FiloSottile/mkcert · error
failed to open windows root store: %v
Error message
failed to open windows root store: %v
What it means
openWindowsRootStore() calls the Win32 API CertOpenSystemStoreW("ROOT"); if it returns a NULL handle the formatted error is thrown. The dominant cause is lack of elevation — writing to the CurrentUser/ROOT store (and LocalMachine even more so) requires an elevated process on Windows. The syscall always returns a non-nil err (its last-call error), so the real diagnostic is whatever GetLastError reported, typically ERROR_ACCESS_DENIED.
Source
Thrown at truststore_windows.go:80
if err == nil && !deletedAny {
err = fmt.Errorf("no certs found")
}
fatalIfErr(err, "delete cert")
return true
}
type windowsRootStore uintptr
func openWindowsRootStore() (windowsRootStore, error) {
rootStr, err := syscall.UTF16PtrFromString("ROOT")
if err != nil {
return 0, err
}
store, _, err := procCertOpenSystemStoreW.Call(0, uintptr(unsafe.Pointer(rootStr)))
if store != 0 {
return windowsRootStore(store), nil
}
return 0, fmt.Errorf("failed to open windows root store: %v", err)
}
func (w windowsRootStore) close() error {
ret, _, err := procCertCloseStore.Call(uintptr(w), 0)
if ret != 0 {
return nil
}
return fmt.Errorf("failed to close windows root store: %v", err)
}
func (w windowsRootStore) addCert(cert []byte) error {
// TODO: ok to always overwrite?
ret, _, err := procCertAddEncodedCertificateToStore.Call(
uintptr(w), // HCERTSTORE hCertStore
uintptr(syscall.X509_ASN_ENCODING|syscall.PKCS_7_ASN_ENCODING), // DWORD dwCertEncodingType
uintptr(unsafe.Pointer(&cert[0])), // const BYTE *pbCertEncoded
uintptr(len(cert)), // DWORD cbCertEncoded
3, // DWORD dwAddDisposition (CERT_STORE_ADD_REPLACE_EXISTING is 3)View on GitHub (pinned to 1c1dc4ed27)
Solutions
- Relaunch the terminal as Administrator and rerun `mkcert -install`.
- If running in CI/containers, ensure the agent/container runs with sufficient privileges to write the ROOT store, or pre-install the CA via image build.
- Verify the user profile's certificate stores are healthy: `certutil -store -user ROOT` and `certutil -store ROOT`.
- Check group policy / antivirus rules that protect the trusted root store and exempt the mkcert process or use an approved deployment channel (e.g. GPO-based CA distribution).
Example fix
# before (non-elevated shell) mkcert -install # => failed to open windows root store: Access is denied. # after (elevated shell) # Right-click terminal -> Run as administrator mkcert -install # => The local CA is now installed in the system trust store!
Defensive patterns
Strategy: validation
Validate before calling
if runtime.GOOS == "windows" {
if !isElevated() { // check membership in BUILTIN\Administrators + token elevation
log.Fatal("mkcert -install requires an elevated terminal on Windows")
}
} Prevention
- Always launch terminals for mkcert install/uninstall via 'Run as administrator'.
- In CI/containers, bake the CA into the image at build time instead of installing at runtime.
- Confirm write access to the ROOT store before scripting installs (`certutil -store ROOT` as a smoke test).
- Coordinate with IT when AV/EDR or GPO restricts certificate stores.
When it happens
Trigger: Running `mkcert -install` or `mkcert -uninstall` from a non-elevated cmd/PowerShell/terminal; CI runners or containers executing as a restricted service account; group policy or AV blocking modifications to the ROOT store; a corrupted user certificate store profile.
Common situations: Developer opens a regular terminal instead of 'Run as administrator'; Docker Windows containers where the ROOT store is not writable; CI agents provisioned without admin; enterprise hardened images that deny cert-store writes to standard users.
Related errors
- failed deleting certificate: %v
- failed enumerating certs: %v
- no certs found
- failed to close windows root store: %v
- failed adding cert: %v
AI-assisted analysis of FiloSottile/mkcert@1c1dc4ed27 (2026-08-15).
Data as JSON: /api/errors/b821e871017e02f7.
Report an issue: GitHub.