Kepware The Installer Was Unable To Find Required Root Certificates Exclusive !exclusive! -
: If manual installation fails, PTC Kepware Support recommends opening a ticket through My Kepware to receive the specific certificate chain files required for your server version.
Press Win + R , type , and press Enter to launch the Microsoft Management Console.
If an internet path is open but the feature is blocked by policy, verify that the policy is set to Disabled or Not Configured under: Local Computer Policy > Computer Configuration > Administrative Templates > System > Internet Communication Management > Internet Communication Settings .
The simplest and most direct solution recommended by PTC is to ensure your Windows system is fully updated.
To his surprise, this worked! The installer suddenly found the required root certificates, and Kepware installed successfully. John breathed a sigh of relief, feeling a mix of relief and accomplishment. : If manual installation fails, PTC Kepware Support
The most common missing certificates for Kepware are:
: The most direct fix is to connect the machine to the internet and run Windows Update to automatically refresh the local Trusted Root Certification Authorities store.
If no results appear, you know you need Method 2.
Right-click the downloaded .crt file and select . Choose Local Machine and click Next. Select Place all certificates in the following store . The simplest and most direct solution recommended by
:
To avoid this issue in the future:
Need further assistance? Contact PTC Kepware support with the installer log file (located in %temp%/PTC_Kepware_Install.log).
The most direct fix is to download and install the required certificates yourself. Locate a Working Computer Find a machine with full internet access. Open a web browser. Download the Root Certificates John breathed a sigh of relief, feeling a
Resolving the “exclusive root certificate” failure is a lesson in bridging security silos. The immediate fix involves manually updating the Windows root certificate store. On an online machine, simply running Windows Update or installing the “Update for Root Certificates” (KB931125) often suffices. For air-gapped systems, an administrator must export the required root certificate from an internet-connected machine (by examining the digital signature of the Kepware executable or its installer) and then import it into the offline machine’s Trusted Root store using the Microsoft Management Console (MMC) Certificates snap-in. A more subtle solution involves temporarily disabling certain antivirus or application control software that intercepts certificate validation. Some hardened security suites inject their own roots or block access to the default Windows store, causing the Kepware installer to see an empty or altered store. Ultimately, the error forces a choice: relax restrictive security policies just enough to allow the legitimate root, or accept that modern industrial software requires periodic trust maintenance.
If you cannot use the official patch and Windows Update is not an option, you can manually import the certificates. You will need to identify and download the specific certificate files (usually in .cer , .crt , or .p7b format).
By following the methods in this guide—especially the for air-gapped networks—you can bypass this roadblock in minutes.
