ERROR: Failed to verify authenticode signature - ConfigMgr (2012, 1511, 1602) Pre-requisite downloads

Hey Guys.. Hope you are all good.. This time I am bringing you all a simple fix to an annoying issue that most of us have faced while trying to upgrade / Install ConfigMgr. Yes, this is about the fix to annoying "Failed to verify authenticode signature" error while downloading setup pre-req's.  lets get into that quickly


Error Description

While you are downloading setup pre-requisites for ConfigMgr installation either via setup wizard or via by running setupdl.exe, the download will fail with the below error message

The corresponding error message in ConfigMgrsetup.log would read like this

INFO: Verifying signature for file 'C:\TEMP\Download\sqlncli.msi'    Configuration Manager Setup    06.05.2016 10:11:57    11032 (0x2B18)
ERROR: Failed to verify 'C:\TEMP\Download\sqlncli.msi' authenticode signature.    Configuration Manager Setup    06.05.2016 10:11:57    11032 (0x2B18)
ERROR: File signature check failed for C:\TEMP\Download\sqlncli.msi    Configuration Manager Setup    06.05.2016 10:11:57    11032 (0x2B18)
INFO: Downloaded file 'C:\TEMP\Download\sqlncli.msi' is not valid    Configuration Manager Setup    06.05.2016 10:11:57    11032 (0x2B18)
ERROR: Failed to download required file    Configuration Manager Setup    06.05.2016 10:11:57    11032 (0x2B18)

Solution

Many of us would think that there is something wrong with file which is downloaded or blame the hardware or software firewall for ruining the downloaded file. But in reality this is nothing to do with your firewall and stuff.

You receive this error message because of an IE setting "Check for publisher's certificate revocation" under Advanced settings.

We need to disable temporarily to get this download working. If you are allowed you could directly remove the check mark. If if you are same as me and not allowed to change this settings here, you would have to do it through registry.

Open Regedit.exe and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing and Change Value “State”  to 146944 Decimal or 0x00023e00 Hexadecimal.. As shown below.

Now, the "Check for publisher's certificate revocation" would be disabled and your download should succeed.

Hope this helps, Happy upgrading ConfigMgr :-)

 S A Delphin