# Fix an SSL Certificate Thumbprint Without the Console

> Read and update the certificate thumbprint for the MDM and Front-end services directly in the CapaInstaller database when the console isn't available.

Source: https://docs.capaone.com/capainstaller/knowledge-base/fix-an-ssl-certificate-thumbprint-without-the-console/  
Product: CapaInstaller — a separate CapaSystems product; do not apply this page to any other.

This article describes how to view and correct the SSL certificate thumbprint for the Mobile
Device Management (MDM) Service and the Front-end Service directly in the CapaInstaller database.
Use this when the CapaInstaller console can't reach the service, for example a Front-end Service
placed in the DMZ, and [Configuring or Updating a Certificate](/capainstaller/the-capainstaller-console/system-administration/how-to-use-system-administration/configuring-or-updating-a-certificate/)
isn't an option.

:::caution
Editing the database directly bypasses the validation the console normally performs. Back up the
database before making changes, and prefer the console method whenever it's available.
:::

## Find the current thumbprint

The thumbprint is stored as a `CertificateThumbprint` variable in the `SERVICECONFIG` table, linked
to its service through `SERVICEID`. Run the query for the service type you're checking.

**Front-end Service**

```sql
SELECT s.*, sc.*
FROM SERVICE s
INNER JOIN SERVICECONFIG sc ON sc.SERVICEID = s.ID
WHERE s.TYPE = 'cifrontend'
  AND sc.VARIABLE = 'CertificateThumbprint';
```

**MDM Service**

```sql
SELECT s.*, sc.*
FROM SERVICE s
INNER JOIN SERVICECONFIG sc ON sc.SERVICEID = s.ID
WHERE s.TYPE = 'cimdm'
  AND sc.VARIABLE = 'CertificateThumbprint';
```

The `VALUE` column of the returned row holds the thumbprint currently configured for the service.

![Result of the Front-end Service query in SQL Server Management Studio, showing the CertificateThumbprint variable and its VALUE column](/attachments/capainstaller/cifrontend-certificatethumbprint-query-result.png)

## Update the thumbprint

To correct the thumbprint, update the same `VALUE` column. Replace `<NewThumbprint>` with the
thumbprint of the certificate as it appears in the Windows Personal Certificate Store, with no
spaces.

**Front-end Service**

```sql
UPDATE sc
SET sc.VALUE = '<NewThumbprint>'
FROM SERVICECONFIG sc
INNER JOIN SERVICE s ON sc.SERVICEID = s.ID
WHERE s.TYPE = 'cifrontend'
  AND sc.VARIABLE = 'CertificateThumbprint';
```

**MDM Service**

```sql
UPDATE sc
SET sc.VALUE = '<NewThumbprint>'
FROM SERVICECONFIG sc
INNER JOIN SERVICE s ON sc.SERVICEID = s.ID
WHERE s.TYPE = 'cimdm'
  AND sc.VARIABLE = 'CertificateThumbprint';
```

:::note[Important]
The thumbprint must match a certificate already imported into the Windows Personal Certificate
Store on the server hosting the service. See
[Certificate handling in CapaInstaller](/capainstaller/the-capainstaller-console/system-administration/how-to-use-system-administration/certificate-handling-in-capainstaller/)
for how to import one.
:::

Restart the service on its host server for the new thumbprint to take effect.