CERT_E_UNTRUSTEDTESTROOT Fix – That Certificate Error
This error means Windows doesn't trust a test root certificate. The fix is to delete that cert from the untrusted store. Here's how, fast.
You're hitting 0X800B010D, and it's a pain.
I get it. You're trying to open a site or an app, and bam — certificate error. It says something like "The root certificate is untrusted" or gives you that hex code. Usually happens when you're testing something internal, like a dev server or a self-signed cert for a lab. A client last month had it when their dev team set up a new test environment and forgot to remove the test root from the production machines. Here's the real fix.
Fix It in 3 Minutes
Skip the deep rabbit hole of certificate chains and trust settings. The actual cause is a test root certificate sitting in your "Untrusted Certificates" store (yes, Windows has a special place for things it doesn't trust). You need to delete it.
Step-by-Step
- Press Windows + R, type
certmgr.msc, and hit Enter. - In the left pane, expand Untrusted Certificates > Certificates.
- Look for any certificate with "test" or "root" in the name — sometimes it's labeled "Testing Root CA" or "Unverified" something.
- Right-click it and select Delete. Confirm the prompt.
- Close the tool and restart your browser or app. Try again.
That's it. 90% of the time, this kills the error. If it doesn't, move to the next section.
Why This Works
Windows has a list of root certificates it trusts by default (the Microsoft Root Program). When you install a test root certificate from a dev tool or a self-signed setup, sometimes it lands in the Untrusted store instead of the Trusted Root Certification Authorities store. That's a bug in the installer or a security setting gone too strict. The result: Windows flags it as "untrusted" and blocks any certificate signed by it. Removing it from the untrusted store tells Windows to stop being paranoid about this one cert. You're not breaking security — you're cleaning up a misconfigured cert.
Less Common Variations
If the basic fix didn't work, try these:
1. It's in the Local Machine Store
If you're running as admin and still see the error, the cert might be in the local machine store instead of the user store. Open certlm.msc (same steps as before but with certlm.msc). Go to Untrusted Certificates > Certificates and delete it there too.
2. The Cert Is Actually Trusted but Listed as Untrusted
Sometimes the same cert appears in both the Trusted Root and Untrusted stores. Windows picks the untrusted one first. Check Trusted Root Certification Authorities > Certificates in both certmgr.msc and certlm.msc. If you see a matching cert, delete the one from Untrusted, not the trusted one.
3. Group Policy Is Pushing It
If you're on a corporate machine, a Group Policy might be shoving the test root into the untrusted store on purpose. Run gpresult /h gp.html in a command prompt as admin and check the output for certificate policies. If you see one, talk to your IT team — don't fight it.
Prevention
To avoid this in the future, be careful when installing test certificates from dev tools or self-signed setups. Always install them into Trusted Root Certification Authorities store manually, not automatically. If you're a dev, use certutil -addstore -f Root certname.cer from an admin prompt to put it in the right place. For apps that pop up a warning about untrusted roots, skip the test root entirely and use a proper CA-signed cert from Let's Encrypt or a cheap SSL provider — it's worth the few dollars a year.
One more thing: if you're testing in a lab, set up a clean VM and snapshot before messing with certificates. That way you can roll back in seconds instead of hunting down a rogue cert later.
Was this solution helpful?