{"record":{"id":"b6ce976c0564134e","repo":"FiloSottile/mkcert","slug":"failed-to-close-windows-root-store-v","errorCode":null,"errorMessage":"failed to close windows root store: %v","messagePattern":"failed to close windows root store: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"truststore_windows.go","lineNumber":88,"sourceCode":"\nfunc openWindowsRootStore() (windowsRootStore, error) {\n\trootStr, err := syscall.UTF16PtrFromString(\"ROOT\")\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\tstore, _, err := procCertOpenSystemStoreW.Call(0, uintptr(unsafe.Pointer(rootStr)))\n\tif store != 0 {\n\t\treturn windowsRootStore(store), nil\n\t}\n\treturn 0, fmt.Errorf(\"failed to open windows root store: %v\", err)\n}\n\nfunc (w windowsRootStore) close() error {\n\tret, _, err := procCertCloseStore.Call(uintptr(w), 0)\n\tif ret != 0 {\n\t\treturn nil\n\t}\n\treturn fmt.Errorf(\"failed to close windows root store: %v\", err)\n}\n\nfunc (w windowsRootStore) addCert(cert []byte) error {\n\t// TODO: ok to always overwrite?\n\tret, _, err := procCertAddEncodedCertificateToStore.Call(\n\t\tuintptr(w), // HCERTSTORE hCertStore\n\t\tuintptr(syscall.X509_ASN_ENCODING|syscall.PKCS_7_ASN_ENCODING), // DWORD dwCertEncodingType\n\t\tuintptr(unsafe.Pointer(&cert[0])),                              // const BYTE *pbCertEncoded\n\t\tuintptr(len(cert)),                                             // DWORD cbCertEncoded\n\t\t3,                                                              // DWORD dwAddDisposition (CERT_STORE_ADD_REPLACE_EXISTING is 3)\n\t\t0,                                                              // PCCERT_CONTEXT *ppCertContext\n\t)\n\tif ret != 0 {\n\t\treturn nil\n\t}\n\treturn fmt.Errorf(\"failed adding cert: %v\", err)\n}\n","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/FiloSottile/mkcert/blob/1c1dc4ed27ed5936046b6398d39cab4d657a2d8e/truststore_windows.go#L70-L106","documentation":"After installing or uninstalling, mkcert closes the ROOT store handle with CertCloseStore(handle, 0); if the API returns 0 the formatted error is returned. Because the handle is closed via `defer store.close()` after the operation already succeeded, this failure is cosmetic — the store mutation completed but the handle teardown failed (typically a handle/allocation issue or the store already closed). mkcert does not call fatalIfErr on this path's result in the defer, so impact is limited to resource hygiene.","triggerScenarios":"CertCloseStore returning FALSE because the handle is invalid or was already closed; internal cert-context leaks making close fail; running on a Windows version where the store was invalidated between open and close (e.g. store service restarted mid-operation).","commonSituations":"Rare in practice; occasionally observed after AV interference with crypt32 or in long-lived processes that manipulate the store repeatedly; mostly seen when the same store handle is closed twice due to upstream code changes.","solutions":["Treat as non-fatal: the add/delete operation already completed; re-run `mkcert -check` or inspect the ROOT store to confirm the CA state.","Ensure only one mkcert instance manipulates the store at a time to avoid handle races.","Reboot (or restart the Cryptographic Services) if the store is in a bad state and retry.","If reproducible, report upstream to the mkcert project with the GetLastError value."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := store.close(); err != nil {\n    // operation already succeeded; log and continue, do not fail the run\n    log.Printf(\"warning: store close failed: %v\", err)\n}","preventionTips":["Serialize store access: one mkcert process at a time.","Close each store handle exactly once and right after use.","Treat close failures as hygiene warnings, not transactional failures — verify outcomes with `mkcert -CAROOT`/store inspection instead."],"tags":["mkcert","windows","crypt32","handle-management","cleanup"],"backgroundTag":null,"analyzedSha":"1c1dc4ed27ed5936046b6398d39cab4d657a2d8e","analyzedAt":"2026-08-15T09:28:09.359Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}