Last updated: July 13, 2026
TL;DR — Key Takeaways
- A repeating root certificate prompt usually means software on your PC is inspecting HTTPS traffic.
- Antivirus suites and corporate VPNs both install their own root certificates to do this.
- A random GUID-style certificate name means it was generated locally, not by a public authority.
- Do not click Accept on a root certificate you cannot identify. Identify it first.
- Malware is possible but far less common than the boring explanations.
A prompt asking you to trust an unknown certificate authority feels alarming. In most cases it is not a hacker. It is software already on your machine, doing something poorly.
What the popup is actually telling you
A root certificate authority vouches for the identity of websites. Your browser is warning you that something is claiming that authority. It cannot verify who or what that something is.
Browsers trust a curated list of root certificate authorities. Those roots sign the certificates that prove a website is really who it claims to be. Our guide on how SSL certificates work covers that trust chain in detail.
When a certificate shows up that is not signed by a trusted root, the browser refuses to accept it silently. That is the warning working correctly, not a failure.
Why the certificate has a random name
A certificate issued to a random GUID-style string was generated locally on your computer. Public certificate authorities use recognizable organization names, not random identifiers.
This is the single most useful clue in the whole prompt. Legitimate public roots carry names like DigiCert, Let’s Encrypt, or Sectigo. A string of hex characters is not a company.
Security software often generates a unique root certificate at install time, named with a random identifier. That is expected behavior for that software. It is not, however, something a public authority would ever do.
The four things that actually cause this
| Cause | How Common | Telltale Sign |
|---|---|---|
| Antivirus HTTPS scanning | Very common | Issuer names your AV vendor, or a local GUID |
| Corporate VPN or proxy inspection | Common on work devices | Appears only on a managed or work machine |
| Leftover cert from uninstalled software | Occasional | Started after removing a security tool |
| Adware or malware root CA | Least common | No matching installed software at all |
Antivirus HTTPS scanning is the usual suspect
Consumer security suites inspect encrypted web traffic to look for threats. To read HTTPS, they must install their own root certificate and re-sign every site’s certificate on the fly.
When that process breaks, every HTTPS site can throw errors at once. Google researchers documented an Avast bug that did exactly this. The software generated its root using the system clock. A wrong clock at install time produced an expired root afterward.
They estimated that single bug caused roughly 1.5 million certificate warnings per week. It is a good reminder that boring software bugs cause far more of these prompts than attackers do.
Corporate VPNs and proxies do the same thing
Workplace network security often inspects TLS traffic for data loss prevention. The mechanism is identical to antivirus interception, just run by your IT department instead.
If this is a work laptop, the certificate is probably legitimate and intentional. Ask your IT team before removing anything.
The malware case, and why it is rarer than you think
Adware and malware can install a root certificate to intercept HTTPS traffic and inject ads. This is the scenario people fear, and it is real.
It is also the least likely explanation. Check the boring causes first, and only treat malware as likely once the others are genuinely ruled out.
How to inspect the certificate yourself
Open your system’s certificate store, find the root in question, and check its issuer and validity dates. If it matches software you installed, the mystery is solved.
On Windows
- Press
Windows + R, typecertmgr.msc, and press Enter. - Expand Trusted Root Certification Authorities, then click Certificates.
- Sort by name and look for entries that do not match a known public authority.
- Double-click a suspicious entry to view its issuer, validity dates, and thumbprint.
On macOS
- Open Keychain Access from Applications, then Utilities.
- Select the System and System Roots keychains in the sidebar.
- Filter by Certificates and scan for unfamiliar entries.
- Double-click any entry to inspect its details and trust settings.
Cross-reference what you find against your installed programs list. If the certificate’s name matches your antivirus, VPN client, or a former security tool, you have your answer.
How to fix it
The fix depends on the cause. Disable HTTPS scanning in your antivirus, or remove a stale certificate left by uninstalled software. Run a malware scan if nothing accounts for it.
Work through these in order:
- Check your system clock first. A wrong date makes valid certificates appear expired. This is the fastest thing to rule out.
- Disable HTTPS or SSL scanning in your antivirus. Most suites expose this under a web protection or online threat setting. Restart the browser afterward.
- Remove stale certificates from uninstalled software. If a security tool is gone but its root remains, delete the root in the certificate store.
- Run a reputable malware scan. Do this if no installed software accounts for the certificate.
- Ask IT before touching anything on a work machine. The certificate is likely required for network access.
Why you should never blindly click Accept
Accepting a root certificate grants it authority to vouch for any website. A malicious root can impersonate your bank or email provider without triggering any browser warning.
That is what makes this prompt worth taking seriously, even though the cause is usually mundane. Trusting a root is not like dismissing a cookie banner. It is a broad grant of authority.
The cost of investigating is a few minutes. The cost of accepting a malicious root is every encrypted session on that machine.
Want to see what a legitimate certificate looks like? Run the domain through our SSL Certificate Checker and compare the issuer.
Frequently Asked Questions
Does an untrusted root certificate popup mean my computer is hacked?
Usually not. The most common cause is antivirus software that inspects HTTPS traffic using its own root certificate. Corporate VPNs and proxies do the same thing. Malware is possible but far less likely, and you can check which one it is.
Why is the certificate issued to a random string of characters?
A random GUID-style name means the certificate was generated locally on your machine, not by a public certificate authority. Real public CAs use recognizable organization names. Security software often generates a unique local root at install time.
How do I see which root certificates are installed on Windows?
Press Windows key plus R, type certmgr.msc, and press Enter. Open Trusted Root Certification Authorities, then Certificates. On macOS, open Keychain Access and select the System Roots keychain to see the same kind of list.
Is it safe to just click Accept on the certificate prompt?
No. Accepting a root certificate you cannot identify grants it authority to vouch for any website. If it belongs to malware, that lets an attacker impersonate banking or email sites without triggering a browser warning. Identify it before accepting it.
Can antivirus software really cause certificate errors?
Yes. Google researchers traced a single Avast bug that generated roughly 1.5 million certificate warnings per week. The software created its root certificate using a wrong system clock, so the root appeared expired to Chrome afterward.
References
- Google Research — Where the Wild Warnings Are: Root Causes of Chrome HTTPS Certificate Errors. research.google.com
- RFC 5280 — Internet X.509 Public Key Infrastructure Certificate Profile. rfc-editor.org/rfc/rfc5280
- Chromium Project — Chrome Root Program Policy. chromium.org/root-ca-policy