Resolving TIA Portal V13 Siemens.Automation.Basic.dll Signature

1. Problem Overview

Engineers attempting to launch TIA Portal V13 (also reported on V13 SP1, V15, and V15.1) on a Windows workstation see the following dialog the moment the executable loads:

Signature for the following assemblies is not correct - Siemens.Automation.Basic.dll Please ensure installed TIARootCertificate.

The TIA Portal shell (Siemens.Automation.Portal.exe) never reaches the project tree. STEP 7 V13, WinCC V13, and the Startdrive V13 components are equally blocked because they share the Siemens.Automation.Basics.dll core assembly and the same digital signature chain. The fault is reported on Windows 7 SP1 (x64), Windows 10 Enterprise (x64), and Windows 10 IoT Enterprise — any host where the trusted root store is missing the Siemens code-signing certificate.

A secondary symptom, "impossible to create connection to server", appears when the TIA Update Center (Siemens.Automation.UpdateCenter.exe) is launched. It is a different fault — a proxy / TLS / Internet Explorer Enhanced Security Configuration (IESC) problem — and is covered briefly in Section 7.

2. Root Cause Analysis

TIA Portal V13 introduces a strong-name and Authenticode verification step on every startup. The runtime loads Siemens.Automation.Basics.dll from:

C:\Program Files (x86)\Siemens\Automation\Portal V13\Bin\

When the assembly is loaded, the Common Language Runtime (CLR) checks the Authenticode signature. The signing chain terminates at the Siemens TIA Portal V13 code-signing certificate, whose root is the Siemens TIARootCertificate. The root is normally pushed into the Local Machine → Trusted Root Certification Authorities store by the TIA Portal setup (Setup.exe /Silent). If the push is blocked by:

• User Account Control (UAC) elevation failure during setup,
• Group Policy that restricts certificate store writes for non-administrators,
• A pre-existing V11 install that registered a conflicting root,
• An antivirus / EDR product that quarantined CA_STEP7 intermediate files,
• A Windows Image that was sysprepped with the certificate store stripped,

…the chain is untrusted. The CLR therefore refuses to load the assembly, and the TIA shell aborts before any project is opened.

2.1 Why V11 and V13 Cannot Coexist

STEP 7 / TIA Portal V11 signs its core assemblies with a different root than V13. Installing V13 over V11 (or vice versa) breaks the chain on whichever version is launched second. Siemens' compatibility matrix states:

If V11 is present and a V13 trial must be evaluated, the recommended path is: roll back to a Windows restore point, upgrade V11 → V12 SP1 → V12 Update 3, then install V13.

3. Prerequisites

• Local Administrator rights on the workstation.
• TIA Portal V13 installation media or extracted installer directory (DVD ISO, SCCM source, or SIMATIC Automation Tool cache).
• Working certificate files in <InstallDir>\Portal V13\Bin\CA_STEP7\:
  • Siemens_Automation_TIA.cer (root CA)
  • TIA_V13_CodeSigning.cer (issuing CA, optional)
• Internet Explorer 11 (Win7) or Microsoft Edge legacy (Win10) for the manual import method, OR certlm.msc for the MMC method.
• Latest Windows cumulative update (at least the patches from the TIA Portal V13 readme — KB2871997, KB2925436, KB2918614, KB2883200, and the SHA-2 code-signing support update KB3033929 for Win7).

4. Solution A — Certificate Import via Internet Explorer 11

This is the canonical Siemens-documented procedure for hosts that already have IE 11 and where the certificate store is locked by GPO.

1. Install or confirm IE 11 (Windows 7 SP1 only). Reboot.
2. Open Internet Explorer as Administrator.
3. Navigate to Tools → Internet Options → Security tab → Local intranet (or Trusted sites) → Custom level….
4. Click Reset to: → choose Medium. Confirm with OK. Repeat for the Internet zone if the security slider is at High.
5. Close Custom level and return to Internet Options.
6. Click the Content tab → Certificates button → Trusted Root Certification Authorities sub-tab.
7. Click Import…. The Certificate Import Wizard opens. Click Next.
8. Click Browse… and navigate to:

   C:\Program Files (x86)\Siemens\Automation\Portal V13\Bin\CA_STEP7\

   Change the file type filter to All Files (*.*), select Siemens_Automation_TIA.cer, and click Open.
9. Click Next. On the Certificate Store page, click Browse… and enable Show physical stores. Expand Trusted Root Certification Authorities and select Local Computer (not the logical "Registry" child). Click OK.
10. Click Next → Finish. The wizard should report "The import was successful". Click OK.

For Win10 1809 and later, IE 11 is replaced by Microsoft Edge Legacy for the UI walkthrough, but the certificate store manipulation is identical when launched from Control Panel → Internet Options (still available as inetcpl.cpl).

5. Solution B — Certificate Import via Microsoft Management Console (MMC)

Preferred on Windows 10 and on locked-down hosts where IE is disabled or the GPO hides Internet Options.

