Fix 'Certificate Chain Trust Broken' Error Fast

Quick answer for advanced users

Run certutil -urlcache * delete as admin, then restart your browser. If that doesn't cut it, check system time and verify the site's certificate chain with openssl s_client -connect example.com:443 -showcerts.

What's actually happening here?

This error—CERT_CHAIN_TRUST_BROKEN—pops up when Windows can't build a full, trusted path from the site's certificate back to a root certificate authority (CA) you trust. I've seen it mostly on Windows 10 and 11, especially in Chrome, Edge, and Firefox. The chain is broken, meaning an intermediate certificate is missing, expired, or corrupted. It's not a virus—but it can feel like one when you're blocked from a site you need for work.

Common triggers: accessing a corporate intranet portal after a cert renewal, visiting a site with a misconfigured SSL setup, or using a VPN that intercepts traffic with its own cert. Also, if your system clock is off by more than a few minutes, Windows won't trust any cert.

Fix #1: Clear the certificate cache

The quickest fix, and the one that works most often, is nuking the local certificate cache. Windows stores intermediate certs you've seen before—sometimes they're outdated or corrupted.

1. Open Command Prompt as Administrator (right-click Start, choose Command Prompt (Admin) or Terminal (Admin)).
2. Type certutil -urlcache * delete and hit Enter. This clears the entire cache—it'll take a few seconds.
3. Restart your browser. Try loading the site again.

I've fixed hundreds of tickets with this one command. It's safe—Windows rebuilds the cache automatically when you visit sites. No reboot needed.

Fix #2: Check your system date and time

If the cache clear didn't work, check the clock. Windows uses your system time to verify certificate validity. If it's wrong, every cert looks expired or not-yet-valid.

1. Right-click the time in the taskbar, select Adjust date/time.
2. Turn on Set time automatically and Set time zone automatically.
3. If they're already on, toggle them off, wait 10 seconds, then toggle back on. Also click Sync now.
4. Restart your browser.

This trips up a lot of people. I once had a dev whose machine was 4 hours off—every SSL site broke.

Fix #3: Reinstall the missing intermediate certificate

Sometimes the site's chain is just incomplete. You can grab the intermediate cert directly from the issuer.

1. Visit the site that shows the error. In Chrome, click the padlock icon (or the Not secure warning) next to the URL > Connection is not secure > more info. Look for the certificate viewer.
2. Find the Certification Path tab. You'll see the hierarchy—root CA at top, intermediate in middle, site cert at bottom. If the intermediate is missing (red X or blank), that's your problem.
3. Note the issuer name (e.g., DigiCert, Let's Encrypt, GlobalSign). Go to their website, download the intermediate CA certificate in .cer format.
4. Open mmc.exe (as admin) > File > Add/Remove Snap-in > Certificates > Computer account > Local computer > OK.
5. Expand Intermediate Certification Authorities > right-click Certificates > All Tasks > Import. Browse to the .cer file, place it in the Intermediate Certification Authorities store.
6. Restart your browser.

This fix is a bit manual but works when the server admin forgot to bundle the intermediate cert. You can also use openssl s_client -connect example.com:443 -showcerts to inspect the chain directly—if you see only one cert, the server's broken.

Alternative fixes when the main ones fail

If the steps above don't work, try these in order:

• Disable antivirus SSL scanning: Norton, McAfee, Bitdefender, and even some corporate AVs (like CrowdStrike) intercept SSL traffic with their own certs. If that cert is expired or not trusted, you get this error. Turn off HTTPS scanning in the AV settings temporarily. If the site loads, add an exception.
• Update Windows and browser: Microsoft pushes trust updates via Windows Update. Go to Settings > Update & Security > Check for updates. Also update Chrome/Firefox/Edge to the latest version—an old browser might not trust new root certs.
• Reset browser SSL state: In Internet Options (yes, old-fashioned but still works), go to Content > Clear SSL state. This removes all cached SSL sessions.
• Check for corporate proxies: If you're on a work network, the proxy might be injecting its own certificate. Contact your IT team—they may need to push the corporate root cert to your machine via Group Policy.

Prevention tip: keep your certificate store healthy

You can avoid a lot of this by running certutil -urlcache * delete once a month, especially if you visit many HTTPS sites regularly. Also, keep your system clock synced automatically—it's easy to overlook. For IT admins: always bundle intermediate certs when issuing server certificates. I've seen this error on misconfigured IIS and Apache servers all the time—a proper chain setup saves your users from this headache.

If none of this helps, the issue might be on the server side. Use the openssl command I mentioned to verify the chain, then send it to the site owner. But in my experience, 90% of the time it's either a stale cache or a wrong clock.