The installation of the Symantec Critical Systems Protection client fails with a certificate error.

Products

• Critical System Protection

Issue/Introduction

• The client installation may fail and roll back to the earlier state. You may see the following message in install log:
  
  "ScriptGen: ShowServiceProgress() Look for timeout starting CSPService or other failure loading SIS.dll."

• When in the MMC snap you may also see the following:
  
  An expired Symantec Root CA, and unexpired Symantec205ca in the "Untrusted certificates" folder
  When you double click on the Symantec205ca an error stating the following: "This certificate has been revoked by its certification authority"
   
• In rare cases you may only see the following error in the install.log, and the CSP 8.00 MP1 installation may roll-back to a previous state or fail to roll-back entirely.
  
  "Could not open registry key SYSTEM\CurrentControlSet\Services\CSPMasterServiceMig for flushing. Error: 2"

Environment

Windows 2003 SP2

Cause

The computer has not updated the appropriate root certificates and therefore cannot validate the Symantec Endpoint Protection binaries. For example, this issue can occur:

• If certificates are removed or blocked by the System Administrator
• Windows Server 2003 because the base image does not include currently valid root certificates
• Computers are on a protected network that does not have access to run Windows Update

Resolution

To fix this issue, update the root certificates on the computer.  If the computer has internet access, launch Windows Update. The download and installation of the updated root certificates occurs automatically in the background. You do not need to take additional action.

If the computer does not have internet access, use the process below to download then install the necessary files. Both certificates are required to properly validate the Symantec Critical Systems Protection binaries.

The Windows interface for adding certificates may look slightly different depending on your version of Windows. Symantec Technical Support does not officially support this process; these instructions are provided for your convenience.

Process to update the necessary root certificates

I. Download the necessary certificates.
II. Add the Certificate snap-in, if needed.
III. Install the Symantec Class 3 Public Primary Certification Authority - G5 certificate.
IV. Install the Symantec Class 3 Code Signing 2010 CA certificate.
 

I. To download the necessary root certificates

1. Download roots.zip:
   http://www.symantec.com/content/en/us/enterprise/verisign/roots/roots.zip
2. Extract all files from roots.zip file into an empty folder.  
3. Download the intermediate code signing certificate: 
   https://knowledge.digicert.com/content/dam/digicertknowledgebase/library/VERISIGN/ALL_OTHER/Certificates/Code2010/VeriSign_Class_3_Code_Signing_2010_CA.cer
   Please review DigiCert KB for more information about installation and support: https://knowledge.digicert.com/solution/SO19140.html
4. Using an internal network connection, or physical media such as a thumb drive, bring these files to the computer on which you need to update the root certificates.
    

II. To add the Certificate snap-in

1. Click Start > Run and then enter MMC.
   The Microsoft Windows Management Console opens.  
2. Under Console Root, check for Certificates (Local Computer).
   Note: If this snap-in is already present, skip to III. 
3. Click File > Add/Remove Snap-in. Under Available snap-ins, click Certificates, and then click Add.
4. In the Certificates snap-in dialogue, click Computer account, and then click Next.
5. Ensure that Local computer is selected, and then click Finish.
    

III. To install the Symantec Class 3 Public Primary Certification Authority - G5 certificate

1. While in the Microsoft Windows Management Console, click to expand Certificates (Local Computer), and then expand Trusted Root Certification Authorities.
2. Right-click Certificates, and then click All Tasks > Import.
3. In the Certificate Import Wizard dialogue, click Next.
4. Click Browse to navigate to VeriSign Class 3 Public Primary Certification Authority – G5.cer. Double-click this file, and then click Next.
   You can find this certificate in the extracted roots.zip file in the folder VeriSign Root Certificates\Generation 5 (G5) PCA.
5. For Certificate Store, ensure you place the certificate into Trusted Root Certification Authorities, and then click Next.
6. Review the settings, and then click Finish.

The Certificate Import Wizard should report success.
 

IV. To install the Symantec Class 3 Code Signing 2010 CA certificate

1. While in the Microsoft Windows Management Console, click to expand Intermediate Certification Authorities.
2. Right-click Certificates, and then click All Tasks > Import.
3. Click Browse to navigate to VeriSign_Class_3_Code_Signing_2010_CA.cer. Double-click this file, and then click Next.
4. For Certificate Store, ensure you are placing the certificate into Intermediate Certification Authorities, and then click Next.
5. Review the settings, and then click Finish.

The Certificate Import Wizard should report success.

It may also be necessary to delete one or more Symantec/Verisign certificates in the "Untrusted Certificates" folder that display the following error upon review of the actual root certificate "This certificate has been revoked by its certification authority" before following the steps above. When you discover that one of the certificates shows up as 'revoked' even though Symantec/Versign did not revoke the certificates, it typically means that the certificate was either moved or copied to the "Untrusted Certificates" store on the local machine.