PAR POS System Requirements

SSL Certificate Validation Notice

Overview

During a recent maintenance window on the PAR POS cloud system, we detected your devices did not have the ability to validate the new SSL certificate. The certificate validation process is managed by the Windows operating system through Windows Update and is automatic.

Certificate Trust List updates are downloaded from the following URL, which is hosted by Microsoft: http://ctldl.windowsupdate.com.

It is recommended to use whatever remote control and file transfer/deployment tool or application that you would normally use to deploy files or patches to your terminals.

Alternatively, you can also follow the steps included in this document for the SSL certificate replacement.

Possible Validation Issues

There are four likely reasons for SSL Certificate validation issues:

  1. Windows Update functionality and/or Windows Update communication on the firewall is blocked on your devices
  2. HTTP (Port 80) outbound traffic from your network is blocked (the CTL is hosted on HTTP so it may be contacted if the Microsoft root certificate needs to be updated)
  3. Security tooling on the POS devices does not allow installation of a new trusted certificate
  4. Windows Updates are self-managed and Certificate Trust List updates are not getting approved

SSL Certificate Validation Fixes

To maintain connectivity to PAR POS, the Certificate Trust List update for the new SSL certificate must be applied to all POS devices in the store through one of the methods below:

  • Update all devices with the ability to run Windows Update and communicate to the CTL distribution list at http://ctldl.windowsupdate.com
  • Update the firewall on all POS devices to allow outbound HTTP communication to windowsupdate.com
  • Update security software to trust the new Root Certificate for PAR POS by appropriately installing the certificate into the software — the certificate may be found at the following URL:
    • http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/B7AB3308D1EA4477BA1480125A6FBDA936490CBB.crt
  • If self-managing the centralized Windows Update infrastructure, follow the instructions for that application to also distribute the Windows Certificate Trust List updates to all devices

SSL Certificate Check and Replacement Procedure

  1. Download the PAR POS Software SSL Check .msi:
    1. https://cdn.brinkpos.net/utilities/BS-SSL-Installer.msi
  2. Install the application by running the .msi (target directory is C:\Brink)
  3. Run the BS-SSL-Check from the Desktop shortcut
  4. Click on "Test Me"
    1. This will check for the SSL.com certificate
      1. If the certificate is not found it will prompt to install it
      2. If the certificate is found the app will notify you
    2. This will also check if Port 80 can communicate Outbound traffic
      1. If the port is blocked there is an error message
  5. Close the app

SSL Certificate Replacement Procedure (PowerShell)

  1. Copy the certificate file into any local folder

  2. Open an administrative Powershell window and navigate to the folder that contains the certificate

  3. Execute the following command and click the Enter key — no errors should occur if command is successful:

  4. After SSL Certificate update, you may see red text in the Powershell window — this is an indication that an error occurred in the execution of the command. Check the syntax of the command for any mistyped characters:

  5. To test if the certificate has been applied, execute the following command:

    • Get-ChildItem -Path Cert:\LocalMachine\Root | Where-Object {$_.Thumbprint -eq "FF95E7706B770B38AD8D8EABE014061F69A86800"}

Additional Resources

Microsoft Reference Documentation:

Links to Root Certificates for PAR POS providers:

Previous
Suggested Default Ports for In-Store Integrations & Devices
Next
Updated API Protocol and Cipher Support (1-8-25)