---
title: "EPM Windows installer reports that the address is not in the Segura™ application certificate"
slug: "epm-windows-installer-address-not-in-segura-application-certificate"
updated: 2026-11-09T18:09:55Z
published: 2026-11-09T18:09:55Z
canonical: "docs.senhasegura.io/epm-windows-installer-address-not-in-segura-application-certificate"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# EPM Windows installer reports that the address is not in the Segura™ application certificate

The EPM Windows installer blocks the installation because the address given in `URL` does not match any name in the Segura® application certificate. This document covers EPM Windows 4.2.17. This only happens when the Segura™ application certificate is issued by a public certificate authority (CA). If the certificate is issued by a private CA, such as the vault's own CA or an internal CA, the installer does not check the address, and the installation is not blocked by this cause.

## Symptom

- The installer stops with a message saying the address given to the installer is not in the certificate, and EPM Windows is not installed.
- The message lists the names the certificate was issued for.
- The Windows Event Viewer records the error in the **EPM** log, usually with event ID `18001`. The **Details** part of the event shows the reason.

### Cause 1: The `URL` address is not in the certificate

The host name or IP address in the `URL` installation parameter does not appear in the certificate's Subject Alternative Name (SAN) or Common Name (CN).

### Solution: Install with a name the certificate covers

1. Run the installer again, with `URL` set to one of the names the message lists. To use an IP address, the certificate must list it as an IP SAN.
2. On a multi-tenant Segura® Platform, if the listed name is not the tenant's name, issue a certificate that covers the tenant's name. Using the IP address or a `hosts` file alias does not work, because the host name selects the tenant.

### Cause 2: A proxy inspects the TLS traffic

The listed name is not the Segura™ application name, and the message mentions a proxy that inspects TLS traffic. The installer uses the system proxy, so it validates the certificate the proxy presents instead of the Segura™ application certificate.

### Solution: Trust the proxy or exclude the Segura™ application from inspection

Do one of the following, then run the installer again:

- Import the proxy's CA into the **Trusted Root Certification Authorities** store of the local computer. The certificate the proxy generates must also carry the Segura® application name.
- Exclude the Segura® application address from TLS inspection on the proxy.

## For more information

- [EPM Windows agent requirements](/v4-2/docs/epm-windows-requirements)
- [Install the EPM Windows client via CMD](/v4-2/docs/epm-windows-cmd-installation)