The EPM Windows installer blocks the installation because the Segura™ application certificate was issued by a certificate authority (CA) the workstation does not trust. This document covers EPM Windows 4.2.17.
Symptom
- The installer stops with a message saying the certificate was issued by a certificate authority the workstation does not trust, and EPM Windows is not installed.
- The Windows Event Viewer records the error in the EPM log, usually with event ID
18001. The Details part of the event shows the statusUntrustedRootorPartialChain.
Cause 1: The root CA is not trusted (UntrustedRoot)
The root CA that issued the Segura™ application certificate is not in the Trusted Root Certification Authorities store of the local computer. EPM runs as Local System, so a CA in the user store does not count.
Solution: Import the root CA into the local computer store
- Import the root CA that issued the Segura™ application certificate into the Trusted Root Certification Authorities store of the local computer. Do not use the user store. For a self-signed certificate, import the certificate itself. To cover many workstations, use a Group Policy Object (GPO).
- Run the installer again.
Cause 2: The certificate chain is incomplete (PartialChain)
Segura™ Platform does not send the intermediate certificates, so the workstation cannot build the chain up to the root CA.
Solution: Send the full certificate chain
- Configure Segura™ Platform to send the full certificate chain, including the intermediate certificates. See How to manage web application SSL certificate.
- Run the installer again.