How to fix Windows Update error 0x800B010A?

Error 0x800B010A means Windows checked the signature on an update or installer and could not follow its certificates up to a root it trusts. The root list on the PC is out of date or cannot be refreshed. Make sure Windows can reach its root certificate server first, then retry the update.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What Windows Update error 0x800B010A means

Microsoft's list of security and setup error codes (Winerror.h) names 0x800B010A CERT_E_CHAINING. It describes it in one line: "A certificate chain could not be built to a trusted root authority." It is one of the 0x800B01 trust codes that Windows raises while it checks a digital signature.

Every Windows update and every Microsoft installer is signed. The signing certificate was issued by an intermediate authority, and that one by a root authority. Windows accepts the file only when it can walk this chain up to a root in its Trusted Root Certification Authorities store. With 0x800B010A the walk stops: the root is not on the PC and Windows could not fetch it.

Why Windows Update error 0x800B010A appears

The missing root is the result. What keeps the root from arriving decides the fix. From the most likely to the least likely:

How to fix Windows Update error 0x800B010A

Fixes 1 to 3 give Windows the root certificate it is missing, which solves most cases. Fix 4 is for Windows 7 only. Fixes 5 to 7 cover a damaged cache or damaged system files.

Fix 1. Let Windows reach its root certificate server and refresh the roots

5 minutesLow riskEveryone, first. Especially when a proxy is set or a security suite filters web traffic.

Windows fetches a missing root from ctldl.windowsupdate.com over plain HTTP on port 80. A manual proxy or a web filter that blocks that host stops the fetch, and every signature that needs a new root fails with 0x800B010A.

1. Open Settings > Network & internet > Proxy. On Windows 10 open Settings > Network & Internet > Proxy.
2. Under Manual proxy setup, turn off Use a proxy server unless your work or school requires it. Turn off Use setup script as well if you did not set it on purpose.
3. Right-click Start and select Terminal (Admin). On Windows 10 select Windows PowerShell (Admin).
4. Go to a folder you can write to with cd $env:TEMP.
5. Run certutil -generateSSTFromWU WURoots.sst. This downloads Microsoft's current root list into one file.
6. If the command ends with CertUtil: -generateSSTFromWU command completed successfully., the path to the root server is open. Restart the PC and select Check for updates again.

Fix 2. Turn automatic root certificate updates back on

10 minutesRead the warningA privacy tool, a tweak script or a company policy may have turned off root updates.

Microsoft documents the policy value DisableRootAutoUpdate under HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot: 0 enables the automatic update of trusted roots, 1 disables it. With 1, Windows never fetches a missing root and the chain stays broken.

1. Right-click Start and select Terminal (Admin).
2. Run reg query "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot" /v DisableRootAutoUpdate.
3. If the result shows ERROR: The system was unable to find the specified registry key or value., the policy is not set. This fix is not for you; go to Fix 3 or Fix 5.
4. If it shows DisableRootAutoUpdate REG_DWORD 0x1, run reg add "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot" /v DisableRootAutoUpdate /t REG_DWORD /d 0 /f.
5. Restart the PC, run Fix 1 again to fetch the roots, and select Check for updates.

Fix 3. Copy the root certificates in from a connected PC when the PC is offline

15 minutesLow riskThe PC has no internet, and a .NET Framework, Visual C++ or update installer fails with 0x800B010A.

An offline PC never gets new roots, so any installer signed under a newer root fails the chain check. The same root list Windows would download can be made on another PC and imported by hand.

1. On a PC with internet, open Terminal (Admin) and run certutil -generateSSTFromWU WURoots.sst in a folder you can find again.
2. Copy WURoots.sst to a USB drive and plug it into the offline PC.
3. On the offline PC press Win + R, type certlm.msc and select OK. Select Yes in the User Account Control prompt.
4. Expand Trusted Root Certification Authorities, right-click Certificates and select All Tasks > Import.
5. Select Next, then Browse. Set the file type list to **Microsoft Serialized Certificate Store (*.sst)** and open WURoots.sst.
6. Keep Place all certificates in the following store with Trusted Root Certification Authorities, select Next and Finish.
7. Run the installer or the update again.

