FiloSottile/mkcert · error

failed duplicating context: %v

Error message

failed duplicating context: %v

What it means

Before deleting a matched certificate, mkcert duplicates its context with CertDuplicateCertificateContext so the enumeration continues past the deletion; a NULL return triggers this error. Duplicate merely increments a reference count on an existing context, so failure implies an invalid context pointer — the enum returned a context that was freed or corrupted between the call and the duplication.

Source

Thrown at truststore_windows.go:128

	deletedAny := false
	for {
		// Next enum
		certPtr, _, err := procCertEnumCertificatesInStore.Call(uintptr(w), uintptr(unsafe.Pointer(cert)))
		if cert = (*syscall.CertContext)(unsafe.Pointer(certPtr)); cert == nil {
			if errno, ok := err.(syscall.Errno); ok && errno == 0x80092004 {
				break
			}
			return deletedAny, fmt.Errorf("failed enumerating certs: %v", err)
		}
		// Parse cert
		certBytes := (*[1 << 20]byte)(unsafe.Pointer(cert.EncodedCert))[:cert.Length]
		parsedCert, err := x509.ParseCertificate(certBytes)
		// We'll just ignore parse failures for now
		if err == nil && parsedCert.SerialNumber != nil && parsedCert.SerialNumber.Cmp(serial) == 0 {
			// Duplicate the context so it doesn't stop the enum when we delete it
			dupCertPtr, _, err := procCertDuplicateCertificateContext.Call(uintptr(unsafe.Pointer(cert)))
			if dupCertPtr == 0 {
				return deletedAny, fmt.Errorf("failed duplicating context: %v", err)
			}
			if ret, _, err := procCertDeleteCertificateFromStore.Call(dupCertPtr); ret == 0 {
				return deletedAny, fmt.Errorf("failed deleting certificate: %v", err)
			}
			deletedAny = true
		}
	}
	return deletedAny, nil
}

View on GitHub (pinned to 1c1dc4ed27)

Solutions

1. Ensure only one process manipulates the ROOT store at a time; retry `mkcert -uninstall`.
2. Reboot to clear any wedged store state and retry.
3. Remove the mkcert CA manually with certmgr.msc or `certutil -delstore ROOT <serial>`.
4. If it reproduces consistently, capture the GetLastError value and report upstream to mkcert.

When it happens

Trigger: `mkcert -uninstall` when the enumerated CERT_CONTEXT becomes invalid mid-loop (concurrent deletion by another process), or under memory corruption / non-Windows compatibility layers where the CertContext pointer chain is unreliable. Extremely rare on healthy systems.

Common situations: Two mkcert uninstalls racing; an EDR agent deleting certs while mkcert enumerates; running under Wine or translation layers with incomplete crypt32 support.

Related errors

• failed enumerating certs: %v
• failed deleting certificate: %v
• no certs found
• failed to open windows root store: %v
• failed to close windows root store: %v

AI-assisted analysis of FiloSottile/mkcert@1c1dc4ed27 (2026-08-15). Data as JSON: /api/errors/0a443804233aa463. Report an issue: GitHub.