How to renew Office Online and OWA Certificate

When users suddenly cannot open Word, Excel, or PowerPoint documents directly from SharePoint, an expired Office Online Server certificate is one of the first things a SharePoint administrator should investigate. The SharePoint sites themselves may remain accessible, but document previews and browser-based editing can fail because the certificate used for secure communication is no longer valid.

Renewing the certificate is usually straightforward when the Office Online Server farm is healthy. The challenge is knowing which configuration to update, how to verify the relevant service, and what to check if the renewal does not resolve the issue.

This guide explains two approaches to renewing an Office Online Server (OOS) certificate, including the PowerShell method and a manual certificate replacement approach. It also covers the checks that help restore document access without introducing additional configuration problems.

Why an Expired Office Online Certificate Breaks SharePoint Documents

SharePoint Server can rely on Office Online Server to render Office documents in a browser. When a user opens a supported document, SharePoint communicates with the Office Online Server farm to provide browser-based viewing or editing.

Secure communication depends on a valid TLS certificate. If that certificate expires, has the wrong name, or is not trusted by the connecting systems, the browser-based document experience may stop working.

Typical symptoms include:

Word, Excel, or PowerPoint documents failing to open in the browser.
Document previews displaying an error instead of the file contents.
Users being redirected to an error page when opening documents.
SharePoint pages loading normally while Office document functionality remains unavailable.

An expired certificate is a strong candidate when these symptoms appear near the certificate’s expiration date. However, administrators should also investigate TLS configuration, certificate trust, and connectivity if replacing the certificate does not resolve the problem.

Before You Renew the Certificate

Obtain a replacement certificate from a trusted certificate authority (CA), or use a self-signed certificate if that is appropriate for your environment and trust configuration.

Before making changes, confirm the following:

Certificate validity: The replacement certificate is within its validity period.
Correct identity: The certificate’s subject or Subject Alternative Name (SAN) matches the hostname used to access Office Online Server.
Private key availability: The certificate is installed with its associated private key.
Trust chain: The connecting SharePoint servers and clients trust the certificate and its issuing chain, as applicable.
Certificate permissions: The required services can access the private key.
Farm health: The Office Online Server farm and its services are operational.

Also, record the current certificate’s friendly name and expiration date. If you are working in a production environment, arrange a maintenance window where necessary and preserve a recovery path before changing the farm configuration.

Method 1: Renew the Certificate Using PowerShell

The preferred starting point is to update the certificate configured for the Office Online Server farm through its supported PowerShell administration interface.

Step 1: Install the replacement certificate

Import the new certificate into the Local Computer certificate store on the appropriate Office Online Server machine. For a farm, follow the certificate deployment requirements for every relevant server rather than assuming that installing it on one machine is sufficient.

Verify that the certificate appears under:

Certificates (Local Computer) → Personal → Certificates

Check its expiration date, friendly name, subject or SAN, and private key availability.

Step 2: Check the WACSM service

Open an elevated PowerShell session on the Office Online Server machine and run:

Get-Service WACSM

The command returns the service status. If WACSM is running, that is a useful initial health check and supports proceeding with the farm configuration update.

However, a running service alone does not prove that the entire farm is healthy or that the new certificate is correctly installed.

If the service is stopped or reports an unexpected state, investigate the service and farm health before attempting the renewal.

Step 3: Update the farm certificate

Run the following command, replacing the example name with the exact friendly name of the replacement certificate:

Set-OfficeWebAppsFarm -CertificateName "New certificate Friendly name"

The -CertificateName parameter identifies the certificate that the farm should use. Make sure the name matches the installed certificate’s friendly name exactly.

After the command completes, review any output or errors and verify that the configuration reflects the intended certificate.

Important: Do not assume the certificate change is successful simply because PowerShell accepts the command. Confirm that the certificate is valid, accessible, and correctly configured for the farm.

Step 4: Test SharePoint document access

Return to SharePoint and test a representative Word or Excel document in the browser. If possible, test with a standard user account as well as an administrator account.

Confirm that:

The document opens without a certificate or TLS error.
Browser-based viewing or editing works as expected.
Other Office document types behave normally.
No new service or connectivity errors appear.

If the farm is healthy and the certificate is correctly configured, this approach is generally the simplest way to complete the renewal.

