«Unknown Error» or «Invalid PIN» on a new installation or PC

If Brandtrack Player shows a certificate error or won't let you sign in on a Windows 10 or 11 PC, Windows may be missing a security certificate. In this article we show you how to install it.

Applies to: Windows 10 and 11. Estimated time: 10 minutes. No admin rights needed.

When to use this article

When Brandtrack Player shows one of these errors:

• An Unknown Error screen that, when you click Read more, shows details with HandshakeException or CERTIFICATE_VERIFY_FAILED:

Unknown Error
Please contact support
HandshakeException: Handshake error in client (OS Error: … CERTIFICATE_VERIFY_FAILED: certificate signature failure …)

• The message Invalid PIN when pairing, even though the PIN is correct, and the app won't let you sign in.
• The problem only happens on some PCs, or only on one location's network.

Why does this happen?

On some networks, the app can't complete secure authentication with our servers. The most common causes are network restrictions (a corporate firewall or proxy) and antivirus policies that inspect HTTPS connections.

We're working on an automatic fix inside the app. In the meantime, installing the root and intermediate certificates with this guide works around the problem.

Step by step

1. Download the certificates. Open your browser (Chrome, Edge, etc.) and go to https://app.brandtrack.fm/AmazonCertificates.zip. The download starts automatically. Go to your Downloads folder, right-click AmazonCertificates.zip and choose Extract All…. Save it to your Desktop so it's easy to find.
2. Download the intermediate certificate. This file isn't in the ZIP. Open this address from Amazon's official site in your browser: http://crt.r2m01.amazontrust.com/r2m01.cer. A file named r2m01.cer is saved to your Downloads folder.
3. Open the certificate manager. Press Windows + R, type certmgr.msc and press Enter.

4. Install the root certificates.

   1. In the left panel, right-click Trusted Root Certification Authorities and choose All Tasks → Import…
   2. Click Next, then Browse…
   3. In the bottom right, change the file type to All Files (*.*). Otherwise the file may not show up.
   4. Open the folder you extracted in step 1, select AmazonRootCA1.pem and click Next.
   5. Check that the store says Trusted Root Certification Authorities, then click Next → Finish.
   6. If Windows shows a security warning, click Yes. You'll see "The import was successful".

   Repeat these steps for the other files in the folder: AmazonRootCA2.pem, AmazonRootCA3.pem, AmazonRootCA4.pem and the Starfield one. Having several installed causes no problems.

5. Install the intermediate certificate.
   1. In the same panel, right-click Intermediate Certification Authorities and choose All Tasks → Import…
   2. Click Next → Browse…, change the filter to All Files (*.*) and select r2m01.cer from your Downloads folder.
   3. Check that the store says Intermediate Certification Authorities, then click Next → Finish.
6. Restart Brandtrack Player. Close the app and open it again. It should connect and play normally.

If you have admin rights: it's better to install the intermediate certificate for the whole computer, so it works for every Windows user. Do the same, but in step 3 type certlm.msc instead of certmgr.msc and accept when Windows asks for permission.

If the PC has several Windows users

With certmgr.msc, certificates are installed only for the current user. Install them while signed in with the same Windows account that runs Brandtrack Player, or use certlm.msc as an administrator.

Still not working?

Contact our support team at support@brandtrack.fm and tell us:

• Which certificates you installed.
• The PC's Windows version.
• Whether the network uses a corporate firewall, proxy or antivirus.

With that information we can connect remotely and check it with you.