Trusting Corporate Windows Certificates in WSL (Ubuntu)

When using Windows Subsystem for Linux (WSL), applications running inside Ubuntu maintain their own certificate trust store and do not automatically trust certificates installed in Windows.

This can cause issues such as:

• VS Code Server failing to install when running code .
• curl certificate validation errors
• wget certificate validation errors
• Package installation failures
• Access issues to internal or corporate websites protected by SSL inspection

This article describes how to identify, export, and trust a corporate certificate from Windows within WSL.

Prerequisites

• Windows 11
• WSL (Ubuntu)
• Local administrator access (recommended)

Option A: From the Windows Certificate Store

1. Press Win + R
2. Run: certmgr.msc
3. Browse to: Trusted Root Certification Authorities
4. Review certificates issued by:
5. • Your organisation
   • Security appliances such as:
   • • Zscaler
     • Fortinet
     • Palo Alto
     • Netskope
     • Cisco Umbrella
     • Symantec
     • CrowdStrike
     • Other corporate security products
5. Locate the certificate that corresponds to your corporate security infrastructure.

Option B: From Microsoft Edge

If you're unsure which certificate is being used:

1. Open a website experiencing certificate issues.
2. Click the padlock icon in the address bar.
3. Select: Connection is secure
4. View the certificate details.
5. Note the root or intermediate certificate issuer.

1. In certmgr.msc, locate the required certificate.
2. Right-click the certificate.
3. Select: All Tasks > Export
4. Choose: No, do not export the private key
5. Select format: Base-64 encoded X.509 (.CER)
6. Save the certificate to: C:\temp
7. • Example: C:\temp\company-root.cer

Open Ubuntu.

Verify the certificate is visible: ls /mnt/c/temp/company-root.cer

Copy it to Ubuntu's local certificate directory:

sudo cp /mnt/c/temp/company-root.cer \
/usr/local/share/ca-certificates/company-root.crt

Note: Ubuntu expects trusted certificates to use the .crt extension.

Run: sudo update-ca-certificates

Expected output:

Updating certificates in /etc/ssl/certs...
1 added, 0 removed
done.