---
title: "Certificate Update Troubleshooting"
slug: "certificate-update-troubleshooting"
description: "Learn how to troubleshoot PCC digital certificate update failures and apply solutions like restarting the application or manually installing CDUT files."
updated: 2026-04-02T20:05:09Z
published: 2026-04-02T20:05:09Z
canonical: "docs.onespan.com/certificate-update-troubleshooting"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Certificate Update Troubleshooting

Our PCC digital certificates use Client Data Update Tokens (CDUT) to automatically update [TLS certificates](/v1/docs/communicating-via-websocket) and [Server Authentication](/v1/docs/authenticating-servers) whitelists. This article outlines some of the potential causes and solutions in the unlikely event that an automatic update does not occur.

## Symptoms of an update failure

The following may be signs of an update failure:

| Cause | Symptom |
| --- | --- |
| Expired TLS certificate | A pop-up dialog appears, prompting the user to download and install the Personal Certificate Client. |
| Expired Server Authentication whitelist | The following error message appears: *“The document cannot be signed because there is an issue with the OSS Personal Certificate Client. Please reinstall the OSS Personal Certificate Client and try again.* **[Error code 17]**.” |

These symptoms will only appear after the affected certificates have expired. They will not appear at the time the update mechanism fails. Updates are always pushed prior to certificate expiration.

## Solutions

Here are some possible solutions you can try should your update fail.

#### Restart the application

The PCC must be restarted to load the updated configuration. The application will automatically force a restart within 48 hours. However, if this mechanism fails, and the machine has not been restarted, the update may not be applied.

Use one of the following commands to restart the application:

| Operating System | Command |
| --- | --- |
| On **Windows** using a *Command Prompt* | `taskkill /f /im onespan-pcc.exe` |
| On **macOS** using a *Terminal* | `launchctl unload ~/Library/LaunchAgents/com.onespan.Personal-Certificate-Client.launchd.plist` `launchctl load ~/Library/LaunchAgents/com.onespan.Personal-Certificate-Client.launchd.plist` |

For both Windows and macOS operating systems you can also just restart your computer. This will also restart the PCC.

#### Manually download and install the CDUT

Should the issue continue, you can manually download and install the latest CDUT file yourself.

To manually download and install the CDUT file:

1. Download the following file: [https://static.esignlive.com/pcc/CDUT.txt](https://static.esignlive.com/pcc/CDUT.txt)
2. Copy this file to the appropriate directory:
  - **Windows**: `%LOCALAPPDATA%\OneSpan\OneSpan Personal Certificate Client\Data\cdut.txt`
  - **macOS**: `${HOME}/Library/Application Support/OneSpan/OneSpan Personal Certificate Client/Data/cdut.txt`

Note that the `cdut.txt` file name must be saved in lowercase letters. You may also need to create the `Data` folder if it does not already exist.
3. Restart the application using the steps described above.