Free tools Windows power users keep installed
One-click scans. No signup required.
To validate a certificate in Windows, identify the application using it, confirm that Windows can build a trusted chain for the certificate’s intended purpose, and check whether the application can obtain acceptable revocation information. There is no single command or setting that produces the same result for every Windows application: a browser or TLS program, Network Policy Server (NPS), and Microsoft Entra certificate-based authentication can apply different policies.
How Windows validates a certificate
Windows builds a certificate chain from the certificate being checked through any intermediate certificate authorities (CAs) to a root. A trust provider and application policy then evaluate whether that chain is acceptable for the certificate’s use. Chain construction and revocation checking are related but distinct: a chain can reach a trusted root while a revocation check fails, or fail trust evaluation even when revocation data is available.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Visa Virtual $50 eGift Card (plus $4.95 Purchase Fee) - For Online Use Only | $54.95 | Buy on Amazon |
| 2 |
|
Amazon eGift Card - Smart Apples | $50.00 | Buy on Amazon |
| 3 |
|
MasterCard Virtual eGift Card | $206.95 | Buy on Amazon |
| 4 |
|
Visa Virtual eGift Card | $206.95 | Buy on Amazon |
| 5 |
|
dot. Card - Digital Business Card - Tap Compatible with iPhone & Android (Black) | $29.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
Revocation status may come from cached information or from network retrieval. Certificate Revocation Lists (CRLs) and Online Certificate Status Protocol (OCSP) responses can be used, depending on the API and application policy. An unavailable, expired, stale, or mismatched CRL—or a network path that cannot reach its distribution point—can prevent a successful check. Microsoft’s CertGetCertificateChain reference describes these API-level chain and revocation behaviors.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How to verify a certificate chain in Windows
- Identify the consumer and failure. Record the operating system, application or service, certificate purpose, exact error, and whether the failure occurs locally or in a remote service. A browser, a TLS application using Crypt32, NPS, and Entra certificate-based authentication may not share the same policy.
- Check chain construction and trust. Determine whether the chain reaches the expected intermediate and root certificates, and inspect the resulting trust status. A successful chain build alone does not prove that the certificate satisfies every application-specific policy.
- Review CAPI2 events for chain failures. In Event Viewer, inspect the CAPI2 Operational log for the relevant “Build Chain” and “Verify Chain Policy” events. These provide evidence about chain construction and policy verification when investigating a trust error.
- Use the appropriate certutil operation. Windows includes
certutilfor certificate and CA inspection, CRL operations, and Certificate Trust List (CTL) verification. Choose the operation for the question at hand and consult Microsoft’s certutil command reference for exact syntax and options. No one command establishes that every application’s chain and revocation policy will accept a certificate. - Check revocation separately. Inspect the certificate’s CRL Distribution Points (CDPs), the CRL’s issuer and validity interval, and whether the checking machine can reach the relevant endpoint through its proxy, firewall, and network path. Consider the cache and when the CA last published updated revocation data.
Why certutil or an application reports an untrusted root
Microsoft defines CERT_E_UNTRUSTEDROOT (0x800b0109) as a chain that was processed but terminated at a root certificate not trusted by the trust provider. The reported message is: “A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.” This points to a trust-chain problem; it is not, by itself, evidence that the certificate is revoked.
#1 Best Overall
- Visa Virtual eGift Cards are designed for online use only. Gift Cards are subject to Terms and Conditions: a.co/5bw3qXJ
- When you access your Visa Virtual eGift Card for the first time, you’ll need to register your name, address, phone number, and email address via activationspot.com. These details should also be used as your billing address for online purchases, as many merchants require address verification for purchase authorization.
- This Visa Virtual eGift Card is non-reloadable. No cash or ATM access. Visa Virtual eGift Cards are emailed active.
- Funds do not expire but your Visa Virtual eGift Card has a ‘valid thru’ date (9 years from date of purchase). If funds remain after this date has passed, please call the Toll Free number found on your Visa Virtual eGift Card for a replacement card. A one-time purchase fee applies at the time of checkout.
- This item is not eligible for refund, resale, or return. Available for sale within the United States only. Not available to residents of Puerto Rico, Hawaii, New Mexico, South Dakota, West Virginia and the US Virgin Islands.
Use the CAPI2 Operational log’s Build Chain and Verify Chain Policy events to see where the chain ended and how policy evaluation treated it. Microsoft’s troubleshooting guidance describes root certificates distributed through Group Policy as one possible cause in a particular scenario, not as the universal explanation. Check the actual root and intermediate certificates, the applicable trust configuration, and the application’s policy rather than assuming one cause from the error alone. See Microsoft’s certificate-chain troubleshooting guidance.
Why certificate revocation checking fails
A revocation check can fail because the certificate is revoked, because the checker cannot obtain usable status information, or because retrieved data is not valid for the certificate or time being checked. NPS documentation identifies missing CRL information, inaccessible CRLs, issuer mismatch, and expired CRLs among the causes of a failed check. Check the CRL issuer and its validity dates, confirm that the CDP is reachable from the validating system, and account for cached data and CA publication timing.
Rank #2
- Amazon.com Gift Cards never expire and carry no fees.
