Could not establish trust relationship for the SSL/TLS secure channel

Where you see it

In Windows PowerShell 5.1 (Invoke-WebRequest, Invoke-RestMethod, System.Net.WebClient) and in .NET Framework applications that use HttpWebRequest:

Invoke-WebRequest : The underlying connection was closed: Could not establish trust relationship for the SSL/TLS
secure channel.
At line:1 char:1
+ Invoke-WebRequest -Uri https://api.example.com/ -UseBasicParsing
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

This is the TrustFailure status of a WebException; the text is in the .NET Framework reference source. The inner exception says more:

$Error[0].Exception.InnerException.Message

The remote certificate is invalid according to the validation procedure.

PowerShell 7 runs on modern .NET and reports the same problem differently; see The remote certificate is invalid according to the validation procedure.

What it means

.NET Framework asked Windows to check the server’s certificate, and Windows said no. Windows builds the certificate chain from the server’s certificate up to a root certificate in the machine’s Trusted Root Certification Authorities store, and checks the dates and the host name. Any failure gives this one message. To fix it, find out which check failed.

Find the exact reason

Windows PowerShell keeps the certificate of the failed connection, so you can ask Windows to build the chain and show its status, without switching anything off:

$req = [System.Net.HttpWebRequest]::Create('https://api.example.com/')
try { $req.GetResponse().Dispose() } catch { }
$cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($req.ServicePoint.Certificate)
$chain = [System.Security.Cryptography.X509Certificates.X509Chain]::new()
$chain.Build($cert)
$chain.ChainStatus | Format-List Status, StatusInformation
$cert | Format-List Subject, Issuer, NotAfter, DnsNameList

False

Status            : PartialChain
StatusInformation : A certificate chain could not be built to a trusted root authority.

Status            : NotTimeValid
StatusInformation : A required certificate is not within its validity period when verifying against the current system
                    clock or the timestamp in the signed file.

Status            : RevocationStatusUnknown
StatusInformation : The revocation function was unable to check revocation for the certificate.

Status            : OfflineRevocation
StatusInformation : The revocation function was unable to check revocation because the revocation server was offline.

Subject     : CN=api.example.com
Issuer      : CN=Example Issuing CA, O=Example CA
NotAfter    : 2026-04-01 2:00:00 AM
DnsNameList : {api.example.com}

Look for UntrustedRoot, PartialChain or NotTimeValid. RevocationStatusUnknown and OfflineRevocation can also appear, because this check asks Windows to look up revocation. If the chain is fine, compare DnsNameList with the host name you used.

Likely causes

UntrustedRoot or PartialChain: the root is not trusted here

Internal servers often use a company CA; a TLS-inspection proxy re-signs public sites with its own root. Both roots must be in the Windows store. Fix: ask IT to deploy the root through Group Policy or Intune, or import it yourself (administrator):

Import-Certificate -FilePath .\corp-root.cer -CertStoreLocation Cert:\LocalMachine\Root

See How to trust a private root CA on Windows and How to work behind a TLS-inspecting corporate proxy, safely.

On machines without internet access, a public root can also be missing: Windows downloads trusted roots from Windows Update when it needs them, and disconnected machines must get them another way (Microsoft: trusted roots in disconnected environments).

PartialChain: the server does not send its intermediate

Windows can download a missing intermediate itself, but not on a network that blocks it. Confirm with openssl s_client -showcerts (Git for Windows includes OpenSSL): one certificate means the intermediate is missing. Fix the server: How to build the full chain file your server needs. On IIS, import the intermediate into the computer’s “Intermediate Certification Authorities” store.

NotTimeValid: a certificate expired

Renew the server’s certificate and reload the service, or correct the client’s clock (w32tm /resync).

The name does not match

Calling a server by its IP address or a short name that is not in the certificate fails too. Use the name in DnsNameList, or add the name you need to the certificate.

Check yours

Try it: Chain checkerOpen the full tool

Runs in your browser. Nothing you paste is sent anywhere.

Paste the chain

Try a sampleChoose a sample…A complete chain: leaf, intermediate and rootA server that forgets its intermediateA chain in the wrong orderA self-signed root CA

-----BEGIN CERTIFICATE----- MIIC1zCCAnygAwIBAgIQWTTOzqWiPshGdQhNb6kmNjAKBggqhkjOPQQDAjB+MQsw CQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UECxMe U2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSswKQYDVQQDEyJQS0kgWmVy byB0byBIZXJvIFNhbXBsZSBJc3N1aW5nIENBMB4XDTI2MTAwMTAwMDAwMFoXDTM2 MTAwMTAwMDAwMFowGjEYMBYGA1UEAxMPd3d3LmV4YW1wbGUuY29tMFkwEwYHKoZI zj0CAQYIKoZIzj0DAQcDQgAEw4og6Y/SOr+WrqSv+ng7tOBEsc5N3A3yZRk+9hsR XzPQvB9672aHZHTYFNlSY93RWVcTRieE+8XnIbWIYfwxIqOCAT4wggE6MAwGA1Ud EwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMCcG A1UdEQQgMB6CD3d3dy5leGFtcGxlLmNvbYILZXhhbXBsZS5jb20wHQYDVR0OBBYE FALMipe4vcXJTpwO926S15Y/bobzMB8GA1UdIwQYMBaAFN+ph37v40SN23r6Fg/z OvSNjJqeMEgGCCsGAQUFBwEBBDwwOjA4BggrBgEFBQcwAoYsaHR0cDovL3BraS5l eGFtcGxlLmNvbS9zYW1wbGUtaXNzdWluZy1jYS5jcnQwPQYDVR0fBDYwNDAyoDCg LoYsaHR0cDovL3BraS5leGFtcGxlLmNvbS9zYW1wbGUtaXNzdWluZy1jYS5jcmww EwYDVR0gBAwwCjAIBgZngQwBAgEwCgYIKoZIzj0EAwIDSQAwRgIhAM5dJUPhL+qV artvWtQinfnykhVflJTjMXe8M6PnqQfaAiEAhOLGj1hSEkNxQoMrYNXRaIe69nq6 2unibVFSVw1AC80= -----END CERTIFICATE-----

Every certificate the server sends, leaf first. The output of openssl s_client -showcerts -connect example.com:443 works as it is: we ignore the text around the certificates.

Check the chainClearChoose a file

Paste the certificates the server sends (from openssl s_client -showcerts, or exported from the browser). The checker shows a missing intermediate and names the root the chain needs.

Learn why

• Who do we trust? CAs, trust stores and self-signed certificates: the Windows store and other stores.
• Certificate chains and path validation: how Windows builds the chain.
• Related: schannel: SEC_E_UNTRUSTED_ROOT in git and curl on Windows.

In the gameLevel 12: Who do we trust?Registry of Roots, Keystone. In development