---
title: "EPM Windows installer does not trust the Segura™ application certificate"
slug: "epm-windows-installer-does-not-trust-the-segura-application-certificate"
updated: 2026-11-03T20:31:55Z
published: 2026-11-03T20:31:55Z
canonical: "docs.senhasegura.io/epm-windows-installer-does-not-trust-the-segura-application-certificate"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# EPM Windows installer does not trust the Segura™ application certificate

The EPM Windows installer blocks the installation because the Segura™ application certificate was issued by a certificate authority (CA) the workstation does not trust. This document covers EPM Windows 4.2.17.

## Symptom

- The installer stops with a message saying the certificate was issued by a certificate authority the workstation does not trust, and EPM Windows is not installed.
- The Windows Event Viewer records the error in the **EPM** log, usually with event ID `18001`. The **Details** part of the event shows the status `UntrustedRoot` or `PartialChain`.

### Cause 1: The root CA is not trusted (`UntrustedRoot`)

The root CA that issued the Segura™ application certificate is not in the **Trusted Root Certification Authorities** store of the local computer. EPM runs as Local System, so a CA in the user store does not count.

### Solution: Import the root CA into the local computer store

1. Import the root CA that issued the Segura™ application certificate into the **Trusted Root Certification Authorities** store of the local computer. Do not use the user store. For a self-signed certificate, import the certificate itself. To cover many workstations, use a Group Policy Object (GPO).
2. Run the installer again.

### Cause 2: The certificate chain is incomplete (`PartialChain`)

Segura™ Platform does not send the intermediate certificates, so the workstation cannot build the chain up to the root CA.

### Solution: Send the full certificate chain

1. Configure Segura™ Platform to send the full certificate chain, including the intermediate certificates. See [How to manage web application SSL certificate](/v4-2/docs/orbit-cli-how-to-manage-web-application-ssl-certificate).
2. Run the installer again.

## For more information

- [EPM Windows agent requirements](/v4-2/docs/epm-windows-requirements)
- [Certificates](/v4-2/docs/orbit-web-reference-for-certificates)