Security Certificate for EWS

[DougD55]

I am using the edge browser on a Windows 10 computer. I tried the same thing using Chrome with the same results. When I open the web site for the embedded web server there is a red strike through on the HTTPS part of the address and it says the site is not secure. The site opens up, but I can't enter the secure areas where I need to enter the PIN. I understand that I need to create a new certificate, but I am not sure how to do that. When I go into the EWS under security there is a place where you can import a new certificate, however you need to enter your pin and when you do that you get kicked out. 

[zoey7886]

@DougD55, Welcome to the HP Support Community!  

Thanks for reaching out about your query regarding Security Certificate Issues for EWS! 

We're thrilled to have the opportunity to assist you and provide a solution.  

When accessing the Embedded Web Server (EWS) of your HP printer on browsers such as Microsoft Edge or Google Chrome, you might encounter a security certificate warning indicating that the site is not secure. Here are the steps to address this issue:

Accessing EWS Despite Security Warning

1. Open the EWS:
   • Type the printer's IP address into the browser's address line and press Enter.
   • If you see a security certificate message, click "Continue to this website (not recommended)" to proceed to the EWS homepage. This action is safe for administrative purposes and does not harm your computer.

Generating a New Certificate

If you need to create a new certificate to avoid future warnings and access secure areas requiring a PIN, follow these steps:

Log into the EWS:

• On the EWS homepage, click "Login" and enter "admin" as the username and use the WPS Security PIN (usually found on a self-test or network configuration report) as the password.

Generate a New Security Certificate:

• Navigate to the "Security" tab.
• Select "Certificate Management".
• Click "Create New Certificate" to generate a new self-signed certificate.

Installing the New Certificate on Your Computer

Download the New Certificate:

• From the Certificate Management section, download the newly created certificate to your computer.

Install the Certificate:

• On Windows:
  • Open the Run dialog (Windows + R), type certmgr.msc, and press Enter.
  • In the Certificate Manager, select "Trusted Root Certification Authorities".
  • Right-click "Certificates", select "All Tasks" > "Import".
  • Follow the wizard to import the downloaded certificate. 

Hope this helps! 

Take care, and have an amazing day!  

Did we resolve the issue? If yes, Please consider marking this post as "Accepted Solution" and click "Yes" to give us a helpful vote - your feedback keeps us going!  

Regards, 

[DougD55]

On my Windows 11 computer, I enter the Ip address for my printer in the address bar of my Edge browser. The EWS page is displayed, I am not prompted to log in as an administrator. I cannot enter any of the areas where I am required to enter my known PIN. In the upper right-hand corner of the page there is a sign in sign out link and it is not displaying my ID, so I am guessing it does not know who I am. If I click on it to log in, I am met with the dialogue to enter my PIN and I am kicked out.

[zoey7886]

@DougD55, Thanks for the update—and I hear your frustration loud and clear. It’s definitely annoying when you're doing everything right and still getting stonewalled.

What’s likely happening is a loop caused by the outdated or untrusted certificate. When the browser doesn’t trust the certificate, it blocks secure functions—like logging in with your PIN—even if the rest of the page loads.

Here’s what you can try:

🔹 Clear the browser cache and cookies—sometimes it helps shake off old session data.
🔹 Then, when you’re at the EWS page, click on the “Not secure” warning in the address bar, and try to view or download the certificate.
🔹 Export the certificate, then manually install it on your computer as a Trusted Root Certificate Authority (via certmgr.msc → Right-click on "Trusted Root Certification Authorities" → Import).

Once Windows trusts it, the PIN login should no longer get kicked out by your browser.

Let me know how it goes—we’ll get this sorted.

Hope this helps! 

Take care, and have an amazing day!  

Did we resolve the issue? If yes, Please consider marking this post as "Accepted Solution" and click "Yes" to give us a helpful vote - your feedback keeps us going!  

Regards, 

[DougD55]

On my Windows 11 computer logged in as an administrator I was able to copy the certificate file to my local hard drive.

Following your instructions I opened a command prompt and executed certmgr.msc , I imported it as a trusted root certificate authority as per your instructions.  I rebooted my computer and tried to run the EWS web server again. Nothing much changed. This time I receive the message that it was not secure and did I want to proceed. I am still not able to enter my pin on any of the pages that require it. 

HP is a very large global company, security issues are very complex, and this was an expensive printer.  How is it that Microsoft can install and update Office on my computer without me doing searches on the internet to resolve security issues. This is an issue HP created and should be handling and not expecting their customers to spend hours fixing their security problems.     

[DougD55]

After completing the previous steps, you suggested things have gotten worse. It seems like clicking on anything brings you to the page where you have to enter your pin and I now get this message:

If I click on continue there is no place to enter admin, and the page just pops up. When I click on Certificate Manager I am presented with the screen that asks for my PIN and I get kicked out.

This case needs to be escalated to the next level of support.

[zoey7886]

@DougD55, Welcome to the HP Support Community! 

We're here to help you tackle that Security Certificate for EWS! Don't worry, we've got your back! 

To get you the best assistance, we need to take this conversation to a private chat. We're inviting you to a private message to protect your privacy and ensure that any sensitive information remains confidential. 

To access your private message, just click the little blue envelope icon on the upper right corner of your HP Community profile, next to your profile name.  

We're looking forward to helping you resolve this issue! 

Stay tuned, and thanks for your patience! 

Regards, 

[DougD55]

Not only does this impact the EWS it also affects the HP Smart App. In researching this it seems that HP is not using best practices to create the self-signed certificate.  This may work with older web browsers like Firefox but not with the most recent versions of Chrome and Edge that are adhering to best practices. Thinking about this from a security perspective why would you allow the application developer to sign the security certificate? Some bad actor could develop malicious code and sign their own security certificate; you want a third party to say this code is safe.