After my PC rebooted following installation of KB5121003 (build 26200.9168), several certificates I had previously installed as trusted were no longer visible. These certificates are used for SSL VPN connections to various vendor appliances. Is this a known update issue, or could the certificates have been moved or installed in the wrong certificate store?
3 Answers
First check whether the certificates were actually deleted or simply moved. The User and Local Machine stores are separate, and certificates in Personal, Intermediate Certification Authorities, and Trusted Root Certification Authorities serve different purposes. A service may also be unable to use a certificate installed only for your user account.
The build may also matter. On some preview or Insider builds, certificate contents can change between channels. However, if this is a regular production installation and the missing certificates are private roots used for vendor VPNs, I would first confirm whether they were in the correct store and whether they were installed under the Local Machine context.
If these are internal or self-signed roots installed manually, a servicing operation or certificate trust-list refresh could expose a store or deployment problem. Certificates installed by hand may not remain consistent across updates, especially if the VPN software runs as a service. Deploying them through Group Policy or device-management policy is more reliable than reinstalling them after every update.
The quickest way to verify this is with certutil rather than relying on the MMC view: compare `certutil -store root` with `certutil -store -user root`, and check the certificate thumbprints.