How to Configure Windows Sandbox Certificate Store Injection via XML in Windows 11

Testing enterprise software, internal HTTPS microservices, or SSL-inspecting web proxies inside Windows Sandbox often fails immediately with certificate validation errors (such as SEC_ERROR_UNKNOWN_ISSUER or NET::ERR_CERT_AUTHORITY_INVALID). Because Windows Sandbox boots from a pristine, generic Windows 11 image on every launch, it lacks internal corporate Root Certificate Authorities (CAs), private enterprise PKI certificates, and intermediate signing trust chains. Using Windows Sandbox configuration (.wsb) XML profiles and automated PowerShell logon scripts, security engineers can inject custom certificate stores upon launch.

Understanding the Windows Certificate Store Hierarchy

The Windows 11 security subsystem organises cryptographic certificates into distinct logical stores:

• Cert:LocalMachineRoot: The Trusted Root Certification Authorities store. Certificates placed here establish root trust anchors across all users and system services (including Microsoft Edge, Chrome, and curl).
• Cert:LocalMachineCA: The Intermediate Certification Authorities store. Holds intermediate issuer certificates required to build complete trust chains.
• Cert:CurrentUserMy: The Personal certificate store. Contains client certificates and private keys utilized for mTLS (mutual TLS) enterprise authentication.

Preparing Certificate Assets on the Host

Create a dedicated directory on your Windows 11 host at C:SandboxCertificates containing:

• CorporateRootCA.cer: Your organization’s root CA certificate (Base-64 or DER encoded).
• InternalIntermediateCA.cer: Intermediate signing certificates.
• Install-Certs.ps1: The automation bootstrap script.

Authoring the Windows Sandbox WSB Profile

Save the following configuration as Enterprise_PKI_Sandbox.wsb on your Windows 11 host machine:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MemoryInMB>6144</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxCertificates</HostFolder>
      <SandboxFolder>C:CertsDeploy</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:CertsDeployInstall-Certs.ps1</Command>
  </LogonCommand>
</Configuration>

Authoring the PowerShell Certificate Injection Script

Save Install-Certs.ps1 in C:SandboxCertificates on your host:

Write-Host "Initialising Windows Sandbox Enterprise Certificate Store..." -ForegroundColor Cyan

$CertDir = "C:CertsDeploy"
$RootCertPath = Join-Path $CertDir "CorporateRootCA.cer"
$IntermediateCertPath = Join-Path $CertDir "InternalIntermediateCA.cer"

# 1. Import Trusted Root CA Certificate
if (Test-Path $RootCertPath) {
    Write-Host "Importing Root CA certificate into LocalMachineRoot..." -ForegroundColor Green
    Import-Certificate -FilePath $RootCertPath -CertStoreLocation "Cert:LocalMachineRoot" | Out-Null
    Write-Host "Root CA imported successfully." -ForegroundColor Green
} else {
    Write-Warning "Root CA certificate not found at $RootCertPath"
}

# 2. Import Intermediate CA Certificate
if (Test-Path $IntermediateCertPath) {
    Write-Host "Importing Intermediate CA into LocalMachineCA..." -ForegroundColor Green
    Import-Certificate -FilePath $IntermediateCertPath -CertStoreLocation "Cert:LocalMachineCA" | Out-Null
    Write-Host "Intermediate CA imported successfully." -ForegroundColor Green
}

# 3. Verify Certificate Chain in Local Store
Write-Host "Installed Trusted Root Certificates:" -ForegroundColor Cyan
Get-ChildItem -Path "Cert:LocalMachineRoot" | Where-Object { $_.Subject -like "*Corporate*" } | Format-Table Subject, Thumbprint, NotAfter

# 4. Test TLS handshake with curl
Write-Host "Testing internal HTTPS connectivity with curl:" -ForegroundColor Yellow
curl.exe -I https://internal-portal.corp.local | Select-String "HTTP/" | Write-Host

Running and Verifying the Custom Trust Anchor

1. Double-click Enterprise_PKI_Sandbox.wsb on your Windows 11 host.
2. Windows Sandbox spins up in an isolated session in seconds.
3. Upon logon, the PowerShell window automatically imports the root and intermediate certificates into Cert:LocalMachineRoot without requiring user confirmation.
4. Launch Microsoft Edge inside the sandbox and navigate to your enterprise intranet or internal API. Notice the lock icon displays as valid and trusted without any security warnings.
5. Closing Windows Sandbox completely purges the injected certificates and keys, ensuring zero residual artifacts persist.