Endpoint Protection Error Certificate Chain could not be built to a trusted root authority

Question

Need help installing endpoint protection on Windows 8.1. Getting error: 
 Certificate chain could not be built to a trusted root authority: C:\Users\[admin]\AppData\Local\Temp\SophosSetup-xxxxxxxxx\Setup.exe 
 Error downloading/running stage 2: Verify file failed for the stage 1 installer binary. See KB-000044065 (searched everywhere and couldnt find this KB). 
 If anyone could shed me some light on this error, thank you.

Sophos User930 · Accepted Answer

Does running the following commands help from an admin prompt: 
 mkdir C:\digicerttemp 
 cd C:\digicerttemp 
 certutil.exe -urlcache -f https://cacerts.digicert.com/DigiCertTrustedRootG4.crt C:\digicerttemp\DigiCertTrustedRootG4.crt 
 certutil.exe -addstore root C:\digicerttemp\DigiCertTrustedRootG4.crt 
 cd \ 
 rmdir digicerttemp /S /Q

Qoosh · Answer

Hi Kheir, 
 Thank you for reaching out to the Sophos Community Forum. 
 I suggest checking if automatic updating of root certificates is disabled on the affected device. You can find further information on how to check this in the following article. - Automatic Root Certificates Update is turned off, which could lead to installation and communication failures 
 You can also try the following steps to manually import the necessary certificate. 
 
 Access the file referenced in the log: eg:C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe

Access the Properties of the file 
 Click the Digital Signatures tab. 
 Select Sophos Ltd in the Signature list and click Details . 
 Click View Certificate and then click the Install Certificate... 
 On the Certificate Import Wizard select Store Location Local Machine and click Next . 
 Leave the default option Automatically select the certificate store based on the type of certificate selected and click Next, then Finish. 
 The message 'The import was successful' should be displayed. Click OK to exit the windows. 
 Reinitiate the installation. 
 
 If you could post a screenshot of the notification you are receiving, that would be much appreciated, as we should not be referencing outdating KBA's in the hardcoded error messages. Please also verify you are using a newly downloaded installer. 
 Let me know if this works for you.

Endpoint Protection Error Certificate Chain could not be built to a trusted root authority

Top Replies