PRTG Network Monitor: SSL certificate via ACME

Paessler PRTG uses its own PEM file format for the web server instead of the Windows Certificate Store. simple-acme and FairSSL\'s ImportPRTG script automate the whole process: issuance, conversion to PRTG\'s format, backup of the previous files and a restart of PRTG Core Service.

Setup

Step 1: Install simple-acme

Grab FairSSL\'s simple-acme build (pre-configured with the right ACME settings and ships ImportPRTG.ps1 in the Scripts folder). Extract to C:\simple-acme on the PRTG Core Server. No separate management host needed - the PRTG server runs simple-acme itself.

Step 2: Prepare the environment

Domain is set up for FairSSL AutoDNS.
Users open PRTG via the DNS name on the certificate (not a local IP).
Run the command prompt as administrator on the PRTG Core Server.
ImportPRTG auto-detects the PRTG program directory via the service, the registry and default paths.

Step 3: Issue the certificate and install

Run the command from C:\simple-acme as administrator. simple-acme issues the certificate via FairSSL AutoDNS, stores the PEM files, runs ImportPRTG, backs up the existing PRTG files, writes prtg.crt, prtg.key and root.pem and restarts PRTG Core Service.

wacs.exe --verbose --baseuri "https://fairssl.dk/acme" `
  --eab-key-identifier YOUR_EAB_KID --eab-key YOUR_EAB_HMAC --accepttos `
  --source manual --host "prtg.example.com" --validation none `
  --store pemfiles --pemfilespath "C:\simple-acme\Certificates" `
  --pemfilesname "prtg-example-com" --friendlyname "fairssl-prtg-cert" `
  --installation script --script ".\Scripts\ImportPRTG.ps1" `
  --scriptparameters "C:\simple-acme\Certificates prtg-example-com"

Step 4: Custom PRTG install path (optional)

If PRTG is on a non-standard path and auto-detection cannot find the cert folder, supply it as the third script parameter:

--scriptparameters "C:\simple-acme\Certificates prtg-example-com \"D:\PRTG Network Monitor\cert\""

Step 5: Verify

Open the PRTG web interface in a browser and check that the new certificate is served.
Confirm the PRTG cert folder contains prtg.crt, prtg.key and root.pem.
If remote probes need the web server certificate, copy the same three files into their cert folders.
Verify publicly with FairSSL\'s SSL scanner.

Troubleshooting

Browser still shows the old certificate

PRTG caches the web server certificate until Core Service restarts. ImportPRTG restarts PRTG Core Service automatically, but if the script ran under an account without service-restart rights, do it manually: Restart-Service PRTGCoreService.

Script aborts: "source key appears encrypted"

PRTG cannot handle passphrase-protected keys. Run simple-acme without --pemfiles-password or remove the encryption before upload. simple-acme writes unencrypted PEM by default, so you only hit this if you actively added a password parameter.

ImportPRTG cannot find the PRTG program directory

Default location is C:\Program Files (x86)\PRTG Network Monitor. If PRTG runs from another folder, pass the path to the cert subfolder as the third script parameter (see Step 4). Also confirm PRTGCoreService is running so the script can look up ImagePath.

Frequently asked questions

Find answers to the most common questions about SSL certificates and FairSSL.

Where does PRTG keep its web server certificate?

PRTG runs on Windows but does not use the Windows Certificate Store for the web server. It reads three files from the cert folder in the PRTG program directory: prtg.crt (the certificate), prtg.key (unencrypted private key) and root.pem (CA chain). Our ImportPRTG script writes exactly those three files, backs up the old ones and restarts PRTG Core Service.

Will renewal interrupt monitoring?

Only briefly. PRTG Core Service restarts, which pauses the web UI and monitoring for a few seconds. Probes on the same server keep collecting data, and remote probes lose at most a single scan. Schedule renewals outside critical windows if that matters to you.

What about remote probes?

If your remote probes need to present the same web server certificate, copy the three files (prtg.crt, prtg.key, root.pem) into the cert folder on each probe host. Probe-to-Core-Server security uses PRTG's own internal signing and is unaffected by the web server certificate.

PRTG is installed in an unusual path. What do I do?

ImportPRTG normally finds the PRTG program directory via the service, the registry and default install paths. If PRTG is in a non-standard location (e.g. D:\PRTG Network Monitor), pass the cert folder as the third script parameter to skip auto-detection.

Does PRTG need an unencrypted private key?

Yes. PRTG cannot handle passphrase-protected keys. simple-acme issues the private key unencrypted by default, and ImportPRTG normalises line endings so the files read correctly. The script aborts before installation if the source key looks encrypted.

What happens at renewal?

simple-acme schedules a daily task. When ARI or the 7-day fallback triggers a renewal, a new certificate is fetched, ImportPRTG runs again and PRTG Core Service restarts with the new files. No manual action.

Ready to automate PRTG certificates?

Create a free account and issue your first certificate in under 10 minutes.

Create free account Compare certificates