LabVIEW HTTPS Client and Windows Certificate Store — Does the Client Reload Trust Anchors Mid-Session?

Answer

LabVIEW’s built‑in HTTPS client does not require a process restart to pick up a new root CA added to the Windows certificate store. It relies on WinHTTP, which queries the Windows trust store for each new TLS handshake. Therefore, as long as a new handshake occurs (i.e., a new request that is not re‑using an existing Keep‑Alive connection), the freshly added CA is recognized immediately.

Confirmed facts

• LabVIEW delegates TLS validation to WinHTTP on Windows.
• WinHTTP performs a fresh lookup of the system certificate store for every new TLS handshake.
• If an existing HTTPS connection is kept alive, the trust store is not re‑checked until that connection is closed and a new handshake is initiated.
• When the Certificate Store property is set to a custom CA file/list, LabVIEW loads that file into memory at the time the property is applied or at the first request that uses it; changes to the file are not automatically detected.

Likely explanation

The observed behavior stems from WinHTTP’s design: it does not cache the trust store across handshakes. Only connection‑level caching (Keep‑Alive) can delay recognition of a newly added CA.

Steps to verify in your environment

1. Run the LabVIEW VI that makes HTTPS requests.
2. While the VI is running, add the new root CA to the Windows Trusted Root Certification Authorities store (via certmgr.msc or PowerShell).
3. Ensure the next HTTPS request does not reuse an existing Keep‑Alive connection (e.g., disable HTTP keep‑alive or close the session before the request).
4. Observe that the request now succeeds without restarting LabVIEW.
5. To test the custom‑store path, set the Certificate Store property to a CA file, modify that file while the VI runs, and note that the change is not seen until you reset the property or restart the VI.

Missing diagnostic detail

If your application uses persistent HTTP connections (Keep‑Alive) and you cannot disable them, you will need to force a new handshake (e.g., by closing and reopening the session) for the updated trust anchors to take effect. Let me know whether you rely on connection reuse so I can advise on the exact reset method.