SharePointO365: Create Your Client Key and Certificate on Windows or macOS

Setting up a SharePointO365 connector often leads to the same question: What goes into the Client Key and Client Certificate fields?

You need a matching pair: a public certificate that identifies the application and a private key it uses to prove its identity. In this guide, we’ll create those files, upload the public certificate to Microsoft Entra ID, and enter the right values in Oracle Fusion AI Agent Studio.

Create the files → Upload the certificate → Configure the connector → Test with a known document

This guide covers SharePointO365, which synchronizes documents into Content Intelligence—not the separate Microsoft SharePoint connector used for live API operations. Keep Oracle’s Create a SharePoint Connector guide handy for the overall configuration.

Before you begin

• These examples create a self-signed RSA certificate valid for one year. Use them for an approved test or proof of concept. For production, follow your organization’s certificate and key-management policy.
• You’ll need access to the Entra app registration and the SharePointO365 connector. Your administrator must also verify application permissions, admin consent, and site access.
• Already have a certificate uploaded to Entra? Use its matching private key. A newly generated key won’t match the existing certificate.

Keep the private key private. Never upload it to Entra or include it in email, chat, screenshots, source control, or support attachments. Store it using your organization’s approved process.

What goes where?

Choose the instructions for your computer, then continue with the shared Entra and Oracle steps.

Windows: create the files with PowerShell

PowerShell 7+ is required. The script below specifically requires PowerShell 7.4 or later. Use the latest supported stable version approved by your IT team—not Windows PowerShell 5.1.

You don’t need to install OpenSSL for this Windows procedure.

1. Check your PowerShell version

Open PowerShell 7 from the Start menu and run:

$PSVersionTable.PSVersion

If the version starts with 5, close that window and open PowerShell 7. To install or update PowerShell, follow Microsoft’s Windows installation instructions.

This command shows the installed version; it doesn’t check whether an update is available.

2. Create and export the files

Copy the entire block below into the same PowerShell window.

It creates a new folder under your local application-data directory, restricts access to your Windows account, generates the certificate, and exports the files. You don’t need to edit any usernames or paths.

Leave Cert:\CurrentUser\My unchanged. It identifies a Windows certificate store, not a filesystem folder. The script exports the files separately.

& {
    $ErrorActionPreference = 'Stop'

    if (-not $IsWindows -or $PSVersionTable.PSVersion -lt [version]'7.4') {
        throw 'Open PowerShell 7.4 or later on Windows.'
    }

    Import-Module PKI -SkipEditionCheck -ErrorAction Stop

    $folder = Join-Path $env:LOCALAPPDATA (
        'SharePointO365\' + [guid]::NewGuid().ToString('N')
    )
    New-Item -ItemType Directory -Path $folder -ErrorAction Stop | Out-Null

    $user = [Security.Principal.WindowsIdentity]::GetCurrent().User
    $acl = [Security.AccessControl.DirectorySecurity]::new()
    $acl.SetOwner($user)
    $acl.SetAccessRuleProtection($true, $false)

    $rule = [Security.AccessControl.FileSystemAccessRule]::new(
        $user, 'FullControl', 'ContainerInherit, ObjectInherit',
        'None', 'Allow'
    )
    $acl.AddAccessRule($rule)
    Set-Acl -LiteralPath $folder -AclObject $acl

    $cerPath = Join-Path $folder 'certificate.cer'
    $crtPath = Join-Path $folder 'certificate.crt'
    $keyPath = Join-Path $folder 'pkcs8-privateKey.pem'
    $cert = $rsa = $pair = $null

    try {
        $settings = @{
            Subject           = 'CN=SharePointO365Connector'
            FriendlyName      = 'SharePointO365 Connector Authentication'
            CertStoreLocation = 'Cert:\CurrentUser\My'
            KeyAlgorithm      = 'RSA'
            KeyLength         = 2048
            HashAlgorithm     = 'SHA256'
            KeySpec           = 'Signature'
            KeyUsage          = 'DigitalSignature'
            KeyExportPolicy   = 'Exportable'
            NotAfter          = (Get-Date).AddYears(1)
        }

