diff --git a/.bazelci/config.yaml b/.bazelci/config.yaml
index bba12dba..e410466b 100644
--- a/.bazelci/config.yaml
+++ b/.bazelci/config.yaml
@@ -157,6 +157,8 @@ tasks:
       - "-//cmake_hello_world_lib/static:libhello_example"
       - "-//cmake_hello_world_lib/static:test_hello"
       - "-//cmake_with_data/..."
+    batch_commands:
+      - powershell -noexit "& "".\..\.bazelci\windows-update-certs.ps1"""
     build_targets: *windows_targets
     test_targets: *windows_targets
     build_flags:
diff --git a/.bazelci/windows-update-certs.ps1 b/.bazelci/windows-update-certs.ps1
new file mode 100644
index 00000000..bf76336a
--- /dev/null
+++ b/.bazelci/windows-update-certs.ps1
@@ -0,0 +1,6 @@
+cd $env:USERPROFILE;
+Invoke-WebRequest https://curl.haxx.se/ca/cacert.pem -OutFile $env:USERPROFILE\cacert.pem;
+$plaintext_pw = 'PASSWORD';
+$secure_pw = ConvertTo-SecureString $plaintext_pw -AsPlainText -Force;
+& openssl.exe pkcs12 -export -nokeys -out certs.pfx -in cacert.pem -passout pass:$plaintext_pw;
+Import-PfxCertificate -Password $secure_pw  -CertStoreLocation Cert:\LocalMachine\Root -FilePath certs.pfx;