After my PC rebooted following installation of KB5121003 (build 26200.9168), several certificates I had previously installed as trusted were missing. These certificates are used for SSL VPN connections to various vendor appliances. Is this a known update issue, or could the certificates have been moved or removed because they were installed in the wrong certificate store?
3 Answers
Which store were the certificates installed into? The important distinction is Trusted Root Certification Authorities versus Personal or Intermediate Certification Authorities, and also whether they’re in the Current User or Local Machine context. The application or VPN service has to look in the same store where the certificate was installed.
First check whether the certificates were truly deleted or simply stored somewhere different. Verify both the Local Machine and Current User Trusted Root stores, and make sure they weren’t accidentally placed under Intermediate or Personal certificates. Services often run under the machine account, so a certificate installed only for your user account may not work for them. You can compare the expected thumbprints with `certutil -store root` and `certutil -store -user root` instead of relying only on the graphical certificate manager. If these are manually installed internal or self-signed roots, deploying them through Group Policy or device management is more reliable than reinstalling them after every servicing operation.
Are you running an Insider build? Certificate stores can change between Insider channels, especially when the trust list is updated. That said, this may not apply if you’re on a normal release.
No, I’m not using an Insider build. The missing certificates are internal or appliance-specific certificates used for SSL VPN connections.