Resolving WinCC Flexible 2008 SP5 Upd2 Invalid Signature Error

1. Problem Description

When launching the WinCC Flexible 2008 SP5 Update 2 setup on a Windows engineering station, the installer aborts with a signature verification error similar to:

Setup.exe - Invalid Signature
The signature of some setup components had to be updated.
The setup cannot be executed because the signature could not be verified.

The error is not related to a corrupted download. The same archive, even after re-download, fails with the identical message. The fault lies in the trust chain used by Windows to validate the Authenticode signature embedded in the new installer components. WinCC Flexible 2008 SP5 Update 2 was re-signed in 2018 to use newer SHA-2 code-signing certificates, and any host that does not have the corresponding root certificates in the Trusted Root Certification Authorities store cannot validate the signature.

This issue is documented in the official Siemens support entry 109757233, which is shipped inside the Readme file of the update package and which is the authoritative reference for the symptom described in this article.

2. Affected Software and Operating Systems

3. Root Cause Analysis

The WinCC Flexible 2008 SP5 Update 2 installer is composed of two layers:

1. An outer Setup.exe bootstrap that validates the signature of every component in the InstData folder before extraction begins.
2. Inner installers (rs.exe, SIA2.exe, MSI packages, CAB archives) that perform the actual copy operations and registry writes.

The outer bootstrap calls WinVerifyTrust with the WINTRUST_ACTION_GENERIC_VERIFY_V2 action. If any of the following conditions is true, the API returns TRUST_E_CERT_SIGNATURE (0x80096004) or CERT_E_UNTRUSTEDROOT (0x800B0109) and the installer refuses to continue:

• The host has no SHA-2 capable root in Cert:\LocalMachine\Root.
• Windows is in flight signing mode where automatic root update is disabled (group policy UseMachineId or registry NoRootUpdate).
• The system clock is more than 12 months skewed from real time, expiring the timestamp counter-signature.
• An anti-virus or file integrity monitor is replacing or quarantining the binary after signature validation (this is the typical cause of the SIA2.exe "is infected" report).
• The archive was extracted onto a case-sensitive or non-NTFS volume and the signature is invalid because the binary header was truncated by a 512-byte boundary copy.

The most common combination in the field is Windows 7 SP1 without the November 2014 root update (KB3033929) and without subsequent monthly rollups. In this state the trust store contains the old GTE CyberTrust and Entrust roots, but not the Symantec / DigiCert roots used by the Siemens re-signing campaign.

4. Pre-Installation Checklist

1. Verify Windows version. Open Start → Run → winver and confirm the build number. Capture a screenshot for the project log.
2. Verify free disk space. WinCC Flexible 2008 SP5 with Update 2 requires at least 3.5 GB free on the system drive and 1 GB free on the installation target.
3. Verify administrator rights. The setup must be launched by a member of the local Administrators group with UAC set to the default level.
4. Verify write access to %TEMP% and to the installation folder. The outer bootstrap decompresses ~1.6 GB of payload into %TEMP%\{guid} before invoking inner installers.
5. Temporarily disable real-time anti-virus scanning on the extraction folder and the install target. Exclusions should at minimum cover *.exe, *.dll, and *.cab inside the installation path.
6. Re-verify the archive checksum against the value published in the Siemens support entry before continuing.

5. Resolution Path A - Install Missing Root Certificates via Windows Update

This is the resolution recommended by Siemens in the readme of Update 2.

1. Connect the engineering station to the Internet (or proxy that allows windowsupdate.microsoft.com and ctldl.windowsupdate.com).
2. Open Control Panel → Windows Update and select Check for updates.
3. Install all classified as Important, in particular the root certificate updates and the SHA-2 support update (KB3033929 on Windows 7 SP1).
4. Restart the host when prompted and re-run Windows Update to confirm no further updates are pending.
5. Re-launch Setup.exe from the WinCC Flexible 2008 SP5 Update 2 archive as administrator.

If the engineering station is on an air-gapped network, see Resolution Path C for offline root installation.

6. Resolution Path B - Launch the Inner Installer Directly

If Windows Update is unavailable, restricted by group policy, or simply not desired on a locked-down engineering workstation, the inner installer can be launched directly. The inner setup does not re-validate the outer signature chain at the same strict level because it is itself an InstallShield runtime that re-reads the manifest after extraction.

