How to Fix ADSelfService Plus SSL Path Errors (GoDaddy P7B Guide)

If you manage ManageEngine ADSelfService Plus on Windows Server 2022 and rely on GoDaddy for your SSL certificates, you have likely run into the dreaded error:

"Unable to find a valid certificate path. Try uploading additional CA certificates."

This happens because the native ADSelfService interface only lets you upload a single certificate file. If you upload just your main domain certificate, the application lacks the root and intermediate links required to establish a secure chain of trust.

Thankfully, the solution is simple. You just need to package GoDaddy's Apache/CentOS download files into a single, comprehensive .p7b bundle using built-in Windows utilities. Here is the step-by-step breakdown.

Step 1: Prep the GoDaddy Files for Windows

When you download the Apache (CentOS) certificate archive from GoDaddy, you get a handful of files including your primary domain .crt, a -root.pem file, and an -intermediate.pem file. Windows needs to map these out before it can pack them together.

• Locate the -root.pem file. Right-click, select Rename, and change the extension from .pem to .crt.
• Double-click this newly renamed root file, click Install Certificate..., select Local Machine, and click through to finish the wizard.
• Locate the -intermediate.pem file, rename its extension to .crt, and repeat the same Local Machine installation step.

Step 2: Export the Combined .P7B Chain

Now that Windows recognizes the root and intermediate paths locally, it can cleanly bind the whole family history into a single file wrapper.

1. Double-click your primary domain certificate file (e.g., yourdomain-certificate.crt).
2. Navigate to the Details tab at the top of the interface and click Copy to File... to open the Certificate Export Wizard.
3. Click Next, then choose the option for Cryptographic Message Syntax Standard - PKCS #7 Certificates (.P7B).
4. CRITICAL: Make sure to check the box that reads "Include all certificates in the certification path if possible." (This is the exact toggle that eliminates the ManageEngine path error).
5. Click Next, click Browse, choose a destination folder (like your Desktop), and save it as adselfservice.p7b. Click Finish.

Step 3: Upload and Bind in ADSelfService Plus

With your new unified chain ready, you can now feed it directly to your server application.

• Log into the ADSelfService Plus portal with an admin account.
• Go to Admin > Product Settings > Connection.
• Click the Apply SSL Certificate tool button.
• Under the 'Apply Certificate' radio toggle, browse for the adselfservice.p7b file you exported in Step 2.
• Type in the original password you created when generating the Certificate Signing Request (CSR) on this machine, then click Apply.

Final Step: Bounce the Service

The system should accept the file immediately without throwing any path validation warnings. You will be prompted to restart the service to finish the installation.