How to resolve certificate-related errors in Customer's Canvas On-Premises

A Windows certificate trust update can prevent older server components of Customer's Canvas On-Premises from starting or processing images and print files, even when your application and license have not changed. The preferred solution is to update the affected component. Installing the required root certificate can provide a quick fix when the failure is caused by this certificate chain.

Customer's Canvas On-Premises includes several components, including Design Editor, Dynamic Image, Preflight Tool, and VDP Tool (State Renderer). This article provides confirmed release ranges for Design Editor and guidance for checking the other components.

What errors can you see?

Depending on the component and how it is hosted, the certificate problem may appear as a license verification error:

LicenseException: Library signature mismatch

In applications that load the affected module, it may also appear as:

HttpException: The required CustomersCanvas module hasn't been loaded.

Check the installed component version and the full application logs to confirm whether the certificate issue is the cause.

What happened?

Older deployments can include Aurigma server assemblies signed with code-signing certificates issued by Sectigo. Their certificate chain can depend on Sectigo's AAA Certificate Services root certificate. On October 26, 2026, Microsoft removed that root from the default Windows trust list.

This change followed a separate incident involving the eMudhra certificate authority. eMudhra did not issue the certificates used to sign these Aurigma assemblies. Microsoft lists AAA Certificate Services as removed from its default trust lists, separately from the revoked eMudhra intermediate certificates. See Microsoft's announcement for details.

When Windows cannot build a trusted signing chain, signature checks in a server component or one of its required dependencies can fail. For the impact on standalone Graphics Mill applications, see our Graphics Mill article.

Which installations should you check?

Check each installed server component separately. Design Editor, Dynamic Image, Preflight Tool, and VDP Tool have their own releases and dependencies, so the same version number does not apply to all of them. See the Customer's Canvas documentation for the product and component guides.

Confirmed Design Editor release ranges

The affected Design Editor release branches are:

Design Editor 7.1.71 and later in the 7.1 branch, as well as the 7.2, 7.3, and 7.4 branches, are not affected by this issue. Design Editor 6.21 and earlier is also unaffected.

Dynamic Image, Preflight Tool, and VDP Tool

For these components, applicability depends on the installed build and the signed server assemblies it uses. The Design Editor release ranges above do not establish whether a release of Dynamic Image, Preflight Tool, or VDP Tool is affected.

If one of these components reports a similar signature or module loading error, the same approach may apply: update to an unaffected component build, or install the root certificate if the error is caused by the Sectigo trust chain described here. Contact support with the component name, installed version, and full error message so we can confirm the appropriate fix for your installation.

The failure depends on the Windows certificate trust configuration, so it may appear on different servers at different times as trust updates reach them. If your deployment is managed by Aurigma, contact support to check the installed components.

How to restore your installation

Recommended: update the affected component

Updating to an unaffected component release is the preferred long-term solution. For Design Editor, use 7.1.71 or later in the 7.1 branch, or a compatible 7.2–7.4 release. For Dynamic Image, Preflight Tool, or VDP Tool, contact support to identify an unaffected build appropriate for your installation.

Follow the release notes and migration instructions for the component you are updating, preserve your configuration, and test the upgrade before deploying it to production. Restart the updated application or rendering process and verify the operation that previously failed: loading the editor, generating images, checking artwork, or rendering variable data output.

Quick fix: manually install the required root certificate

If the component fails because of the Sectigo certificate chain described above, installing the self-signed Sectigo Public Code Signing Root R46 certificate can provide an alternative trusted root, without restoring trust in the removed AAA root. Your existing application binaries and license key can stay in place.

This changes the Windows trusted root store. Have a server administrator apply it in accordance with your organization's security policy. For Dynamic Image, Preflight Tool, or VDP Tool, support can help confirm whether this workaround applies to the installed build.

1. Download the self-signed Sectigo Public Code Signing Root R46 certificate from Sectigo. Use this specific file: its Subject and Issuer both name Sectigo Public Code Signing Root R46.
2. On each affected Windows machine, open the downloaded certificate, select Install Certificate, and choose Local Machine. Administrator privileges are required.
3. Select Place all certificates in the following store, choose Trusted Root Certification Authorities, and complete the import.
4. Restart the affected component. For an IIS-hosted application, recycle its application pool; for VDP Tool, restart the rendering process. Verify that the operation that previously failed now works.

The certificate's SHA-256 fingerprint is 7E76260AE69A55D3F060B0FD18B2A8C01443C87B60791030C9FA0B0585101A38.

The Graphics Mill license key reissue tool is intended for standalone Graphics Mill licenses. It does not bypass the module signature check in Design Editor. For the Customer's Canvas On-Premises components covered here, use the component update or certificate approach described above.

Need help?

If you need to confirm whether your installation is affected, or the error persists, contact Customer's Canvas support. Include the component name and installed version, Windows version, the full exception and stack trace, and the steps you have already tried.