F-Secure product installation fails with error "Could not validate the server certificates and create a secure connection to the service. Make sure that your Windows has the latest updates and try again."

F-Secure product installation fails with error "Could not validate the server certificates and create a secure connection to the service. Make sure that your Windows has the latest updates and try again." - F-Secure Community

Issue:

I verified that Windows has the latest updates installed, but still F-Secure product installation fails due to error "Could not validate the server certificates and create a secure connection to the service. Make sure that your Windows has the latest updates and try again.". What can I do?
The installation fails with error: "The certificates from the server could not be verified, make sure that the windows updates are installed."
The certificates of the download server could not be verified. Make sure you have the latest windows updates and try again.

Resolution:

The error is typically caused when Windows updates are disabled. Make sure that Windows updates are installed. If the problem continues with all Windows updates installed, proceed to try the following workaround:

There may be some problems adding the needed certificate from third party Root Certification Authorities store. F-Secure currently uses the Digicert Root CA. You can try to install the certificate manually from https://www.digicert.com/CACerts/DigiCertGlobalRootCA.crt
If you are using a third-party Certificate Authority (e.g. Starfield, GlobalSign), ensure this certificates are valid and installed in the host.
If choosing the local machine (all users) option doesn't fix it, try to add the certificate to the user's profile option instead.
DNS can also be the reason, so try using Google DNS 8.8.8.8 (and 8.8.4.4) and see if it solves the issue. You can check this by using ping to guts2.sp.f-secure.com if it times out, change to Google DNS.

Also, in case of PSB Server Protection, the installation can fail in multiple ways if you have the Enabled the "Turn off Automatic Root Certificate Update" and don't have the latest root certificates available.

This problem can be fixed by enabling the automatic root certificate updates via Group Policy: Computer Configuration / Administrative Templates / System / Internet Communication Management / Internet Communication settings / Turn off Automatic Root Certificate Update, which need to be set as Not Configured or Disabled.

Note: The name of the feature starts with "Turn off" so when it is enabled, it prevents the Windows from automatically downloading the needed new root certificates.

If these fail to fix the problem, the next solution is to do a clean install of the Windows operating system, so that certificates are updated.

Article no: 000002105