Method 2: Replace the Certificate While Preserving Its Name

A second approach described in some Office Web Apps Server environments is to replace the expired certificate with a new certificate that uses the same friendly name.

This method involves the Windows certificate store and the Office Online Server farm’s configuration files. It is more invasive than updating the farm through PowerShell, so use it only when appropriate for your specific server version and after reviewing supported Microsoft guidance.

Step 1: Open the Local Computer certificate store

On the Office Online Server machine:

Open the Microsoft Management Console (MMC) by running mmc.exe.
Select File → Add/Remove Snap-in.
Add the Certificates snap-in for the Computer account.
Select Local computer and finish the wizard.
Navigate to Certificates (Local Computer) → Personal → Certificates.

Locate the expired certificate and record its friendly name before making any changes.

Import the replacement certificate, ensuring that it has the correct identity, private key, and trust configuration.

If you intend to use the same-name replacement approach, make sure the new certificate’s friendly name matches the name expected by the existing configuration.

Do not delete the old certificate until you have verified the replacement, backed up relevant configuration, and established an appropriate rollback plan. Removing a certificate prematurely can make recovery more difficult.

Step 2: Inspect the farm configuration

The configuration file referenced in the original procedure is:

C:\ProgramData\Microsoft\OfficeWebApps\Data\FarmState\settings.xml

The ProgramData directory is hidden by default, so enter the full path directly in File Explorer if necessary.

Before inspecting or changing the file, create a protected backup and follow the supported configuration-management guidance for your Office Online Server version.

The manual procedure involves locating the certificate name in settings.xml and checking whether it matches the imported certificate’s friendly name. However, this file is part of the product’s internal farm state. Directly editing it is not a routine certificate-renewal method and may be unsupported or overwritten by the service.

Prefer the documented PowerShell method. Do not modify the XML file in production merely because a certificate name appears incorrect. Confirm the appropriate recovery procedure with Microsoft documentation or support before making manual changes.

Step 3: Restart the service if required

The original procedure uses the following PowerShell command to restart the service:

Restart-Service WACSM

A service restart can interrupt active document sessions. Use an approved maintenance window and verify the service’s status afterward.

Get-Service WACSM

If the service fails to start or the farm remains unavailable, review service errors and farm health before making further changes.

Troubleshooting: What If Documents Still Do Not Open?

Renewing a certificate will not resolve every browser-based document problem. If SharePoint document access remains broken, investigate the following areas.

Check TLS configuration

An incorrect TLS configuration can prevent secure communication even when the certificate itself is valid. Confirm that the supported TLS protocols and cipher suites are configured appropriately for your Windows Server and Office Online Server versions.

Review the TLS troubleshooting guidance in your environment, especially if the failure began after a security hardening change or server update.

Verify certificate identity and trust

Check the hostname used by SharePoint to reach Office Online Server against the certificate’s SAN entries. Confirm that the full certificate chain is trusted and that the replacement certificate has not been installed without its private key.

Review farm and service health

Check the WACSM service status, Office Online Server farm configuration, and relevant Windows event logs. In a multi-server farm, verify certificate deployment and configuration consistency across the relevant servers.

Retest the complete document workflow

Test a document from the actual SharePoint site and network path used by affected users. A certificate that appears valid in MMC may still fail when the service presents it or when a connecting server does not trust the issuing authority.

Practical Takeaway: Renew First, Validate Second

When an Office Online Server certificate expires, start by obtaining a valid replacement, checking the WACSM service, and updating the farm with Set-OfficeWebAppsFarm -CertificateName. This is the preferred route when the farm is functioning correctly.

Treat direct replacement through MMC and manual modification of settings.xml as a higher-risk recovery scenario, not the default renewal procedure. Back up configuration, confirm the supported process for your server version, and avoid deleting the existing certificate before validating the replacement.

Finally, test real SharePoint document access and investigate TLS, trust, and farm health if the issue persists. A successful certificate renewal should restore the secure connection that Office Online Server needs to deliver browser-based Office documents.

The next step for SharePoint administrators is to audit certificate expiration dates across the farm, document the renewal procedure, and establish reminders well before the next expiry date. That small operational improvement can prevent an avoidable certificate issue from becoming a document-access incident.