Resolving TIA Portal Updater 'Unable to Connect to Server' Error

1. Problem Overview

The TIA Portal Automation Software Updater (ASU) is the Siemens-licensed utility that scans a workstation for installed SIMATIC/STEP 7 / WinCC / Startdrive / SINAMICS Starter installations and pulls matching service packs, HSPs (Hardware Support Packages), and firmware updates from the Siemens Industry Online Support server. When the updater's online check fails, it terminates with a dialog similar to:

Unable to connect to the server.
The connection to the update server could not be established.

The dialog blocks further scan results, leaves the "Search for updates" pane empty, and prevents download of new TIA Portal service packs. The condition is reproducible across manual invocations, scheduled tasks, and the integrated "Check for updates" entry in the TIA Portal Help menu.

2. Affected Versions and Software Stack

The connection error has been observed on the following TIA Portal installations when paired with an out-of-date or mismatched updater binary:

The root pattern is consistent: the updater binary is older than the installed TIA Portal base, so its manifest of supported products does not include the newer base. The Siemens support entry 109474528 - How do you start the ASU for the TIA Portal when the message appears indicating that no connection can be established to the server? documents the same symptom in TIA Portal V13 SP1 Update 5 and later.

3. Root Cause Analysis

The "Unable to connect to the server" message is generated by the updater's Siemens.Automation.UpdateClient component and is logged in the updater trace. The most common root causes, ranked by frequency in field reports, are:

1. Updater version mismatch. A lower-version ASU is launched against a higher-version TIA Portal. The updater reads the local installed-software manifest and finds a base version it does not recognize, then aborts the network request before reaching the server.
2. TLS / certificate chain failure. The Siemens update endpoint (https://www.siemens.com/asu) requires TLS 1.2 with a current certificate chain. Older ASU binaries built against deprecated crypto providers fail the handshake.
3. Proxy / firewall interception. Corporate HTTP proxies that perform SSL inspection strip the Siemens client certificate or re-route the request, producing a connection timeout on port 443.
4. Corrupt local updater cache. The %LOCALAPPDATA%\Siemens\AutomationSoftwareUpdater and %PROGRAMDATA%\Siemens\Automation\UpdateCache directories contain stale manifest hashes that force a re-download which never completes.
5. Pending Windows reboot. The TIA Portal Setup requires a clean restart between major updates. A pending PendingFileRenameOperations key under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate blocks the updater's service registration.
6. Third-party anti-virus tampering. Endpoint protection products that inject DLLs into the updater process (TIAUpdater.exe) can break the signed HTTPS request.

4. Pre-Diagnostic Checklist

Before reinstalling or modifying the workstation, capture the following data so the failure is reproducible:

1. Open TIA Administrator (Start → Siemens Automation → TIA Administrator) and note the installed TIA Portal products with their exact version and update level.
2. Launch the ASU, trigger the failing check, and capture the error dialog verbatim.
3. Open %LOCALAPPDATA%\Siemens\AutomationSoftwareUpdater\Logs and copy the most recent Updater_*.log file. The relevant lines typically appear as:

   [ERROR] ConnectionFailed: server='https://www.siemens.com/asu/api/v2/updates' status=0
   [ERROR] TlsHandshake: RemoteCertificateChainErrors=SslPolicyErrors.None, but client trust list rejected the issuer.

4. Run certutil -store My and certutil -store Root to confirm that the DigiCert Global Root CA used by Siemens is present and not expired.
5. Test the server reachability directly:

   nslookup www.siemens.com
   curl -I https://www.siemens.com/asu/api/v2/updates
   Test-NetConnection -ComputerName www.siemens.com -Port 443

5. Resolution Step-by-Step

Apply the steps in the order shown. Each step resolves one of the ranked root causes. Stop at the first step that restores the check.

5.1 Step A - Align the updater to the highest installed TIA Portal version

1. Open Control Panel → Programs and Features.
2. Sort by Publisher and locate every entry starting with Siemens AG - Industry Sector - Automation whose name contains Automation Software Updater.
3. Uninstall every ASU instance. The installer places an entry per major version (V14, V15, V15.1, V16, V17, V18, V19, V20).
4. Reinstall the ASU that corresponds to the highest TIA Portal base present on the workstation. The current ASU is delivered as part of the latest TIA Portal installation media or can be downloaded from the Siemens support portal entry linked to the installed version.
5. Reboot the workstation (full power cycle, not sign-out / sleep / hibernate).
6. Re-launch the ASU; the check should complete and list all installed products.

