| Previous | Next |
| CERT_E_MALFORMED | CERT_E_CHAINING |
CERT_E_UNTRUSTEDROOT
What CERT_E_UNTRUSTEDROOT means
CERT_E_UNTRUSTEDROOT (0x800B0109) means Windows built a certificate chain, but the chain terminated at a root certificate that is not trusted by the active trust provider or policy.
What to verify
- Inspect the chain that Windows actually built, including intermediate and root certificates.
- Check the relevant Trusted Root Certification Authorities store for the machine or user context that performs validation.
- Use the CAPI2 operational log to identify the Build Chain or Verify Chain Policy event that returned this HRESULT.
- If an organization distributes roots by policy, verify that the intended root is present after policy refresh and that the chain is not terminating at an unexpected root.
What this code does not mean
Do not treat this result as a generic certificate-expiration error. Expiration, revocation, name mismatch, chaining failure, and untrusted-root policy are separate certificate results and require different evidence.
Recovery
Correct the certificate chain or trust configuration using the intended CA and trust policy. Do not import an arbitrary root merely to make validation succeed; first verify that the root is the one the deployment is supposed to trust.
Official references
Looking for a different code? Search another status or error code.