Cisco
Login
Search
Software Secure Workload
Activity Configure

Deploy Software Agents on Workloads Frequently Asked Questions Certificate Issues Windows

Last updated: Jun 09, 2025

Windows

Certificate Issues for MSI installer

MSI installer is signed using code signing certificate:

For MSI Installer, version 3.6.x onwards and 3.5.1.31 onwards

  • Leaf Certificate: Cisco Systems, Inc

  • Intermediate Certificate: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1

  • Root Certificate: DigiCert Trusted Root G4

For MSI Installer, earlier versions

  • Leaf Certificate: Cisco Systems, Inc

  • Intermediate Certificate: Symantec Class 3 SHA256 Code Signing CA

  • Root Certificate: VeriSign Class 3 Public Primary Certification Authority - G5

It uses timestamp certificate:

For MSI Installer, version 3.6.x onwards and 3.5.1.31 onwards

  • Leaf Certificate: Symantec SHA256 TimeStamping Signer - G3

  • Intermediate Certificate: Symantec SHA256 TimeStamping CA

  • Root Certificate: VeriSign Universal Root Certification Authority

For MSI Installer, earlier versions

  • Leaf Certificate: Symantec SHA256 Timestamping Signer - G2

  • Intermediate Certificate: Symantec SHA256 Timestamping CA

  • Root Certificate: VeriSign Universal Root Certification Authority

Windows Sensor Installation or upgrade will fail if digital signature of MSI installer is invalid. Digital signature is invalid if

  • MSI Installer Signing Root Certificate or MSI Installer timestamp Root Certificate is not in a “Trusted Root Certification Authority” store

  • MSI Installer Signing Root Certificate or MSI Installer timestamp Root Certificate is expired or revoked.

Issue 1

Installation of agent might fail with below error in the TetUpdate.exe.log “Msi signature is not trusted. 0x800b0109"

Resolution

  • Run the command certmgr from command prompt

  • Check if MSI Installer Signing Root Certificate or MSI Installer timestamp Root Certificate is in Untrusted Certificates store.

  • Move it to Trusted Root Certification Authority store.

Issue 2

Windows Sensor upgrade fails with the following error in TetUpdate.exe.log “Msi signature is not trusted. 0x800B010C"

A certificate was explicitly revoked by its issuer.

Resolution

  • Run the command certmgr from command prompt

  • Check if MSI Installer Signing Root Certificate or MSI Installer timestamp Root Certificate is in Untrusted Certificates store.

  • Copy it to Trusted Root Certification Authority store.

Issue 3

Windows Sensor upgrade fails with the following in TetUpdate.exe.log “Msi signature is not trusted. 0x80096005"

Resolution

  • Run the command certmgr from command prompt

  • Check if MSI Installer Signing Root Certificate and MSI Installer timestamp Root Certificate is in “Trusted Root Certification Authority” store

If it the certificate is missing, import it from other machine.

To import the certificate, follow below steps:

First export the certificate VeriSign Universal Root Certification Authority from one of Working server. Follow below steps:

  • Run the command certmgr from command prompt

  • Right click on the certificate “VeriSign Universal Root Certification Authority” under “Trusted Root Certification Authorities” and go to All tasksExport.

  • Copy the exported certificate to the Non-working server and then import the certificate.

To import the certificate, follow below steps:

First export the certificate VeriSign Universal Root Certification Authority from one of Working server. Follow below steps:

  • Run the command certmgr from command prompt

  • Right click on the certificates tab under Trusted Root Certification Authorities and go to All tasksImport.

  • Select the Root certificate that you copied and add it in the store.

Previous topic Certificate Issues Next topic Certificate Issues for NPCAP installer