EPM Windows installer reports that the address is not in the Segura™ application certificate

The EPM Windows installer blocks the installation because the address given in URL does not match any name in the Segura® application certificate. This document covers EPM Windows 4.2.17. This only happens when the Segura™ application certificate is issued by a public certificate authority (CA). If the certificate is issued by a private CA, such as the vault's own CA or an internal CA, the installer does not check the address, and the installation is not blocked by this cause.

Symptom

The installer stops with a message saying the address given to the installer is not in the certificate, and EPM Windows is not installed.
The message lists the names the certificate was issued for.
The Windows Event Viewer records the error in the EPM log, usually with event ID 18001. The Details part of the event shows the reason.

Cause 1: The `URL` address is not in the certificate

The host name or IP address in the URL installation parameter does not appear in the certificate's Subject Alternative Name (SAN) or Common Name (CN).

Solution: Install with a name the certificate covers

Run the installer again, with URL set to one of the names the message lists. To use an IP address, the certificate must list it as an IP SAN.
On a multi-tenant Segura® Platform, if the listed name is not the tenant's name, issue a certificate that covers the tenant's name. Using the IP address or a hosts file alias does not work, because the host name selects the tenant.

Cause 2: A proxy inspects the TLS traffic

The listed name is not the Segura™ application name, and the message mentions a proxy that inspects TLS traffic. The installer uses the system proxy, so it validates the certificate the proxy presents instead of the Segura™ application certificate.

Solution: Trust the proxy or exclude the Segura™ application from inspection

Do one of the following, then run the installer again:

Import the proxy's CA into the Trusted Root Certification Authorities store of the local computer. The certificate the proxy generates must also carry the Segura® application name.
Exclude the Segura® application address from TLS inspection on the proxy.