Maintain a folder on your industrial network containing the .CER files of the top 20 Global Root CAs. This saves hours of troubleshooting during future installations.
There are two primary methods to resolve this issue, ranging from the automated approach (recommended) to the manual approach (for strictly offline systems).
This is the most frequent cause. If the target machine is running an older version of Windows (e.g., Windows 7, Windows Server 2008/2012, or an early build of Windows 10) and has not been updated recently, the local certificate store will be outdated. Newer Kepware installers are signed with certificates that rely on modern root authorities (such as DigiCert or Sectigo) that older OS versions do not recognize by default.
Maintain a "golden image" of your Kepware server that includes:
For industrial PCs that cannot connect to the internet, you must manually import the required root certificates. Maintain a folder on your industrial network containing the
Step 1 – Identify the Required Certificate: Kepware installers typically require certificates from DigiCert, Sectigo, or Microsoft Windows Production PCA 2011. The exact root can vary by version, but DigiCert High Assurance EV Root CA is a common requirement.
Step 2 – Download on an Internet-Connected Machine:
Step 3 – Transfer and Install:
The "Exclusive" Power User Trick: If the standard update fails, manually download the specific root certificate from the vendor’s repository: Step 3 – Transfer and Install:
The most common missing certificates for Kepware are:
The error "kepware the installer was unable to find required root certificates exclusive" is not a bug in Kepware itself. It is a symptom of an outdated or misconfigured Windows certificate store. In an era of increasing cybersecurity standards (IEC 62443, NIST SP 800-53), root certificate validation is a mandatory security control.
By following the solutions in this guide—updating Windows root certificates, manually importing the missing CAs, or using advanced bypass switches—you will restore the ability to install Kepware on any industrial PC.
Quick Summary Checklist:
If you have followed all five solutions and still face the error, your Windows installation may have deeper corruption. Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth before contacting PTC Technical Support.
Remember: In the OT world, security and connectivity must coexist. Maintaining a healthy root certificate store is not just about installing Kepware—it is about ensuring the integrity of your entire industrial control system.
Keywords integrated: kepware the installer was unable to find required root certificates exclusive, Kepware installation error, root certificate missing, KEPServerEX installer fails, Windows cryptographic services, PTC Kepware troubleshooting.