Yeah, this one's annoying. You're trying to add a root CA cert and Windows just says no. But the fix is usually dead simple. Let's get to it.
Quick Fix: Use the Right Store and Run as Admin
Most of the time, this error pops up because you're importing the certificate into the Current User store instead of the Local Machine store, or you're not running the import as an elevated admin. The certificate enrollment service needs machine-level access to write to the root store.
- Right-click the .cer or .crt file and select Install Certificate.
- Choose Local Machine (not Current User). If it's greyed out, you're not admin — run it as admin or use an elevated prompt.
- Select Place all certificates in the following store.
- Click Browse and pick Trusted Root Certification Authorities.
- Click OK, then Finish. That's it.
If you're still hitting the error, try importing via the MMC snap-in. That gives you more control and often bypasses the quirky UI issues.
certlm.msc # Computer account certificates (admin required)
In the left pane, expand Trusted Root Certification Authorities, right-click Certificates, and choose All Tasks > Import. Follow the wizard, and you're done.
Why This Works
The error code 0x80095001 maps to XENROLL_E_CANNOT_ADD_ROOT_CERT. It's thrown by the Certificate Enrollment service when it can't write to the root store. The current user store doesn't have the same write permissions, and the import wizard sometimes defaults to that store if you're not careful. Running as admin and targeting the machine store eliminates the permission problem. I've seen this exact fix clear up 90% of the tickets I've dealt with.
Less Common Variations
If the above doesn't work, you might be dealing with one of these:
1. Malformed Certificate File
Sometimes the file is corrupted or saved with a wrong extension. Check the file with a text editor — it should start with -----BEGIN CERTIFICATE-----. If it doesn't, you've got a DER file or something else. Use certutil to convert it:
certutil -decode input.cer output.cer
Then try the import again.
2. Certificate Chain Issues
If the root CA is part of a chain, maybe you're missing an intermediate. The installer might choke on that. Grab the full chain from the vendor and import each cert in order — root last.
3. Corrupted Certificate Store
Rare, but I've seen it. The root store itself can get corrupted. Fix it with:
certutil -store Root
Check if there's an issue. If needed, you can export all certs, delete the store contents, and re-import. But that's a last resort — don't go there unless you're sure.
4. Group Policy Interference
In enterprise environments, Group Policy might be blocking the import or overwriting your changes. Check the event log for Policy errors. If GP is the culprit, you'll need to talk to whoever manages your GPOs.
Prevention for Next Time
Stop importing certs by hand every time. Use certutil -addstore from an elevated command prompt if you're scripting it:
certutil -addstore -f Root yourcert.cer
And if you're deploying to multiple machines, push them via Group Policy or use a management tool like SCCM. That way you avoid the manual steps entirely.
Also, always verify the cert file before you even try to import. A quick check of the file header saves you a headache.
That should cover it. If you're still stuck, double-check that you're using the right cert for the right purpose — sometimes people grab an S/MIME cert instead of a root CA. It happens.