If your application has started throwing LicenseException: Library signature mismatch while using a valid Graphics Mill license, it may be affected by a recent change to Windows certificate trust. The preferred solution is to update to an unaffected Graphics Mill release. If you need to keep your current build, you can use the certificate installation quick fix or the license key reissue option described below.
These instructions apply to Graphics Mill only. If you use Customer's Canvas On-Premises, please see our Customer's Canvas On-Premises troubleshooting guide for product-specific instructions. The Graphics Mill key reissue tool does not support Customer's Canvas products.
What happened?
The affected Graphics Mill builds were signed with an Aurigma code-signing certificate issued by Sectigo. Their certificate chain depends on Sectigo's AAA Certificate Services root certificate. On October 26, 2026, Microsoft removed that root certificate from the default Windows trust list.
This trust-list change was part of Microsoft's response to a separate incident involving the eMudhra certificate authority. eMudhra did not issue the certificate used to sign these Graphics Mill builds. In Microsoft's announcement, AAA Certificate Services is listed as removed from the default trust lists, separately from the revoked eMudhra intermediate certificates.
Graphics Mill checks the library's digital signature during license verification. On affected Windows systems, this check can fail when the application creates its first Graphics Mill object, such as a Bitmap, even if the application and license key have not changed.
Which versions are affected?
The affected Graphics Mill releases are:
| Release branch | Affected versions, inclusive |
|---|---|
| 10.6 | 10.6.41–10.6.64 |
| 11.0 | 11.0.31–11.0.35 |
| 11.1 | 11.1.1–11.1.27 |
| 11.4 | 11.4.1–11.4.9 |
| 11.5 | 11.5.1–11.5.84 |
| 11.6 | 11.6.1–11.6.16 |
Graphics Mill 11.6.17 and later, including all 12.x releases, use a different signing chain and are not affected by this issue. Releases 10.6.40 and earlier, and 11.0.27 and earlier, are also unaffected.
The error depends on the certificate trust configuration of the Windows machine. An affected build may continue to work until the trust changes reach that machine, so check the version used by each deployment.
How to restore your application
Recommended: update to an unaffected release
Updating to Graphics Mill 11.6.17 or later is the preferred long-term solution. These releases use a different signing chain and retain library signature verification without relying on the removed root certificate. Choose a release supported by your application and license. When upgrading across a major version, review the migration documentation and test your application before deploying.
Quick fix: manually install the root certificate
If you need to restore an existing deployment before you can update it, manually installing the AAA Certificate Services root certificate can restore the trust path used by the affected Graphics Mill builds. Your existing binaries and license key can stay in place.
This is a temporary workaround that changes certificate trust for the Windows machine, beyond Graphics Mill. Review Microsoft's guidance on restoring trust and your organization's security policy before using it.
- Download the AAA Certificate Services root certificate from Sectigo. It is also listed under Legacy AAA Root on Sectigo's official certificate download page.
- On the Windows machine running Graphics Mill, open the downloaded certificate, select Install Certificate, and choose Local Machine. Administrator privileges are required.
- Select Place all certificates in the following store, choose Trusted Root Certification Authorities, and complete the import.
- Restart your application or service and verify that image processing works.
The certificate's SHA-256 fingerprint is D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF4.
Alternative: reissue your license key
- Sign in to your account and open the Graphics Mill license key reissue tool.
- Paste the existing Graphics Mill license key used by your application and select Reissue license key.
- Copy the new key and replace the old key in your application or server configuration. Follow the instructions for applying a production license key.
- Restart the application or service so it loads the new key, then verify that image processing works.
The reissued key preserves your license terms and bindings. It allows Graphics Mill to skip the library signature check that is failing because of the certificate trust change.
Need help?
If you need help choosing a solution, the tool cannot reissue your key, or the error continues after applying a fix, contact Graphics Mill support. Include your Graphics Mill version, Windows version, the full error message and stack trace, the steps you have already tried, and whether the application has been restarted.