{"record":{"id":"b62f9a6832acf056","repo":"FiloSottile/mkcert","slug":"no-certs-found","errorCode":null,"errorMessage":"no certs found","messagePattern":"no certs found","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"truststore_windows.go","lineNumber":63,"sourceCode":"\t// Open root store\n\tstore, err := openWindowsRootStore()\n\tfatalIfErr(err, \"open root store\")\n\tdefer store.close()\n\t// Add cert\n\tfatalIfErr(store.addCert(cert), \"add cert\")\n\treturn true\n}\n\nfunc (m *mkcert) uninstallPlatform() bool {\n\t// We'll just remove all certs with the same serial number\n\t// Open root store\n\tstore, err := openWindowsRootStore()\n\tfatalIfErr(err, \"open root store\")\n\tdefer store.close()\n\t// Do the deletion\n\tdeletedAny, err := store.deleteCertsWithSerial(m.caCert.SerialNumber)\n\tif err == nil && !deletedAny {\n\t\terr = fmt.Errorf(\"no certs found\")\n\t}\n\tfatalIfErr(err, \"delete cert\")\n\treturn true\n}\n\ntype windowsRootStore uintptr\n\nfunc openWindowsRootStore() (windowsRootStore, error) {\n\trootStr, err := syscall.UTF16PtrFromString(\"ROOT\")\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\tstore, _, err := procCertOpenSystemStoreW.Call(0, uintptr(unsafe.Pointer(rootStr)))\n\tif store != 0 {\n\t\treturn windowsRootStore(store), nil\n\t}\n\treturn 0, fmt.Errorf(\"failed to open windows root store: %v\", err)\n}","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/FiloSottile/mkcert/blob/1c1dc4ed27ed5936046b6398d39cab4d657a2d8e/truststore_windows.go#L45-L81","documentation":"mkcert's uninstall path walks the Windows ROOT system store and deletes every certificate whose serial number equals the local CA's serial. If the enumeration completes but nothing matched, it synthesizes 'no certs found' and fatalIfErr terminates. It almost always means the CA was never installed on this machine, was already uninstalled, or the CA (and thus its serial number) changed since installation.","triggerScenarios":"Running `mkcert -uninstall` when `mkcert -install` never ran on this host; running it a second time after a successful uninstall; deleting CAROOT and letting mkcert generate a fresh CA (new serial) before uninstalling, so the old store entry's serial no longer matches.","commonSituations":"CI or container images that blindly run `mkcert -uninstall` in a cleanup step; sharing/syncing a CAROOT between machines so serials diverge from what is actually in each machine's store; a teammate resetting CAROOT then trying to clean up the old install.","solutions":["If the goal is simply a clean store, treat this as success: the CA is not present, nothing to remove.","Check the Windows ROOT store (certmgr.msc -> Trusted Root Certification Authorities) for a leftover 'mkcert developed by FiloSottile' entry and delete it manually if the serial changed.","If a genuine stale entry with a different serial exists, rerun `mkcert -install` with the original CAROOT first so the serials match, then `mkcert -uninstall`.","In scripted cleanup, guard the call: only uninstall when an install previously succeeded in the same run."],"exampleFix":"// before: unconditional cleanup fails on fresh machines\nmkcert -uninstall\n\n// after: only uninstall if this run installed it\nif [ \"$INSTALLED_MKCERT\" = \"1\" ]; then mkcert -uninstall; fi","handlingStrategy":"validation","validationCode":"out, err := exec.Command(\"certutil\", \"-store\", \"ROOT\").CombinedOutput()\nif err == nil && !strings.Contains(string(out), \"mkcert\") {\n    // nothing to uninstall; skip `mkcert -uninstall`\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Make uninstall idempotent in scripts: check the store (or your own install marker) before calling `mkcert -uninstall`.","Keep CAROOT stable between install and uninstall so serials always match.","Run uninstall only in sessions that performed a successful install.","Remember a second uninstall after success is expected to report 'no certs found'."],"tags":["mkcert","windows","uninstall","certificate-store","idempotency"],"backgroundTag":null,"analyzedSha":"1c1dc4ed27ed5936046b6398d39cab4d657a2d8e","analyzedAt":"2026-08-15T09:28:09.359Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}