Certificate Chain Validation Failed – Fix in Windows 10/11

When You'll See This

You're browsing a site you trust — maybe your company's internal portal, a bank, or GitHub. Suddenly, your browser throws a full-page warning: Your connection is not private or NET::ERR_CERT_AUTHORITY_INVALID. Clicking details shows something like "Certificate chain validation failed" or error code SEC_E_UNTRUSTED_ROOT. On Windows, the Event Viewer might log 0x800B010A.

This hits hardest with enterprise apps, VPNs, or outdated Windows 10 builds (pre-1903 are notorious). I've seen it on servers that haven't rebooted in months. Real trigger: Windows stopped auto-updating its trusted root certificates around March 2020 for some systems.

Root Cause in Plain English

What's actually happening here is the chain of trust is broken. Every SSL certificate is signed by another certificate, all the way up to a root certificate that's stored in your Windows Trusted Root Certification Authorities store. When that root is missing — or expired — your machine can't verify the website's cert. Windows usually downloads these roots automatically via the Automatic Root Certificates Update service. But if that service is disabled, blocked by group policy, or your PC's date is wrong, the chain falls apart.

Another common cause: your system clock is off by more than a few minutes. HTTPS certs have a valid-from and valid-to date range. If your PC thinks it's 2019 or 2025, the cert won't be valid right now.

The Fix (Numbered Steps)

Step 1: Check Your Date and Time

Skip this step if you checked already. But don't just look at the taskbar. Right-click the clock → Adjust date/time. Turn on Set time automatically and Set time zone automatically. If those are already on, toggle them off, wait 5 seconds, turn them back on. Manually sync: click Sync now under Additional settings.

Why step 1 works: Your cert chain is time-sensitive. Even a 5-minute drift can kill TLS connections. Windows time sync uses NTP over UDP — if a firewall blocks port 123, you're stuck. In that case, set the date manually to accurate time from your phone.

Step 2: Update Root Certificates Manually

Windows sometimes just needs a kick. Open a Command Prompt as Administrator (Win+X → Terminal Admin). Run this:

certutil -generateSSTFromWU roots.sst

This downloads the latest Microsoft trusted root list as a file. Now import it:

certutil -addstore -enterprise root roots.sst

Wait for the command to finish — it can take 30 seconds. Reboot your browser.

The reason step 2 works: certutil -generateSSTFromWU pulls down all currently trusted root certs from Windows Update into a single store file. Importing it into the root store adds any missing roots. This bypasses the broken auto-update service entirely.

Step 3: Enable the Automatic Root Certificates Update Service

Press Win+R, type services.msc, find Automatic Root Certificates Update. Double-click it. Set Startup type to Automatic (not Manual). Click Start if it's stopped. Apply and OK. Then reboot.

If the service is missing on your Windows version (common in some enterprise LTSC builds), skip this — Step 2 is your real fix.

Step 4: Clear SSL State (if using a corporate proxy)

If you're behind a corporate proxy or antivirus that intercepts HTTPS (like Zscaler, McAfee Web Gateway, or Palo Alto GlobalProtect), their cert might be the problem. Open Internet Explorer (yes, it still matters for Windows certificate stores). Go to Settings → Internet Options → Content tab → Certificates. Click Clear SSL State. Then close all browsers.

Why this helps: Corporate proxies often install their own root CA cert. When that cert gets corrupted or expires, the chain breaks. Clearing SSL state resets the cached intermediate certs.

Step 5: Manually Install the Missing Root Cert (Last Resort)

If you know which site is failing, open Chrome, click the padlock → Certificate is not valid → View details. Look at the Certificate Hierarchy tab. The topmost entry is the root — usually something like "DigiCert Global Root CA" or "GlobalSign Root". Google that cert name + "download .cer". Download the root cert file, then:

1. Press Win+R, type certlm.msc (this opens Local Machine certificates).
2. Expand Trusted Root Certification Authorities → Certificates.
3. Right-click → All Tasks → Import. Browse to your .cer file, place it in Trusted Root Certification Authorities.

This is tedious but works when everything else fails.

What to Check If It Still Fails

If after all this the error persists, here's the shortlist of what's likely wrong:

• Group Policy is blocking updates. Run rsop.msc and check Computer Configuration → Administrative Templates → System → Internet Communication Management → Internet Communication settings → Turn off Automatic Root Certificates Update. If enabled, policy is overriding you.
• Antivirus or firewall is MITMing your traffic. Temporarily disable any third-party AV to test. If the error goes away, the AV's SSL inspection cert is expired or misconfigured.
• The server itself is misconfigured. Use SSL Labs to test the website's cert chain. If the server doesn't send intermediate certs, the chain is broken server-side. Not your fault.
• Windows is too old. Windows 7 and 8.1 don't get root updates anymore. Upgrade to Windows 10 22H2 or newer.

One last thing: if you're on a domain-joined machine, talk to your IT admin. They may have pushed a custom root store via Group Policy Certificate Template that's missing the needed root. That's a GPO fix, not yours.