Trying to update the latest version 26.7.4696.628 cloud client alongwith the latest cse version and i’m seeing a certificate error during the cloud client. It will not update my current 25.10 to 26.7.
The CSE seems to be fine.
This is the error: ( replaced the thumbprint with ********* below)
Calling custom action PPCloud.Installer!PPCloud.Installer.CustomActions.SetCustomerCertificateProperty
Begin SetCustomerCertificateProperty
Getting customer certificate thumbprint from package…
Customer certificate thumbprint detected Checking if Netwrix PolicyPak Cloud Client is already installed …
Netwrix PolicyPak Cloud Client is already installed, getting customer certificate thumbprint from registry …
Checking if customer certificate thumbprint from registry is the same as from installer package…
Installation is not possible: Netwrix PolicyPak Cloud Client is already registered with different customer certificate thumbprint***************************************
CustomAction SetCustomerCertificatePropertyCA returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
any idea why this is happening?
Thanks for posting this - we’ve been looking at the same behavior internally.
What’s happening here is that the cloud client MSI carries a customer certificate. When a new MSI is generated /downloaded, it gets a new certificate, so if you manually install that MSI over an older cloud client, the thumbprint in the new package may not match the thumbprint already registered on the endpoint.
That’s exactly what the log is showing:
- the existing cloud client is already registered with one certificate
- the new MSI contains a different certificate
- the installer compares the two and stops with 1603 when it don’t match
For environments where cloud client versions are pushed through the PP cloud portal, the recommended approach is to set the required version in Group Settings and let the client update through its normal refresh /update process.
If you need tighter control over which version is deployed -for instance, after internal testing or change approval- the current workaround is to uninstall the existing cloud client first and then deploy the newly approved MSI.
So, this is not a generic MSI failure; it’s the cloud client’s certificate validation check blocking the manual in-place upgrade because the certificate state on the endpoint does not match the new package.
And… the CSE update is separate from this certificate check, which is why the CSE can complete successfully while the cloud client upgrade is interrupted.