Intermittent SSL Certificate Errors in AVD Sessions – Affects Both Chrome and Microsoft Edge (NET::ERR_CERT_AUTHORITY_INVALID)

Description of Issue:

We are encountering intermittent SSL certificate errors across our Azure Virtual Desktop (AVD) environment. Users randomly receive the following error in both Google Chrome and Microsoft Edge when attempting to access legitimate HTTPS websites such as Xero and Companies House:

“Your connection is not private”

NET::ERR_CERT_AUTHORITY_INVALID

This issue is not consistent – the same websites that load correctly one day may fail the next, without any change to system settings, policies, or connectivity. The error appears across different browsers and different AVD user sessions.

• The issue occurs in both Chrome and Microsoft Edge, confirming it’s not browser-specific.

Environment Details:

Troubleshooting Already Performed:

1. Time Sync Configuration
   • We reconfigured the AVD session host to use time.windows.com as the authoritative NTP source: w32tm /config /manualpeerlist:"time.windows.com" /syncfromflags:manual /reliable:YES /update w32tm /resync /force
   Verified with w32tm /query /status showing successful sync.
2. Time Zone Redirection
   • Set session host timezone to GMT Standard Time.
   • Enabled Time Zone Redirection via registry:
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Name "fEnableTimeZoneRedirection" -Value 1
3. Connectivity Tests
   • Verified Test-NetConnection to affected sites resolves correctly with no packet loss or TCP issues.
   • DNS resolution is consistent.
4. Chrome Cache Clearance
   • Temporary resolution achieved by executing the following PowerShell to clear Chrome’s cache:
   Stop-Process -Name chrome -Force -ErrorAction SilentlyContinue Remove-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Cache" -Recurse -Force -ErrorAction SilentlyContinue
5. Root Store:
   • Certificate authorities are present in Trusted Root.
   • No proxy or SSL interception in the environment.

Symptoms:

• Browser displays NET::ERR_CERT_AUTHORITY_INVALID
• Inconsistent appearance (sometimes resolves on its own)
• Affects both Chrome and Edge
• Only within AVD sessions (not on users’ local physical machines)
• Disrupts access to critical platforms like Xero and government sites

Important: We’ve ruled out the website itself as the root cause — these domains are valid, publicly trusted sites with properly configured SSL certificates. Other devices on non-AVD networks load the same sites without issue.

Could we please kindly request support on this issue.