Hello @David Dai ,
Do you see the certs in the "Trusted Root Certificate Authorities"?
1) Run MMC on the SHIR machine. Click File, then click Add/Remove Snap-in.
2) Add Certificates, and choose “Computer account” to view all certificates on this computer.
3) Please check the certificates listed under Trusted Root Certification Authorities
]2