# Synctool or PowerShell error - The certificate has expired

## Problem

When you run the Synctool or a custom PowerShell script, you see the following error:

> The certificate has expired. Please link a new certificate to your app and pass the valid value.

You may also see an error in the Entra ID portal indicating that the certificate attached to the Zivver app registration has expired. Go to [portal.azure.com](https://portal.azure.com/) → **Entra ID** → **App registrations** → Search for `Zivver`.

## Cause

You are using a [self-signed certificate](https://learn.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps#step-3-generate-a-self-signed-certificate) for [app-only authentication](https://learn.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps) in Exchange Online. A self-signed certificate has a default expiration period of one year.

## Solution

When the self-signed certificate has expired, you must create a new one and upload it to both the Zivver app registration in Entra ID and the Zivver Synctool.

Tip

**Temporary ‘Log on locally’ permissions** Multiple methods exist to install a certificate in the personal certificate store of a service account. This video demonstrates the use of the **Security Policy ‘Log on locally’** to temporarily allow the service account to run the certificate snap-in for installing the new self-signed certificate.

Make sure to remove the service account from the **Security Policy ‘Log on locally’** afterward, as service accounts should never have permission to log on locally on a Windows Server.

Upgrading the self-signed certificate for connecting the Synctool to Exchange Online - YouTube

Tap to unmute

[Upgrading the self-signed certificate for connecting the Synctool to Exchange Online](https://www.youtube.com/watch?v=-YJ_m6jXFEo) [Zivver](https://www.youtube.com/channel/UCkUmayjA6YaDrwKtuQknleA)

Zivver209 subscribers

If the video doesn’t load on this page, you can [watch it directly on YouTube](https://www.youtube.com/watch?v=-YJ_m6jXFEo).

### Video timestamps

- [Intro](https://youtu.be/-YJ_m6jXFEo)
- [Part 1 – Update the certificate](https://youtu.be/-YJ_m6jXFEo?t=88)
- [Part 2 – Optional: Update the certificate for custom PowerShell scripts](https://youtu.be/-YJ_m6jXFEo?t=505)

### References

- [How to generate a self-signed certificate for app-only authentication](https://learn.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps#step-3-generate-a-self-signed-certificate)
- [How to set up app-only authentication](https://learn.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps)

Updated on 2026-07-03