1. Open the archive with 7-Zip, WinRAR, or the built-in Windows expand command while preserving the directory tree.
2. Browse into the extracted tree: C:\WinCCflexible2008_SP5_Upd2\InstData\
3. Right-click rs.exe and select Run as administrator.
4. Follow the normal install wizard. The product is added on top of the existing SP5 base install without changing the feature selection.

7. Resolution Path C - Install the Required Root Certificates Offline

For air-gapped programming stations, download the root certificates on a connected machine and transfer them via removable media.

1. On a connected machine, open the Microsoft Trusted Root Certificate Program download page and obtain at least:
   • DigiCert Trusted Root G4
   • DigiCert Assured ID Root CA
   • Symantec Class 3 Public Primary Certification Authority - G6
   • Microsoft Root Certificate Authority 2011
2. Copy the .cer files to the engineering station.
3. Open certlm.msc (Local Machine certificate store).
4. Import each .cer into Trusted Root Certification Authorities → Certificates using the Place all certificates in the following store option.
5. Restart the host and re-run Setup.exe.

Verify the import with PowerShell:

8. Resolution Path D - Repair a Tampered or Quarantined SIA2.exe

Anti-virus products occasionally flag SIA2.exe (the InstallShield Internal Application) inside InstData as a generic trojan, particularly the Trojan:Win32/Wacatac.B!ml family. This is a known false positive triggered by the compressed PE wrapper used in legacy InstallShield bootloaders. If the file has been quarantined, the outer setup fails signature verification because the file length no longer matches the manifest checksum.

1. Open the anti-virus quarantine and restore SIA2.exe if listed.
2. Add the extraction folder and the final install folder to the AV exclusion list.
3. Re-extract the archive to a fresh directory to ensure the file is bit-identical to the original.
4. Compute the SHA-256 of SIA2.exe and compare it to the value published in the readme or in the Siemens support entry.

9. Resolution Path E - Adjust Group Policy and Registry

Some corporate images disable the automatic root update mechanism. If the host is domain-joined and managed by Group Policy, the following settings must be confirmed:

After changing any of the above, run gpupdate /force and reboot before retrying the installation.

10. Resolution Path F - Virtual Machine Specific Workaround

WinCC Flexible 2008 is frequently deployed in virtual machines that were originally built before SHA-2 root certificates became mandatory. Symptoms inside Hyper-V, VMware Workstation, or VirtualBox images include the signature error appearing after a snapshot revert or a host clock drift.

1. Confirm the VM has network egress to the public Internet or to the WSUS server.
2. Synchronize the VM clock to the hypervisor (Integration Services / VMware Tools time sync).
3. Apply Path A or C as appropriate.
4. If the image is sealed with a non-persistent undo disk, take a checkpoint only after the install completes successfully.

11. Step-by-Step Procedure - Recommended Order

1. Capture OS information with winver and msinfo32 /report %TEMP%\msinfo.txt.
2. Capture the signature error screenshot and the full text of the message.
3. Verify the integrity of the archive with a SHA-256 comparison.
4. Run Windows Update until the host reports "No new important updates".
5. Re-launch Setup.exe as administrator.
6. If it still fails, extract the archive to a fresh folder and run InstData\rs.exe as administrator.
7. If the inner installer also fails on SIA2.exe, verify the file hash and check the anti-virus quarantine.
8. Document the resolution used, the certificate version installed, and the install path for the project quality file.

12. Verification of a Successful Install

After the install completes, perform the following checks:

1. Open Start → Programs → SIMATIC → WinCC flexible 2008 and confirm the icon launches without error.
2. Open WinCC Flexible, select Help → About and confirm the version string ends with SP5 HF2 (for example V1.5.0.0_SP5_HF2 or similar, depending on the language).
3. Confirm the registry entry: HKLM\SOFTWARE\Siemens\WinCC flexible 2008\Setup contains a value indicating the update level.
4. Open the SIMATIC Manager and perform a project compile and download to a test panel (e.g. TP177B or OP77B) to verify the runtime files are not corrupted.
5. Reboot the engineering station and re-launch the HMI software to confirm the install survives a restart.

13. Error Code Reference

14. Frequently Asked Questions