        $cert = New-SelfSignedCertificate @settings

        if (-not $cert.HasPrivateKey) {
            throw 'The certificate does not have an accessible private key.'
        }

        Export-Certificate -Cert $cert -FilePath $cerPath `
            -Type CERT -NoClobber | Out-Null

        $rsa = [Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)

        if ($null -eq $rsa) {
            throw 'The RSA private key could not be opened.'
        }

        $encoding = [Text.UTF8Encoding]::new($false)

        [IO.File]::WriteAllText(
            $crtPath, $cert.ExportCertificatePem() + "`n", $encoding
        )
        [IO.File]::WriteAllText(
            $keyPath, $rsa.ExportPkcs8PrivateKeyPem() + "`n", $encoding
        )

        # Verify that the exported certificate and private key match.
        $pair = [Security.Cryptography.X509Certificates.X509Certificate2]::CreateFromPemFile(
            $crtPath, $keyPath
        )

        if (-not $pair.HasPrivateKey -or $pair.Thumbprint -ne $cert.Thumbprint) {
            throw 'The exported files did not pass the matching-pair check.'
        }

        Write-Host 'SUCCESS: Certificate and matching PKCS#8 private key created.' `
            -ForegroundColor Green
        Write-Host "Folder: $folder"
        Write-Host "Certificate thumbprint: $($cert.Thumbprint)"
        Write-Host "Certificate expires: $($cert.NotAfter)"

        Invoke-Item -LiteralPath $folder
    }
    finally {
        foreach ($item in @($pair, $rsa, $cert)) {
            if ($item -is [IDisposable]) {
                $item.Dispose()
            }
        }
    }
}

3. Confirm the result

You should see a SUCCESS message, the certificate’s thumbprint and expiry date, and a File Explorer window containing:

• certificate.crt
• certificate.cer
• pkcs8-privateKey.pem

No additional conversion or PFX export is needed. Windows also retains the certificate in your current-user certificate store.

If the script reports an error, stop and ask IT to review it before using any output files.

macOS: create the files with Terminal

On macOS, we’ll use Terminal and OpenSSL. Open Terminal using Spotlight and run:

openssl version

The result may identify OpenSSL or LibreSSL. If a command below isn’t supported, ask IT for an approved OpenSSL installation.

1. Create a private working folder

Run these commands in the same Terminal window:

umask 077
WORKDIR="$(mktemp -d "$HOME/SharePointO365-XXXXXX")"
cd "$WORKDIR"
pwd

The final command shows the folder containing your files. The umask setting restricts access to newly created files.

2. Generate the encrypted source key

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -aes-256-cbc -out encrypted-private-key.pem

Enter and confirm a strong, unique passphrase. Keep it in your approved password manager; don’t include it in the command.

This creates encrypted-private-key.pem.

3. Create the public certificate

openssl req -new -x509 -sha256 -days 365 -key encrypted-private-key.pem -out certificate.crt -subj "/CN=SharePointO365Connector"

Enter the same passphrase when prompted.

This creates certificate.crt, valid for 365 days. The name SharePointO365Connector describes the application credential; it doesn’t need to match your SharePoint hostname.

A separate certificate signing request, or CSR, isn’t needed for this self-signed example.

4. Export the key in the format used by the connector

openssl pkcs8 -topk8 -inform PEM -outform PEM -in encrypted-private-key.pem -out pkcs8-privateKey.pem -nocrypt

Enter the passphrase again.

This exports the same private key as unencrypted PKCS#8 PEM. It doesn’t generate a new key.

The output file is no longer passphrase-protected. Protect pkcs8-privateKey.pem using your approved secure-storage process.

