Resolving the Kepware Installer "Missing Root Certificates" Error The error message
"The Installer was unable to find required root certificates" typically occurs during the installation or upgrade of KEPServerEX (versions 5.20.396.0 to 7.0) or ThingWorx Kepware Server
. This issue arises when the host operating system lacks the modern root certificates required to verify the digital signature of the installer. Primary Solutions Apply Windows Updates
: The most direct fix is to run Windows Update on the target machine. This allows the OS to automatically download and install the latest Trusted Root Certification Authorities Manual Certificate Installation
: If the machine is offline or cannot be updated, you must manually install the required certificates into the Local Machine Step-by-Step Manual Installation
If Windows Update is not an option, follow these steps to manually update your certificate store: Identify Missing Certificates : Common required root certificates include those from GlobalSign . Specific critical roots often include: GlobalSign Root CA - R3 DigiCert Trusted Root G4 Microsoft Code Verification Root Import via MMC , and press Enter. File > Add/Remove Snap-in Certificates Computer account (Local Computer). Navigate to Trusted Root Certification Authorities > Certificates Right-click, select All Tasks > Import , and browse to your downloaded certificate file. Ensure Correct Storage "The installer was unable to find required root
: For certificates pushed via Group Policy, the installer may still fail to find them unless they are manually re-installed into the Physical Store (specifically the "Registry" location). Common Troubleshooting Blocks Firewall Interference
: Ensure no firewalls or security software (like Kaspersky) are blocking the installer from verifying signatures online. Bootstrap Logs
: If the error persists, check the installation logs (typically found at C:\Program Files (x86)\Kepware\KEPServerEX\bootstrap.log
) to identify exactly which certificate check is failing (e.g., error code
For further assistance, users are encouraged to open a support ticket via the My Kepware portal download links This error indicates that the Windows operating system
for the missing GlobalSign or Microsoft root certificates to begin the manual import? Kepserverex Root Certificate - Google Groups
Here are the five most effective ways to force the installer to recognize the root certificates.
Myth 1: "I can just reinstall Windows to fix this." Reality: A fresh, offline Windows install has no root certificates except a minimal set. A clean install will actually make the error more likely unless you immediately apply root updates.
Myth 2: "My antivirus is deleting the certificates." Reality: AV rarely deletes root certs. However, aggressive "HTTPS scanning" or "SSL inspection" features can intercept certificate validation. Try temporarily disabling AV during installation.
Myth 3: "Kepware is broken; I need an older version." Reality: Older versions (pre-6.0) used SHA-1 certificates, which are now deprecated. Modern Windows rejects them. Downgrading is a security risk and often fails worse. Identify the Certificate: On a separate
When installing Kepware software (such as KEPServerEX, ThingWorx Kepware Server, or specific Kepware drivers), users may encounter a critical halt in the installation process accompanied by the error message:
"The installer was unable to find required root certificates exclusive"
This error indicates that the Windows operating system on the target machine is missing the necessary Trusted Root Certification Authorities required to validate the digital signature of the Kepware installation files. Kepware installers are digitally signed to ensure security and integrity; if Windows cannot verify this signature due to missing root certificates, the installation is blocked to protect the system.
If Kepware tells you which certificate is missing (check the installer log), import it manually.
There are several primary causes:
| Cause | Explanation | |-------|-------------| | Outdated Windows Image | A fresh installation of Windows (especially older builds like 2012 R2, 2016, or LTSC editions) lacks recent root certificate updates. | | Internet Restriction (Air-Gapped) | Kepware is often installed on industrial PCs or SCADA servers that are physically isolated from the internet. Automatic root certificate updates fail. | | Group Policy (GPO) | Corporate security policies have disabled automatic root certificate updates or removed untrusted certificates. | | Corrupt Certificate Store | The Windows certificate store is damaged. | | Time/Date Mismatch | The system clock or timezone is drastically incorrect. Certificate validity depends on accurate time. |
If the machine cannot be connected to the internet, you must manually install the missing certificates.
.exe) and select Properties. Navigate to the Digital Signatures tab. Select the signature and click Details. Note the issuer (commonly DigiCert or Sectigo)..crt or .cer file to the offline machine via USB.