Fix 4. Install the SHA-2 code signing updates on Windows 7

20 to 40 minutesLow riskThe PC runs Windows 7 SP1 and Windows Update fails.

Since 13 August 2019 Microsoft signs Windows 7 updates with SHA-2 only. Microsoft requires the servicing stack update KB4490628 and the SHA-2 update KB4474419 before any later update. Without them update signatures cannot be checked at all.

1. Open Control Panel > Programs and Features > View installed updates and look for KB4474419 and KB4490628.
2. If one is missing, download it from the Microsoft Update Catalog for Windows 7 for x64-based Systems or for x86, to match your PC.
3. Install both. Microsoft says the order does not matter.
4. Restart the PC before you install any other update.
5. Run Fix 1 again so Windows also refreshes its roots, then check for updates.

Fix 5. Reset the Windows Update components and the catroot2 signature catalogs

10 minutesLow riskThe roots download fine (Fix 1 worked) but the same update keeps failing.

Windows keeps the downloaded update in SoftwareDistribution and the signature catalogs in catroot2. Renaming both and restarting Cryptographic Services makes Windows download the update and check its chain again, now with the fresh roots.

1. Open Command Prompt as administrator. Type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Stop the update services. Type the commands below and press Enter after each one. If Windows says that other services depend on Cryptographic Services, it stops them too. A message that a service is not started is fine.

   net stop wuauserv
   net stop bits
   net stop cryptsvc

3. Delete the download queue files. This clears the list of downloads that the Background Intelligent Transfer Service keeps. If Windows says it cannot find the files, continue.

   del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

4. Rename the update cache folders. Renaming keeps a copy in case you need it; Windows creates new, empty folders when the services start again. If you get Access is denied, a service is still running: repeat the previous step.

   ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
   ren %systemroot%\System32\catroot2 catroot2.old

5. Start the services again. Type the commands below and press Enter after each one. The requested service has already been started is fine: Windows started it on its own.

   net start cryptsvc
   net start bits
   net start wuauserv

6. Restart and check for updates. Restart the PC. Then select Start > Settings > Windows Update > Check for updates. The first check can take longer than usual because everything is downloaded again.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Reset Windows Update components

Fix 6. Install the failing update by hand from the Microsoft Update Catalog

10 to 20 minutesLow riskOne KB keeps failing after Fix 1 and Fix 5.

The Catalog file comes through your browser, outside the Windows Update download path. Its installer checks the chain again on your disk, and with the roots now in place the check usually passes.

1. Check your Windows version. Press Windows key + R, type winver and press Enter. Note the version (for example 25H2) and the OS build.
2. Find the KB number. Open Settings > Windows Update. A failed or pending update is listed with its KB number; earlier ones are under Update history.
3. Check the processor type. Open Settings > System > About and look at System type: an x64-based PC needs the x64 file, an ARM-based PC (for example Snapdragon) needs the arm64 file.
4. Search the catalog. Open the Microsoft Update Catalog at catalog.update.microsoft.com in your browser, type the KB number (for example KB5124010) in the search box and press Enter.
5. Pick the right row. Find the row whose title names your Windows version and your processor type (x64-based or arm64-based) and select Download on that row.
6. Download every file listed. A window lists one or more .msu links. Download all of them into one empty folder, for example C:\packages. On Windows 11 24H2 and later the list can include earlier checkpoint updates that the new one needs.
7. Install a single file. If there is only one file, double-click it and confirm the installation in the Windows Update Standalone Installer.

These steps were written for Windows 11 24H2 and later; Windows 10 22H2. The full page with the other versions and what each result means: Install an update from the Microsoft Update Catalog

Fix 7. Repair system files and the certificate store with DISM and SFC

20 to 30 minutesLow riskSeveral signed programs and updates fail, or Fixes 1 to 6 did not help.

In rare cases a damaged crypto component or system file makes every chain check fail. DISM repairs the component store and SFC then restores damaged system files from it.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

If the error 0x800B010A is still there

The logs show which file failed the chain check and whose certificate it carries. That tells you which root is missing.

