{"record":{"id":"b821e871017e02f7","repo":"FiloSottile/mkcert","slug":"failed-to-open-windows-root-store-v","errorCode":null,"errorMessage":"failed to open windows root store: %v","messagePattern":"failed to open windows root store: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"truststore_windows.go","lineNumber":80,"sourceCode":"\tif err == nil && !deletedAny {\n\t\terr = fmt.Errorf(\"no certs found\")\n\t}\n\tfatalIfErr(err, \"delete cert\")\n\treturn true\n}\n\ntype windowsRootStore uintptr\n\nfunc openWindowsRootStore() (windowsRootStore, error) {\n\trootStr, err := syscall.UTF16PtrFromString(\"ROOT\")\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\tstore, _, err := procCertOpenSystemStoreW.Call(0, uintptr(unsafe.Pointer(rootStr)))\n\tif store != 0 {\n\t\treturn windowsRootStore(store), nil\n\t}\n\treturn 0, fmt.Errorf(\"failed to open windows root store: %v\", err)\n}\n\nfunc (w windowsRootStore) close() error {\n\tret, _, err := procCertCloseStore.Call(uintptr(w), 0)\n\tif ret != 0 {\n\t\treturn nil\n\t}\n\treturn fmt.Errorf(\"failed to close windows root store: %v\", err)\n}\n\nfunc (w windowsRootStore) addCert(cert []byte) error {\n\t// TODO: ok to always overwrite?\n\tret, _, err := procCertAddEncodedCertificateToStore.Call(\n\t\tuintptr(w), // HCERTSTORE hCertStore\n\t\tuintptr(syscall.X509_ASN_ENCODING|syscall.PKCS_7_ASN_ENCODING), // DWORD dwCertEncodingType\n\t\tuintptr(unsafe.Pointer(&cert[0])),                              // const BYTE *pbCertEncoded\n\t\tuintptr(len(cert)),                                             // DWORD cbCertEncoded\n\t\t3,                                                              // DWORD dwAddDisposition (CERT_STORE_ADD_REPLACE_EXISTING is 3)","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/FiloSottile/mkcert/blob/1c1dc4ed27ed5936046b6398d39cab4d657a2d8e/truststore_windows.go#L62-L98","documentation":"openWindowsRootStore() calls the Win32 API CertOpenSystemStoreW(\"ROOT\"); if it returns a NULL handle the formatted error is thrown. The dominant cause is lack of elevation — writing to the CurrentUser/ROOT store (and LocalMachine even more so) requires an elevated process on Windows. The syscall always returns a non-nil err (its last-call error), so the real diagnostic is whatever GetLastError reported, typically ERROR_ACCESS_DENIED.","triggerScenarios":"Running `mkcert -install` or `mkcert -uninstall` from a non-elevated cmd/PowerShell/terminal; CI runners or containers executing as a restricted service account; group policy or AV blocking modifications to the ROOT store; a corrupted user certificate store profile.","commonSituations":"Developer opens a regular terminal instead of 'Run as administrator'; Docker Windows containers where the ROOT store is not writable; CI agents provisioned without admin; enterprise hardened images that deny cert-store writes to standard users.","solutions":["Relaunch the terminal as Administrator and rerun `mkcert -install`.","If running in CI/containers, ensure the agent/container runs with sufficient privileges to write the ROOT store, or pre-install the CA via image build.","Verify the user profile's certificate stores are healthy: `certutil -store -user ROOT` and `certutil -store ROOT`.","Check group policy / antivirus rules that protect the trusted root store and exempt the mkcert process or use an approved deployment channel (e.g. GPO-based CA distribution)."],"exampleFix":"# before (non-elevated shell)\nmkcert -install\n# => failed to open windows root store: Access is denied.\n\n# after (elevated shell)\n# Right-click terminal -> Run as administrator\nmkcert -install\n# => The local CA is now installed in the system trust store!","handlingStrategy":"validation","validationCode":"if runtime.GOOS == \"windows\" {\n    if !isElevated() { // check membership in BUILTIN\\Administrators + token elevation\n        log.Fatal(\"mkcert -install requires an elevated terminal on Windows\")\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always launch terminals for mkcert install/uninstall via 'Run as administrator'.","In CI/containers, bake the CA into the image at build time instead of installing at runtime.","Confirm write access to the ROOT store before scripting installs (`certutil -store ROOT` as a smoke test).","Coordinate with IT when AV/EDR or GPO restricts certificate stores."],"tags":["mkcert","windows","crypt32","access-denied","elevation","certificate-store"],"backgroundTag":null,"analyzedSha":"1c1dc4ed27ed5936046b6398d39cab4d657a2d8e","analyzedAt":"2026-08-15T09:28:09.359Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}