| Previous | Next |
| TRUST_E_EXPLICIT_DISTRUST | CERT_E_INVALID_POLICY |
CERT_E_UNTRUSTEDCA
CERT_E_UNTRUSTEDCA means that the chain structure could be processed, but the applicable policy does not trust one of the CA certificates. This is more specific than a parsing failure and can differ from the final root simply being absent from the trusted-root store.
Identify the policy-rejected CA
- Inspect the chain element and policy status to find which CA was rejected.
- Verify that the CA hierarchy is the one approved for the workload and environment.
- Deploy trust through the correct organizational mechanism only after verifying the CA identity and certificate profile.
Do not add arbitrary CA certificates to trusted stores to make the error disappear; doing so changes the machine trust boundary.
Microsoft: certificate chain policy status
Looking for a different code? Search another status or error code.