• Home PC, Fix 1 shows a blocked download: the block is outside Windows. Check the router, the security suite's web filter and any parental control service.
• Work or school PC: send IT the code, the KB number and the certutil -generateSSTFromWU result. Root updates and the proxy are set by policy there.
• Home PC, nothing helped: reinstall Windows over itself and keep your files and apps: Reinstall Windows without losing files
• Windows 10: support ended on 14 October 2025. Only PCs in Extended Security Updates still get security updates, so check the PC is enrolled before you spend time on a failing update.

How to keep error 0x800B010A from coming back

Frequently asked questions

What does error 0x800B010A mean?

It means Windows could not build a certificate chain from a signed file up to a root it trusts. Microsoft names the code CERT_E_CHAINING and describes it as: a certificate chain could not be built to a trusted root authority. The file itself may be fine. What is missing is the root certificate on your PC, and the usual reason is that Windows could not download it from its root certificate server. Unblock that download first (Fix 1).

How do I fix 0x800B010A on Windows 7?

Install the two SHA-2 prerequisites, the servicing stack update KB4490628 and the SHA-2 update KB4474419, from the Microsoft Update Catalog, and restart (Fix 4). Then make sure the PC can reach ctldl.windowsupdate.com so it can refresh its roots (Fix 1). Keep in mind that Windows 7 support ended on 14 January 2020 and its paid security updates have ended too, so a working update path does not make it safe to use online.

Does 0x800B010A appear on Windows 10 and Windows 11?

Yes, less often than on Windows 7. On Windows 10 and Windows 11 the root list refreshes itself, so the error usually means something stops that refresh: a proxy, a web filter, a policy that turns off root updates, or no internet at all. Fix 1 tests the path in one command. Fix 2 checks the policy. The fixes are the same on both versions; only the Settings paths differ slightly.

Why does a .NET Framework or Visual C++ installer fail with 0x800B010A?

These installers check their own signature before they install. On a PC that is offline, or that has not refreshed its roots for a long time, the root behind a newer signature is missing, and the check fails with the same code. Import the root list from a connected PC (Fix 3) and run the installer again. If it then fails with a different error, repair the packages: How to repair Microsoft Visual C++ Redistributable and .NET Framework

What does signing failed with error 800b010a mean?

This message comes from code signing tools on a developer's PC, not from Windows Update. It has the same meaning: the tool could not build a chain from your signing certificate to a trusted root. Most often the intermediate certificate from your certificate authority is not installed on the signing PC, or its root is missing. Install the intermediate and root certificates your authority publishes, then sign again.

Is it safe to import root certificates by hand?

It is safe when the list comes from Microsoft. The command certutil -generateSSTFromWU downloads the same trusted root list Windows would fetch on its own, so importing it changes nothing Windows would not do itself. Never import a root certificate sent by a website, a pop-up or a stranger. A rogue root lets an attacker read and change your encrypted traffic.

Does the Windows Update troubleshooter fix 0x800B010A?

Rarely. The troubleshooter restarts update services and clears some pending downloads, but it does not fetch root certificates or change the policy that blocks them. Fix 1 and Fix 2 go straight at the cause. It cannot hurt to run it once, so if you want to try it anyway, here is how: Run the Windows Update troubleshooter

Is 0x800B010A the same as 0x800B010F or 0x803C010A?

No. 0x800B010F means the name on a certificate does not match the server. A VPN or proxy often causes it, and it has its own guide on this site. 0x800B010A is about a missing root in the chain. 0x803C010A is a different code family that this page does not cover. Check the exact digits on your screen before you choose a fix.

This page is in English. What if I searched in another language?

Some readers reach this page with searches such as esta dando esse erro, qué significa esto, tengo windows 7, como solucionarlo, voilà ce qui s'affiche and код ошибки. In each case the code 0x800B010A was on the screen. The meaning is the same in every language: Windows is missing a trusted root certificate. The fixes work the same on a Windows set to Spanish, Portuguese, French or Russian; only the menu names are translated.