SolarWinds Platform Install or Upgrade Fails with Product Catalog Signature Validation (Authenticode UnknownError) Due to Missing Root Certificate

When you run the SolarWinds installer or start a Centralized Upgrade (CU), the installer verifies the digital signature of the product catalog before continuing. This check confirms the download is authentic and has not been tampered with.

The signature check relies on the Windows machine having the correct root certificate in its Trusted Root Certification Authorities store. If that root certificate is missing or outdated, Windows cannot validate the signature and the installation stops with an error.

Affected actions:

• Running the online or offline installer
• Running a Centralized Upgrade (CU)
• Upgrading to SolarWinds Platform 2026.2 (both online and offline installers)

You may also see the following entries in C:\ProgramData\SolarWinds\Logs\Administration\AdministrationService.log on the SolarWinds Platform server. These confirm the catalog signature could not be verified even though the SolarWinds signing certificate itself is valid (verification returns UnknownError, which indicates the certificate chain could not be validated on the server):

YYYY-MM-DD HH:MM:SS  ERROR  Verify Signature "...\SolarWinds\SWA\<file>.psd1": Authenticode verification UnknownError
YYYY-MM-DD HH:MM:SS  ERROR  Error occurred during product catalog signature verification
YYYY-MM-DD HH:MM:SS  ERROR  Can't retrieve product catalog from DB
YYYY-MM-DD HH:MM:SS  ERROR  Failed to store Product Catalog to database. Cannot read Product Catalog from cache
YYYY-MM-DD HH:MM:SS  ERROR  Unable to get latest version from catalog ... System.Security.SecurityException ... Authenticode verification UnknownError

Example of the error users see during installation:

Figure 1: Product catalog signature validation error displayed by the installer.

The root certificate commonly involved in this signature validation is:

Microsoft Identity Verification Root Certificate Authority 2020

Note: A similar but separate error can occur when the installer cannot connect to https://downloads.solarwinds.com. That connection error is caused by a different missing certificate and is not covered by this article. This article covers the signature validation failure only.

The Windows server is missing the required root certificate in the Trusted Root Certification Authorities store, so the signature on the product catalog cannot be validated.

This typically happens when:

• The server has no internet access (offline or air-gapped environment), so Windows cannot automatically retrieve missing root certificates.
• The Windows "Automatic Root Certificates Update" feature is turned off, so missing root or intermediate certificates are not retrieved automatically.
• The required root certificate has not yet been installed on the server.

First, confirm the required root certificate is missing.

1. On the affected server, press Windows + R, type certlm.msc, and press Enter (this opens Certificates for the Local Computer).
2. Expand Trusted Root Certification Authorities > Certificates.
3. Look for Microsoft Identity Verification Root Certificate Authority 2020.
• If it is present, this article does not apply. The cause is something else (for example, a revocation check failure or connection issue). Escalate as needed.
• If it is missing, continue with the option below that matches the environment.

Option 1 - Online environment (server has internet access)

** Note that running the command will add many more non-related certificates (approximately 500~) to the Trusted Root Certificate folder.

Use this option when the server can reach the internet. Run PowerShell as Administrator.

1. Download the latest root certificates from Windows Update:
   

    certutil -generateSSTFromWU "$env:TEMP\roots.sst"

2. Import them into the Local Machine Trusted Root store:
   

    Import-Certificate -FilePath "$env:TEMP\roots.sst" -CertStoreLocation Cert:\LocalMachine\Root

3. Confirm Microsoft Identity Verification Root Certificate Authority 2020 now appears under Trusted Root Certification Authorities (see steps 1-3 above).
4. Re-run the installation or Centralized Upgrade.

Alternative for online environments: Ensure the Windows Group Policy "Turn off Automatic Root Certificates Update" is set to Disabled (or Not Configured) so Windows can retrieve missing certificates automatically.

Import-Certificate -FilePath "C:\Temp\MS-Identity-Root-2020.cer" -CertStoreLocation Cert:\LocalMachine\Root