Error: CLOUD SERVICES ROOT CA TLS INTERCEPT CERTIFICATE WAS NOT FOUND on WSS Agent

Products

Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

On multiple Windows endpoints running the Web Security Service (WSS) Agent or Endpoint Security Agent (ESA), the agent status or logs display a missing or "no certificate" warning condition. The explicit error displayed is:

CLOUD SERVICES ROOT CA TLS INTECEPT CERTIFICATE WAS NOT FOUND

or

Warning: WSS SSL intercept certificate was NOT found

When this warning occurs, SSL interception and traffic filtering fail to function across the affected machines. Manual import of the certificate on affected devices successfully resolves the error and restores normal functionality, confirming that the agent operates correctly once the root certificate is present in the system stores.

Environment

Product: Cloud SWG (formerly Web Security Service - WSS)
Component: WSS Agent / Endpoint Security Agent (ESA)
Operating System: Microsoft Windows

Cause

The WSS Agent injects the required root certificate during the initial installation phase and never dynamically deletes or removes its own certificate during runtime.

This warning triggers when the certificate goes missing specifically from the Windows LocalMachine\Root store. This condition is typically caused by external environmental factors:

Group Policy Object (GPO) Overwrites: Active domain policies configured to purge or overwrite unlisted root certificates during routine background policy refreshes (gpupdate).
Security Blocks: Third-party endpoint security software or restricted local Windows permissions blocking the initial write or retention of the certificate in the local store.

To confirm whether the certificate is missing from the system stores, execute the following PowerShell command to scan for the certificate by its specific thumbprint:

Get-ChildItem -Path Cert:\* -Recurse | Where-Object {$_.Thumbprint -eq "2b4eaf4c71f5f27fbd8f0fb55c73abc39f15147e"}

If the command completes and returns no output, the certificate is missing from the endpoint.

Resolution

To resolve this error, download the certificate and restore it to the Windows Local Machine certificate store.

1. Download the Certificate

Obtain the appropriate Cloud SWG Root Certificate by following the instructions in the official documentation:

Download the Cloud SWG Root Certificate

2. Restore the Certificate to the Local Machine Store

The certificate must reside in the Trusted Root Certification Authorities (LocalMachine\Root) store. Use one of the following deployment methods:

Centrally via GPO (Recommended for multiple devices): Request the Active Directory team to deploy the downloaded certificate via Group Policy. Ensure domain policies are not configured to automatically purge unlisted administrative certificates.
Manually (For testing or individual devices): Open certlm.msc, right-click Trusted Root Certification Authorities, select All Tasks -> Import, and select the downloaded certificate. (Note: Importing the certificate solely into the CurrentUser\Root store is insufficient to clear the warning).

3. Check External Restrictions

If the certificate continues to be removed automatically after a deployment or manual import, contact the internal Windows Administration or Security infrastructure teams to identify which third-party process, endpoint security software, or GPO is deleting the certificate. Detailed configuration of third-party security software and Windows GPOs falls outside the scope of WSSA technical support.