5. Check the files

Check the private key, certificate dates, and PEM header without displaying the private-key contents:

openssl rsa -in pkcs8-privateKey.pem -check -noout

openssl x509 -in certificate.crt -noout -subject -dates -fingerprint -sha1

head -n 1 pkcs8-privateKey.pem

The private-key header should be:

-----BEGIN PRIVATE KEY-----

The certificate fingerprint is an identifier for comparison with Entra; it doesn’t change the certificate’s SHA-256 signature.

Now confirm that the certificate and private key match:

set -o pipefail

openssl pkey -in pkcs8-privateKey.pem -pubout -outform DER | openssl dgst -sha256

openssl x509 -in certificate.crt -pubkey -noout | openssl pkey -pubin -outform DER | openssl dgst -sha256

Both commands must complete successfully and return the same SHA-256 value. If they differ, stop before uploading anything.

Your two connector files are now ready:

• certificate.crt
• pkcs8-privateKey.pem

Upload the public certificate to Microsoft Entra ID

The following steps are the same for Windows and macOS.

1. Open the Microsoft Entra admin center and select the directory associated with the SharePoint site.
2. Go to App registrations and open the application approved for the connector. If a new registration is needed, have your administrator create it with the appropriate tenant setting.
3. On Overview, record the Application (client) ID and Directory (tenant) ID.
4. Select Certificates & secrets → Certificates → Upload certificate.
5. Upload certificate.crt, add a recognizable description, and select Add. Windows users can alternatively upload certificate.cer.
6. Confirm that the certificate appears and that its expiry and thumbprint match your local output.

Upload only the public certificate—not either private-key file.

Before continuing, ask your administrator to verify the required SharePointO365 permissions, admin consent, and site access. Uploading a certificate establishes an application credential; it doesn’t grant SharePoint access.

Permission requirements for the separate live Microsoft SharePoint connector aren’t interchangeable with this setup.

Enter the values in Oracle Fusion AI Agent Studio

Open Tools → AI Agent Studio → Credentials → Connectors and add or edit your SharepointO365 connector.

Open the files in Notepad on Windows or a plain-text editor on macOS. Copy the contents, not the filename or path.

Include the first and last lines, preserve actual line breaks, and don’t add quotation marks or Markdown backticks.

For this certificate-based setup, Client Key means the private-key PEM text—not an Entra client secret, certificate ID, or thumbprint.

Test with a document you know

After saving the connector with the approved site and folder scope:

1. Run the Content Intelligence synchronization process.
2. Confirm that the expected documents appear in Authoring.
3. Test retrieval using a question whose answer you can verify in a source document.

For example, if an approved policy explains who approves a leave request, ask: “Who approves a leave request?”

Saving the connector alone doesn’t confirm that ingestion, indexing, and retrieval have completed.

If something doesn’t look right

Already have a key in another PEM format?

These headers identify different formats:

Your administrator can export an unencrypted PKCS#8 copy using:

openssl pkcs8 -topk8 -inform PEM -outform PEM -in existing-private-key.pem -out pkcs8-privateKey.pem -nocrypt

Keep the input and output filenames different. Converting a key that is already correct won’t resolve unrelated authentication or permission issues.

Keep the pair safe—and plan for renewal

Store the private key securely, avoid cloud-synced working folders, and clear clipboard history according to your security policy after setup. File-access restrictions don’t encrypt an unencrypted private key.

Record the certificate owner and expiry date. When renewing, upload the replacement public certificate to Entra and update Oracle with the matching key and certificate. Test the replacement before retiring the previous credential.

Final thoughts

Windows and macOS use different tools, but the handoff is the same: upload the public certificate to Entra, enter the matching PEM values in Oracle, and validate the connector with a known document.

Learn more

• Oracle: Create a SharePoint Connector
• Oracle: Verify synchronized content in Authoring
• Microsoft: Create a self-signed certificate
• Microsoft: Add and manage app credentials
• Microsoft: Install PowerShell on Windows
• OpenSSL: Generate a private key
• OpenSSL: Create a certificate
• OpenSSL: Convert PKCS#8 private keys