- Multiple gift card designs and denominations to choose from.
- Redeemable towards millions of items store-wide at Amazon.com or certain affiliated websites.
- Available for immediate delivery. Gift cards can be sent by email/SMS and can be scheduled up to a year in advance.
- No returns and no refunds on Gift Cards.
CRLs describe status as of the available published list; a checker may therefore be using cached information rather than a newly published CRL. A stale cache or delayed publication can affect what the system sees. OCSP responses may also be used by applications that support them. The exact retrieval and freshness behavior depends on the certificate consumer and its implementation.
How behavior differs by certificate consumer
| Consumer | Documented behavior | What to check |
|---|---|---|
Windows application using CertGetCertificateChain |
With online revocation enabled, the API can use a time-valid OCSP response or CRL from cache or stores and can attempt URL retrieval. Microsoft’s TLS-server-certificate guidance recommends end-certificate revocation checking, allowing network retrieval, bounding retrieval time, and caching end-certificate validation information. It also recommends that TLS servers support OCSP stapling. These are API implementation recommendations, not a universal rule for every Windows consumer. | Review the application’s chain flags, revocation scope, network retrieval behavior, timeout, and cache policy against its security requirements. See the API reference. |
| Network Policy Server (NPS) | NPS checks revocation for all certificates in the chain by default for certificate-based authentication. If a required check fails, NPS can deny the connection. Microsoft states that when NPS cannot locate CRLs during validation, certificate-based connection attempts are rejected. | Ensure primary and secondary CRL publication locations are accessible to NPS and other RADIUS servers, and that current CRLs are published. See Microsoft’s NPS revocation-check guidance. |
| Microsoft Entra certificate-based authentication (CBA) | Entra CBA has service-specific trusted-CA and CRL requirements. Its issuer-trust and CRL errors should not be inferred solely from local Windows chain behavior. | Check the service’s configured trusted issuers and its CRL accessibility and freshness requirements using Microsoft’s Entra CBA certificate-trust guidance. |
Should an application ignore an offline revocation error?
Microsoft’s API documentation discusses ignoring offline revocation errors as an implementation choice. Doing so may allow validation to proceed when status cannot be obtained, but it also removes the assurance that the certificate was checked against current revocation information. Treat this as a deliberate risk and policy decision for the application—not a general fix for a broken CRL endpoint or failed authentication.
Rank #3
- Mastercard Virtual eGift Cards are designed for online use only. Gift Cards are subject to Terms and Condition: a.co/9V5i70m
- When you access your Mastercard Virtual eGift Card for the first time, you’ll need to register your name, address, phone number, and email address via activationspot.com. These details should also be used as your billing address for online purchases, as many merchants require address verification for purchase authorization.
- This Mastercard Virtual eGift Card is non-reloadable. No cash or ATM access. - Mastercard Virtual eGift Cards are emailed active.
- Funds do not expire but your Mastercard Virtual eGift Card has a ‘valid thru’ date (9 years from date of purchase). If funds remain after this date has passed, please call Mastercard customer service for a replacement card. A one-time purchase fee applies at the time of checkout.
- This item is not eligible for refund, resale, or return. Available for sale within the United States only. Not available to residents of Puerto Rico, Hawaii, New Mexico, South Dakota, West Virginia and the US Virgin Islands.
For a TLS application, the API guidance offers more targeted design choices: scope revocation checks to the end certificate where appropriate, permit network retrieval when required, set a bounded retrieval timeout, cache validation information, and support OCSP stapling on TLS servers. These options must be assessed in the context of the application’s security and availability requirements.
Quick Recap
Best Value
- No app or device requirement: Share your dot.Profile with anyone, as others don't need an app or a dot.device to receive your information.
- Hassle-free sharing: Easily share your dot.Profile with unlimited free shares of your digital business card.
- Simple sharing process: Tap your dot.device to a compatible phone or scan the dot.Profile QR code to share your profile. Compatible with a wide range of phones.
- Update information on the go: Keep your dot.Profile up to date by easily modifying and updating your information as it changes, ensuring you always have the most accurate details.
- Privacy and security: Protect your information with dot, as no passwords are ever needed to link your social accounts. Dot uses only usernames and links to create your digital business card.
Rank #4
- Visa Virtual eGift Cards are designed for online use only. Gift Cards are subject to Terms and Conditions: a.co/5bw3qXJ
- When you access your Visa Virtual eGift Card for the first time, you’ll need to register your name, address, phone number, and email address via activationspot.com. These details should also be used as your billing address for online purchases, as many merchants require address verification for purchase authorization.
- This Visa Virtual eGift Card is non-reloadable. No cash or ATM access. Visa Virtual eGift Cards are emailed active.
- Funds do not expire but your Visa Virtual eGift Card has a ‘valid thru’ date (9 years from date of purchase). If funds remain after this date has passed, please call the Toll Free number found on your Visa Virtual eGift Card for a replacement card. A one-time purchase fee applies at the time of checkout.
- This item is not eligible for refund, resale, or return. Available for sale within the United States only. Not available to residents of Puerto Rico, Hawaii, New Mexico, South Dakota, West Virginia and the US Virgin Islands.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
