Fix CERT_E_UNTRUSTEDROOT (0X800B0109) in 5 Minutes

Quick Answer for the Impatient

Run certlm.msc as admin, expand Trusted Root Certification Authorities > Certificates. Find the missing root (usually the issuer of your failing cert) and import it. Or just install the latest Windows Root Certificate Update from Microsoft (KB931125).

Why This Happens

This error shows up when a certificate in a chain — typically an SSL/TLS cert from a web server or an internal app — is signed by a root that Windows doesn’t trust. I’ve seen it most often after a fresh OS install, a broken Windows Update, or when you’re connecting to an internal enterprise PKI that isn’t properly distributed via Group Policy. The root cert is either missing, expired, or corrupted in the Windows certificate store.

Common triggers: accessing a company intranet site with a self-signed root, hitting a public HTTPS site after a botched root update, or running an old Windows 7/8.1 box that hasn’t seen a monthly rollup in years. Don’t bother with clearing browser caches or resetting Winsock — that’s not the culprit here.

Fix Steps

1. Identify the missing root cert. When the error pops up in a browser or app, click the lock icon (or view certificate details). Look at the Certification Path tab. The top-level cert — the root — will have a red X or say “This certificate cannot be verified up to a trusted root.” Write down the root CA name (e.g., “GlobalSign Root CA” or “MyCompany Root CA”).
2. Open the local machine certificate store. Press Win + R, type certlm.msc, hit Enter. This is the local machine store, not your user store — most apps and services use the machine store for root validation.
3. Navigate to Trusted Roots. In the left pane, expand Trusted Root Certification Authorities > Certificates. Scroll through the list. Check if your root CA is there. If it’s missing or expired (check the “Valid To” column), you’ll need to add it.
4. Import the root cert. Right-click Trusted Root Certification Authorities > All Tasks > Import. Browse to the root cert file (usually a .cer or .crt file). If you don’t have it, you can download public roots from the CA’s website or from Microsoft’s root certificate program (for public CAs). For internal CAs, get the root from your IT team or export it from a working machine via certmgr.msc.
5. Also check the Intermediate store. Some chains need an intermediate CA cert. Repeat the import under Intermediate Certification Authorities > Certificates if the chain isn’t complete.
6. Reboot or restart the app. Close and reopen the browser or service that threw the error. Test again.

If the Main Fix Doesn’t Work

Sometimes the issue is more stubborn. Try these in order:

• Run Windows Update manually. Go to Settings > Windows Update > Check for updates. Install all pending updates, especially the monthly security rollup and the “Update for Root Certificates” (KB931125 on older systems). On Windows 10/11, root updates are included in the monthly quality updates.
• Use CertUtil to force update. Open an admin Command Prompt and run certutil -generateSSTFromWU roots.sst. This pulls the latest root certs from Windows Update into a file. Then import roots.sst into the Trusted Root store via certlm.msc — File > Import.
• Check the Third-Party Root store. In certlm.msc, under Trusted Root Certification Authorities, there’s a Third-Party Root Certification Authorities subfolder. Make sure it’s not empty. If it is, you may have a corrupted store. Restore it via sfc /scannow or a system restore point.
• For enterprise environments: If you’re on a domain, the root should be pushed via Group Policy. Run gpupdate /force from admin cmd, then check if the cert appears. Also verify that the CA server’s certificate revocation list (CRL) is reachable — firewalls blocking CRL URLs can cause this error even with the root present.

Prevention Tips

• Keep Windows updated. Monthly quality updates include root cert updates. On Windows 10/11, that’s automatic if you’re not delaying updates.
• For internal PKI: Distribute your root CA cert via Group Policy (Computer Configuration > Windows Settings > Security Settings > Public Key Policies > Trusted Root Certification Authorities). Avoid manual installs on hundreds of machines.
• Back up your cert store. Every quarter, run certutil -exportPFX -p password -user My CertBackup.pfx (adjust for machine store) to have a snapshot.
• Check certificate expiry. Don’t let your root CA expire. That’s a whole other headache — reissuing all client certs. Renew the root CA when it’s still valid.

One last thing: if you’re seeing this on a public site like Google or GitHub, it’s almost certainly a missing root update on your end — not a problem with the site. Don’t disable certificate validation as a workaround. That’s like removing your seatbelt because the warning light is annoying.