Overview

When Splashtop updates its backend certificates, older operating systems like Windows 7 may fail to recognize the new certificate authority (CA). This can cause NinjaOne RMM Splashtop remote sessions to stop working even though they worked previously.

This issue occurs because Windows 7 does not automatically update trusted root certificates, and NinjaOne's Splashtop installer may not yet include the new Amazon Root CA used by Splashtop.

This KB explains how to manually install the required Amazon Root CA 3 certificate to restore Splashtop connectivity.

If additional assistance is needed, Splashtop Support offers live chat and is typically more up to date on certificate requirements than NinjaOne support.

Symptoms

You may encounter one or more of the following:

• Splashtop RMM connections suddenly stop working on Windows 7 devices.

• Errors referencing TLS, certificate validation, or a missing trusted authority.

• Connection worked previously but abruptly stopped after Splashtop server-side changes.

Root Cause

Splashtop rotated or updated their certificates to be signed by Amazon Root CA 3, which is not present by default in Windows 7’s trust store. Because NinjaOne’s bundled Splashtop agent has not yet been updated to include the new certificate, affected endpoints fail to validate the Splashtop server.

Resolution

Step 1 — Download the Amazon Root CA 3 Certificate (DER Format)

Splashtop Support may direct you to the Amazon Trust repository:

https://www.amazontrust.com/repository/

1. Locate the row for Amazon Root CA 3.

2. Download the DER version (recommended for Windows 7):

   • Click DER in the "Self-Signed Certificate" column.

   • Save the file (e.g., AmazonRootCA3.der).

(Note: PEM format also works but requires adjusting the file type filter during import. DER avoids that issue.)

Step 2 — Open MMC and Add the Certificates Snap-in

1. Press Win + R → type mmc → press Enter.

2. Go to File → Add/Remove Snap-in…

3. Select Certificates → click Add.

4. Choose Computer account → Local computer → Finish.

5. Click OK.

Step 3 — Import the Certificate into Trusted Root Certification Authorities

1. In the left tree, expand:

   Certificates (Local Computer) → Trusted Root Certification Authorities → Certificates

2. Right-click Certificates → All Tasks → Import.

3. Choose the file you downloaded (AmazonRootCA3.der).

4. Confirm the destination store is:

   Trusted Root Certification Authorities

5. Click Finish.

6. You should receive “The import was successful.”

Step 4 — Restart Splashtop Services or Reboot

A full system reboot is usually the easiest method. After restarting, Splashtop connections via NinjaOne should begin working again.

Additional Notes

• This issue only impacts Windows 7 devices lacking automatic root certificate updates.

• If NinjaOne later updates their Splashtop installer to include this certificate, future deployments may not require this manual fix.

• Splashtop Support confirmed the certificate dependency and directed us to the Amazon CA repository during live chat.

• Splashtop Support generally has more accurate and timely information on certificate-related outages than NinjaOne Support.

When to Contact Splashtop Support

If:

• The DER certificate does not import correctly,

• Connections still fail after rebooting,

• Or you are unsure whether your issue is certificate-related,

Use Splashtop's Live Chat Support on their website — they are aware of ongoing certificate changes and can confirm whether additional certificates or updates are required.

Summary

Windows 7 endpoints using NinjaOne's Splashtop integration may fail after Splashtop changes their server certificates. Installing Amazon Root CA 3 (DER format) into the Trusted Root Certification Authorities store resolves the issue immediately.

This process restores Splashtop remote access without waiting for NinjaOne to update their agent package.