5.2 Step B - Clean the local updater cache

1. Close the ASU and the TIA Portal completely (verify in Task Manager that no TIAUpdater.exe or S7WBXWFZ.exe process is running).
2. Delete the cache folders:

   rmdir /s /q "%LOCALAPPDATA%\Siemens\AutomationSoftwareUpdater"
   rmdir /s /q "%PROGRAMDATA%\Siemens\Automation\UpdateCache"
   rmdir /s /q "%PROGRAMDATA%\Siemens\Automation\UpdateServerConfig"

3. Re-launch the ASU to force a fresh manifest download.

5.3 Step C - Configure the ASU server URL

The default server URL is https://www.siemens.com/asu. In regulated or air-gapped networks, an internal Automation Update Server (also referred to as the TIA Automation Software Update Server) is used. The official Siemens documentation Checking availability of updates and support packages and installing them describes the configuration path:

1. Open the TIA Administrator.
2. Click Options.
3. Select TIA Automation Software Update Server.
4. Choose Siemens server for direct internet access, or User-defined server and enter the internal ASU endpoint (e.g. https://asu.internal.corp:8443).
5. Test the connection with the Test button. A successful test returns HTTP 200 within three seconds.
6. Click OK, then re-launch the ASU.

5.4 Step D - Re-register the updater service

1. Open an elevated command prompt.
2. Run:

   sc query "Siemens ASU Service"
   sc stop "Siemens ASU Service"
   sc delete "Siemens ASU Service"
   "%ProgramFiles%\Siemens\Automation\AutomationSoftwareUpdater\TIAUpdater.exe" /register

3. Reboot and verify the service starts automatically (Status = RUNNING).

5.5 Step E - Repair .NET and TLS stack

Older ASU binaries require .NET Framework 4.7.2 and SchUseStrongCrypto enabled. Verify and force both:

1. Install .NET Framework 4.7.2 (or later) if absent.
2. In the registry, set:

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
   "SchUseStrongCrypto"=dword:00000001
   [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319]
   "SchUseStrongCrypto"=dword:00000001

3. Reboot.

5.6 Step F - Validate proxy and firewall

1. Open Internet Options → Connections → LAN Settings and confirm that the proxy bypass list includes *.siemens.com if a transparent proxy is in use.
2. Whitelist the following endpoints on the corporate firewall and SSL inspection appliance:

   Hostname	Port	Protocol	Purpose
   www.siemens.com	443	TLS 1.2	ASU manifest and download
   support.industry.siemens.com	443	TLS 1.2	HSP and firmware download
   cache.industry.siemens.com	443	TLS 1.2	Image catalog
   asi.industry.siemens.com	443	TLS 1.2	License server mirror

3. If SSL inspection is mandatory, add the Siemens root CA to the inspection appliance trust store and to the workstation's Trusted Root Certification Authorities store.

6. Verification

Confirm the fix with the following objective checks:

1. Updater dialog test. Launch the ASU, click Check for updates. The dialog must return a populated product list within 30 seconds. The error "Unable to connect to the server" must not appear.
2. Log inspection. The most recent Updater_*.log must show HTTP 200 OK for the manifest request and a non-zero number of updates returned.
3. TIA Portal integration test. Inside TIA Portal, open Help → Check for updates. The integrated updater must launch the same ASU and complete the check without re-prompting the error.
4. Service health. sc query "Siemens ASU Service" returns STATE : 4 RUNNING.
5. End-to-end download test. Select one available update (e.g., a SIMATIC S7-1500 HSP) and click Download. The file *.hsp.zip must land in the configured download directory within the bandwidth limit of the link.

7. ASU Server Configuration Reference

The TIA Administrator stores the ASU endpoint in the following registry path:

[HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\Automation\AutomationSoftwareUpdater]
"UpdateServerUrl"="https://www.siemens.com/asu"
"ProxyEnabled"=dword:00000001
"ProxyAddress"="http://proxy.corp:8080"
"ProxyBypass"="*.siemens.com;<local>"

For air-gapped environments, Siemens offers a local mirror that replicates https://www.siemens.com/asu. The mirror runs as an IIS site on Windows Server 2019 / 2022 with the ASU server component installed from the TIA Portal installation media under Additional Products → TIA Automation Software Update Server. The mirror endpoint is configured the same way in Step C of section 5.

8. Preventive Maintenance

• After every TIA Portal update, open TIA Administrator and verify that the ASU entry points to the correct updater version. A fresh installation of a major TIA Portal release will sometimes install a new ASU alongside, not on top of, the previous one.
• Schedule a monthly task that runs TIAUpdater.exe /cleanup to prune stale manifest entries.
• Maintain a workstation image (e.g., MDT, SCCM) that contains the highest TIA Portal version in use; ASU compatibility scales with the highest installed base.
• Subscribe to the Siemens ProductCERT and TIA Portal release notes feeds; new updates frequently include updater bug fixes.

9. Troubleshooting Matrix

10. Related Siemens Documentation

• Siemens Support Entry 109474528 - How to start the ASU when no connection to the server can be established
• TIA Portal V20 Documentation - Checking availability of updates and support packages

FAQ