Renewing Your SSL Certificate on macOS with Let’s Encrypt

Help! You’re a Systems Admin trying to renew or install a shiny new SSL certificate for your PaperCut NG or MF server on macOS-and you want it to just work. We get it. SSL certificates are vital for secure communications between your PaperCut server and its clients. They keep sensitive info like usernames and print job data safe from prying eyes. And with Let’s Encrypt, you can get a free certificate that’s browser-trusted and ready to roll. This step-by-step guide walks you through: Creating a full-chain certificate Importing it into PaperCut’s keystore Restarting PaperCut Checking it all worked 1. Get the required files and build the full-chain bundle You’ll need: 0001_cert.pem — your leaf certificate 0002_chain.pem — the intermediate CA cert(s) To build the full-chain bundle: Open a terminal on your macOS. cat 0001_cert.pem \ 0002_chain.pem \ > trisco.uk-fullchain.crt Order matters: always put the leaf cert first, followed by intermediates (closest to the leaf first). This keeps the TLS handshake happy. 2. Stop PaperCut and back up the Keystore Before making any changes, let’s play it safe: sudo launchctl unload /Library/LaunchDaemons/papercut.plist sudo cp /Applications/PaperCut\ MF/server/server.keystore \ /Applications/PaperCut\ MF/server/server.keystore.bak 3. Build the full-chain file If you already have a full-chain cert—skip ahead! Otherwise, concatenate like this: cat ~/ssl/trisco.uk/trisco.uk.crt \ ~/ssl/trisco.uk/trisco.uk.chain.crt \ > ~/ssl/trisco.uk/trisco.uk-fullchain.crt 4. Import the full-chain certificate Now, let’s drop that certificate into the PaperCut keystore using keytool: sudo /Applications/PaperCut\ MF/runtime/mac/jre/Contents/Home/jre/bin/keytool \-importcert \ -alias jetty \ -file ~/ssl/trisco.uk/trisco.uk-fullchain.crt \ -trustcacerts \ -keystore "/Applications/PaperCut MF/server/server.keystore" \ -storepass changeit 💡 Tip The default keystore password is changeit — unless you’ve changed it (and kudos if you have!). 5. Restart PaperCut Bring PaperCut back to life: # Stop the server (if it's still running) sudo launchctl unload /Library/LaunchDaemons/papercut.plist # Start the server sudo launchctl load /Library/LaunchDaemons/papercut.plist 6. Verify it worked Check the certificate’s expiration date: openssl x509 -in ~/ssl/trisco.uk/trisco.uk.crt -noout -dates Then in your browser head to: https://<your-host>:9192 Click the 🔒 lock icon and make sure your new cert is showing up loud and proud! That’s it! Your PaperCut MF/NG server is now running with a shiny new Let’s Encrypt certificate on macOS. A special note to number of PaperCut Admin’s that have helped improve this article, including Jon R and others.