Amazon SSL certificate trust (Windows troubleshooting)

Use this article only if the current Windows app (version 5.x) cannot verify HTTPS to Mobile Locker. You do not need to import Amazon Root CA 1 as part of a normal install. Current Windows 10 and 11 PCs that receive Windows Update already trust that root.

The 5.x app is a signed WPF desktop app. It uses the Windows TLS stack (HttpClient). It does not use Node.js or Electron.

If sign-in works and files download, stop here. This is a troubleshooting guide, not an Intune or MDM prerequisite.

On this page

When you need this

The API, EU API, and content downloads all use certificates that chain to Amazon Root CA 1:

If Windows does not trust that root, sign-in, sync, and presentation downloads fail. Typical causes:

  • Windows Update is blocked or the image is old
  • IT removed roots from the Trusted Root store
  • A proxy or Zscaler inspects HTTPS and presents a CA that Windows does not trust

What you see

In the 5.x app, a TLS failure usually shows:

Could not verify the server certificate. Ask your IT department to trust Amazon Root CA 1.

Some screens still show the generic network message Could not reach the server. Check your connection and try again.

On the PC, a browser or curl to https://app.mobilelocker.com may report that the certificate is not trusted, or that the issuer is unknown.

Older Electron Windows builds showed UNABLE_TO_GET_ISSUER_CERT_LOCALLY. Version 5.x does not show that Node.js text. The fix is the same: Windows must trust Amazon Root CA 1 (or the CA your SSL inspector uses).

Download the certificate

Amazon Root CA 1: https://www.amazontrust.com/repository/AmazonRootCA1.cer

Fix with Windows Update

This is the first thing to try on one PC.

  1. Open Settings > Windows Update (or Update & Security on Windows 10).
  2. Click Check for updates.
  3. Install all available updates, including certificate updates.
  4. Restart the PC if Windows asks you to.
  5. Open Mobile Locker and try to sign in or sync.

Import the certificate

If Windows Update does not fix it:

  1. Download AmazonRootCA1.cer from the link above.
  2. Right-click the file and choose Install Certificate.
  3. Choose Local Machine (this needs administrator rights).
  4. Click Next.
  5. Select Place all certificates in the following store.
  6. Click Browse, select Trusted Root Certification Authorities, then click OK.
  7. Click Next, then Finish.
  8. Close Mobile Locker and open it again. Try to sign in or sync.

Fix for a fleet

For many PCs, push Windows Update through WSUS or Intune. That is the cleanest way to keep CA certificates current.

Group Policy

  1. Download AmazonRootCA1.cer.
  2. Open Group Policy Editor (gpedit.msc).
  3. Go to Computer Configuration > Windows Settings > Security Settings > Public Key Policies.
  4. Right-click Trusted Root Certification Authorities > Import.
  5. Select the certificate and finish the wizard.
  6. Deploy the policy to the PCs that run Mobile Locker.

Certificate Manager

  1. Open Command Prompt as Administrator.
  2. Run certlm.msc (Local Computer certificates, not certmgr.msc).
  3. Go to Trusted Root Certification Authorities > Certificates.
  4. Right-click All Tasks > Import.
  5. Select AmazonRootCA1.cer and finish the wizard.

PowerShell

With a file you already downloaded:

Import-Certificate -FilePath "C:\path\to\AmazonRootCA1.cer" -CertStoreLocation "Cert:\LocalMachine\Root"

Download and import in one step:

Invoke-WebRequest -Uri "https://www.amazontrust.com/repository/AmazonRootCA1.cer" -OutFile "AmazonRootCA1.cer"
Import-Certificate -FilePath "AmazonRootCA1.cer" -CertStoreLocation "Cert:\LocalMachine\Root"

Verify

In PowerShell as Administrator:

certutil -verify "C:\path\to\AmazonRootCA1.cer"

You should see that the certificate verified against the CTL.

Test HTTPS (a 404 or other HTTP status is fine; a certificate error is not):

curl -v https://app.mobilelocker.com/api/status

Then restart Mobile Locker and try to sign in or sync.

If it still fails

  • Allow the API and S3 hosts in the firewall or antivirus. See IT Considerations for the Windows App.
  • If a proxy inspects HTTPS, it must present a certificate that Windows trusts, or it must exclude these hosts. Importing Amazon Root CA 1 does not fix an inspector that uses a different corporate CA.
  • When you contact support@mobilelocker.com, include the curl -v output and the server name (app.mobilelocker.com or eu.mobilelocker.com).

Technical details

Amazon Root CA 1

  • Subject: CN=Amazon Root CA 1, O=Amazon, C=US
  • Issuer: CN=Amazon Root CA 1, O=Amazon, C=US (self-signed)
  • Public key: RSA 2048-bit
  • Valid: May 26, 2015 to January 17, 2038
  • Signature: SHA-256 with RSA
  • Serial number: 06:6c:9f:cf:99:bf:8c:0a:39:e2:f0:78:8a:43:e6:96:36:5b:ca

Server certificate chain

  • Leaf: CN=mobilelocker.com (AWS load balancer) or CN=s3.amazonaws.com (content)
  • Intermediate: Amazon RSA 2048 M01 or M04 (Amazon rotates these)
  • Root: CN=Amazon Root CA 1, O=Amazon, C=US
  • Servers: https://app.mobilelocker.com, https://eu.mobilelocker.com, and the Mobile Locker S3 hosts

The app does not pin a specific certificate. It trusts whatever the Windows root store accepts.

Did this answer your question? Thanks for the feedback There was a problem submitting your feedback. Please try again later.

Still need help? Contact Us Contact Us

Related Articles