Diagnose a Certificate Error with Certutil

The browser hides the chain behind a warning. A direct TLS handshake in PowerShell prints the subject, the issuer and the validity dates without a security prompt.

$h = 'example.com'
$req = [Net.HttpWebRequest]::Create("https://$h")
$req.Timeout = 10000
try { $req.GetResponse() | Out-Null } catch { $_.Exception.Message }
$req.ServicePoint.Certificate | Select-Object Subject,Issuer,GetEffectiveDateString,GetExpirationDateString

A machine that is a day behind fails every freshly issued certificate. **w32tm** shows the offset, and the time zone must match the one the machine is in.

w32tm /query /status
w32tm /stripchart /computer:time.windows.com /samples:3
Get-Date
Get-TimeZone

**certutil -verify** walks the chain and fetches every intermediate from its published URL. A chain that fails only in urlfetch is missing an intermediate on the server.

certutil -urlcache * delete
certutil -verify -urlfetch C:\temp\server.cer
certutil -dump C:\temp\server.cer | Select-String -Pattern 'Subject|Issuer|NotAfter'

A corporate proxy or a security product replaces the server certificate with its own. That is not a bug, but it fails any client that does not trust the proxy's root.

netsh winhttp show proxy
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' | Select-Object ProxyEnable,ProxyServer
Get-ChildItem Cert:\LocalMachine\Root | Where-Object Subject -like '*Proxy*'

An expired certificate is a server problem. A missing intermediate is fixed by importing it into **Intermediate Certification Authorities** on the client or on the server.

Import-Certificate -FilePath C:\temp\intermediate.cer -CertStoreLocation Cert:\LocalMachine\CA
Get-ChildItem Cert:\LocalMachine\CA | Select-Object Subject,NotAfter
certutil -verify -urlfetch C:\temp\server.cer

The chain is cached per process. Restart the browser or the app, then check the connection again with the same PowerShell handshake before declaring it fixed.

Stop-Process -Name chrome -ErrorAction SilentlyContinue
$req = [Net.HttpWebRequest]::Create('https://example.com')
try { $req.GetResponse().StatusCode } catch { $_.Exception.Message }
Get-ChildItem Cert:\CurrentUser\Disallowed | Select-Object Subject