TRUST_E_FAIL (0X800B010B) - Generic Trust Failure Fix

Quick Answer

Run certlm.msc, go to Untrusted Certificates, delete anything related to the failing app or driver, then run certutil -generateSSTFromWU roots.sst and import the updated roots.

This error means Windows can't build a trusted chain from the certificate back to a root authority. The certificate itself might be fine — the trust path is broken. I see this most often after a failed Windows update or when someone manually deleted certificates from the store. Also common with old installers signed with SHA-1 certificates that Windows no longer trusts by default.

Step-by-Step Fix

1. Open Certificate Manager for Local Machine — Press Win + R, type certlm.msc, hit Enter. This opens the machine-level certificate store, not your personal one.
2. Check Untrusted Certificates — Expand Untrusted Certificates folder, then Certificates. Look for any certificate related to the program or driver throwing the error. Right-click it, select Delete, confirm.
3. Refresh Root Certificates — Open Command Prompt as admin (right-click Start, choose Command Prompt (Admin) or Terminal Admin). Run:

   certutil -generateSSTFromWU roots.sst

   This downloads the latest trusted root certificates from Microsoft.
4. Import the Fresh Roots — Double-click the roots.sst file created in your working directory (usually C:\Windows\System32). In the Certificate Import Wizard, choose Local Machine, then Place all certificates in the following store. Click Browse, select Trusted Root Certification Authorities, click OK, then Finish.
5. Reboot — Restart the machine. Try the original operation again.

If That Doesn't Work

• Update Windows — Go to Settings > Update & Security > Windows Update, check for updates. Microsoft pushes root certificate updates through Windows Update. Run it twice if it finds nothing the first time.
• Reset Certificate Stores — Run:

  certutil -delstore -user Root

  then rebuild with the SST import step above. Careful — this removes all user-level root certs. Only do this if you know what you're doing. I'd skip this unless the problem is widespread across multiple apps.
• Check for Corrupted System Files — Run sfc /scannow from an admin command prompt. Then run DISM /Online /Cleanup-Image /RestoreHealth. A corrupt system file can break certificate validation.
• Fallback for Drivers — If this happens during driver installation, try temporarily disabling driver signature enforcement: Advanced Startup > Troubleshoot > Advanced Options > Startup Settings > Restart > Press 7. But don't leave it off — that's a security hole.

Prevention Tips

Don't manually delete certificates from the store unless you're certain. I've seen admins clean up "unused" certs only to break every signed app on the machine. Also, keep Windows Update running automatically — it handles root cert refreshes. For internal apps signed with your own CA, make sure the root CA certificate is distributed to all machines via Group Policy. That saves everyone this headache.

One last thing: if you're using an old self-signed certificate with SHA-1, generate a new one with SHA-256. Windows 10 and 11 started distrusting SHA-1 certs in 2020. That alone causes this error.