1. Press Win + R, type mmc, press Enter.
2. If User Account Control prompts, click Yes — the snap-in must be opened elevated.
3. In MMC, choose File → Add/Remove Snap-in….
4. From the list, select Certificates, click Add >.
5. Choose the snap-in target: Computer account → Next → Local computer (the default) → Finish → OK.
6. In the left pane, expand Certificates (Local Computer) → Trusted Root Certification Authorities.
7. Right-click the Certificates sub-folder → All Tasks → Import….
8. The Certificate Import Wizard opens. Click Next.
9. Browse… to C:\Program Files\Siemens\Automation\Portal V15_1\Bin (substitute V13 / V15 / V15.1 as appropriate) and select Siemens_Automation_TIA.cer or Siemens_TIA_Root.cer (file name varies by release). Click Open → Next.
10. Confirm Certificate store: Trusted Root Certification Authorities. Click Next → Finish. Acknowledge the security warning (the certificate is shipped by Siemens, fingerprint should match the readme).
11. Repeat steps 7-10 for the Intermediate Certification Authorities store if a separate issuing CA file is present.

Close MMC. No restart is strictly required, but a logoff is recommended so the cached user profile token is refreshed.

6. Solution C — Command-Line Import (Silent Deployment)

For SCCM, MDT, or scripted rollouts, use the built-in certutil utility:

REM Import the TIA Portal V13 root certificate into the Local Machine store
certutil -addstore -f "Root" "C:\Program Files (x86)\Siemens\Automation\Portal V13\Bin\CA_STEP7\Siemens_Automation_TIA.cer"

REM Import the issuing CA into the Intermediate store (if shipped)
certutil -addstore -f "CA" "C:\Program Files (x86)\Siemens\Automation\Portal V13\Bin\CA_STEP7\TIA_V13_CodeSigning.cer"

REM Verify the certificate is present and trusted
certutil -store "Root" | findstr /i "Siemens"

The -f flag overwrites an existing copy, which is required if an older or revoked root is already present from a prior V11 install. The same command works under PowerShell, which can be wrapped in a Start-Process call with -Verb RunAs to trigger elevation.

7. Verification

1. Signature check. Right-click Siemens.Automation.Basics.dll in <InstallDir>\Bin\ → Properties → Digital Signatures tab. Select Siemens TIA portal V13 → Details → View Certificate. The Certification Path must show the root as "This certificate is OK" with a check mark, not a red cross.
2. Launch TIA Portal. Start Siemens.Automation.Portal.exe from the Start menu or directly. The "Signature for the following assemblies is not correct" dialog must not appear; the TIA Portal V13 splash screen with the rotating Siemens logo should appear and the Portal view should load within 15-30 s on a typical workstation.
3. Update Center reachability (optional). From inside TIA, open Help → Installed software → Show all → TIA Portal Update Center. Run Check for updates. If a proxy is in use, configure it under Options → Settings → Update Center → Use proxy server.
4. CLR fusion log (advanced). Enable the assembly bind failure log:

   reg add "HKLM\Software\Microsoft\Fusion" /v EnableLog /t REG_DWORD /d 1 /f
   reg add "HKLM\Software\Microsoft\Fusion" /v LogFailures /t REG_DWORD /d 1 /f
   reg add "HKLM\Software\Microsoft\Fusion" /v LogPath /t REG_SZ /d "C:\FusionLogs" /f
   

   Reproduce the error. Inspect C:\FusionLogs\*.htm for Siemens.Automation.Basics.dll — successful binds will show the public key token 1d8c4b6a3b1f2e7c (verify in your environment).

8. Secondary Fault — "Impossible to Create Connection to Server"

Symptom: the TIA Update Center or the Siemens license server dialog reports a connection error on the first launch after install.

9. Troubleshooting Matrix

10. Prevention and Best Practice

• Image once, deploy many. Build the TIA Portal workstation from a Sysprep-cleaned Windows image, install the certificate via certutil in an unattend.xml RunSynchronousCommand, then capture the WIM. This guarantees every V13 install has the root pre-trusted.
• Document the fingerprint. Add the SHA-256 hash of Siemens_Automation_TIA.cer to your workstation build sheet. If a future Siemens rotation changes the root, you will detect the mismatch.
• Avoid mixed major versions. V11 + V13 on the same machine is a recurring source of signature faults. Use a VM or separate physical workstation for legacy projects.
• Always install as Administrator. The certificate write to Local Machine\Trusted Root requires elevation. If setup runs with a standard token, the write silently fails, and the runtime is broken on the next launch.
• Check the readme. Siemens publishes a TIA Portal V13 readme PDF with the exact certificate name and fingerprint; treat it as the authoritative source over any forum post.

11. Quick Reference — Command Cheat Sheet

REM 1. Confirm the certificate file exists
dir "C:\Program Files (x86)\Siemens\Automation\Portal V13\Bin\CA_STEP7\"

REM 2. Import the root
certutil -addstore -f "Root" "C:\Program Files (x86)\Siemens\Automation\Portal V13\Bin\CA_STEP7\Siemens_Automation_TIA.cer"

REM 3. Import the issuing CA
certutil -addstore -f "CA"  "C:\Program Files (x86)\Siemens\Automation\Portal V13\Bin\CA_STEP7\TIA_V13_CodeSigning.cer"

REM 4. Verify
certutil -store "Root" | findstr /i /c:"Siemens" /c:"Subject"

REM 5. Re-enable TIA shell — no reboot required, but a logoff is recommended
start "" "C:\Program Files (x86)\Siemens\Automation\Portal V13\Bin\Siemens.Automation.Portal.exe"

FAQ