FiloSottile/mkcert · error

failed deleting certificate: %v

Error message

failed deleting certificate: %v

What it means

After duplicating a matching context, mkcert calls CertDeleteCertificateFromStore on the duplicate; a zero return means Windows refused the deletion. CertDeleteCertificateFromStore both removes the cert and frees the context, and it fails most often with access-denied: the ROOT store was opened without sufficient privilege to delete, or policy/AV blocks trusted-root modification.

Source

Thrown at truststore_windows.go:131

		certPtr, _, err := procCertEnumCertificatesInStore.Call(uintptr(w), uintptr(unsafe.Pointer(cert)))
		if cert = (*syscall.CertContext)(unsafe.Pointer(certPtr)); cert == nil {
			if errno, ok := err.(syscall.Errno); ok && errno == 0x80092004 {
				break
			}
			return deletedAny, fmt.Errorf("failed enumerating certs: %v", err)
		}
		// Parse cert
		certBytes := (*[1 << 20]byte)(unsafe.Pointer(cert.EncodedCert))[:cert.Length]
		parsedCert, err := x509.ParseCertificate(certBytes)
		// We'll just ignore parse failures for now
		if err == nil && parsedCert.SerialNumber != nil && parsedCert.SerialNumber.Cmp(serial) == 0 {
			// Duplicate the context so it doesn't stop the enum when we delete it
			dupCertPtr, _, err := procCertDuplicateCertificateContext.Call(uintptr(unsafe.Pointer(cert)))
			if dupCertPtr == 0 {
				return deletedAny, fmt.Errorf("failed duplicating context: %v", err)
			}
			if ret, _, err := procCertDeleteCertificateFromStore.Call(dupCertPtr); ret == 0 {
				return deletedAny, fmt.Errorf("failed deleting certificate: %v", err)
			}
			deletedAny = true
		}
	}
	return deletedAny, nil
}

View on GitHub (pinned to 1c1dc4ed27)

Solutions

1. Relaunch the terminal as Administrator and rerun `mkcert -uninstall`.
2. If policy blocks programmatic deletion, remove the mkcert CA manually via certmgr.msc (Trusted Root Certification Authorities) or `certutil -delstore ROOT <serial>` as admin.
3. In CI, run the cleanup step under an account with cert-store write/delete rights.
4. Retry once after closing certmgr/other tools holding the store open.

Example fix

# before (non-elevated)
mkcert -uninstall   # failed deleting certificate: Access is denied.

# after (elevated) or manual
certutil -delstore ROOT <serial-of-mkcert-ca>

if runtime.GOOS == "windows" && !isElevated() {
    return errors.New("run `mkcert -uninstall` from an elevated terminal")
}

When it happens

Trigger: `mkcert -uninstall` from a non-elevated shell when the ROOT store requires admin to modify; enterprise policy protecting trusted roots; the certificate being pinned/protected by Windows (e.g. a curated root) so deletion is denied.

Common situations: Developer runs uninstall in a normal terminal after originally installing from an elevated one; hardened corporate images where only administrators may remove trusted roots; scripts/CI cleanup steps running as restricted users.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to open windows root store: %v
• failed enumerating certs: %v
• no certs found
• failed duplicating context: %v
• failed to close windows root store: %v

AI-assisted analysis of FiloSottile/mkcert@1c1dc4ed27 (2026-08-15). Data as JSON: /api/errors/b6d48b5284904046. Report an issue: GitHub.