Loading TLS Certificate Roots (CAs) in Windows 10

Due to some snafu, a fresh install of Windows only had a couple of root certificates, making the internet largely unusable. This is typically corrected by a Windows service, but for some reason, today it was not. The solution: Open a command prompt as Administrator. Download all current trusted roots:

certutil –generateSSTFromWU roots.sst

Install them:

certutil -addstore -f root roots.sst

Note: you may view installed certificates with certlm. Check "Trusted Root Certification Authorities" and "Intermediate Certification Authorities".