Windows Digital Signature & Certificate Diagnostics
Windows signing regressions cluster around cumulative updates, third-party trust providers, and CNG provider conflicts. We benchmark the machine against a known-good baseline and produce a remediation list ranked by impact.
Symptoms we triage
- Digital signature not working after Windows 11 update
- Certificate visible in MMC but not in signing app
- Edge / Chrome stops offering client certificate
- Schannel TLS handshake failures with client certs
- CAPI2 log full of chain-building errors
Diagnostic flow
1. Capture CAPI2 operational log
Expected: Chain build errors with leaf + intermediate IDs
2. Validate certificate
certutil -verify -urlfetch user.cerExpected: All chain elements resolve
3. Confirm CNG providers
certutil -csplistExpected: Expected KSP / CSP for the token present
OS coverage
Windows 10 / 11
- • Windows 11 23H2 / 24H2 CAPI behaviour
- • Windows 10 22H2 trust store comparisons
- • WSUS / Intune deployed trusted roots
Windows troubleshooting library
In-depth diagnostic write-ups for each common Windows failure mode.
Frequently asked
Can you fix this without admin rights?
Most trust-store and middleware fixes require local admin. We document what to request from IT if you do not.
Related fix guides
Step-by-step diagnostic write-ups for the most common Windows errors.
Related services
Related diagnostics hubs that often share the same root cause.
Ready for a structured Windows diagnostic?
Independent consulting, screen-shared remote session, written remediation summary.