did the Jun 9 Security Update remove trusted (amazon) certs?

This is a really useful writeup, and it lines up with what a few others have reported around the same timeframe after installing recent Windows cumulative updates. Windows normally relies on the Automatic Root Certificate Update mechanism to pull trusted roots like Amazon Root CA1 through 4 on demand the first time they're needed, but that mechanism depends on outbound connectivity to Windows Update or the Microsoft Trusted Root Program CTL, so if a device is on a locked down network, behind a proxy that blocks that specific traffic, or if the update itself altered the local disallowed or untrusted store, the auto fetch simply won't kick in and the connection fails silently exactly 1like you're describing. The fact that manually importing AmazonRootCA1.pem immediately fixed the connection strongly points to either the update pruning stale or duplicate root entries as part of its cleanup routine, or a change in how Windows handles intermediate chaining for Starfield-issued certs since Amazon's chain still partially relies on that legacy trust path. For anyone hitting this at scale, the safer short-term fix is scripting a bulk import of the current AWS IoT root CA bundle via certutil or Group Policy rather than relying on Windows to auto-heal the store, especially for devices doing MQTT over 8883 since that path doesn't trigger the same automatic root discovery that regular HTTPS traffic does. Would also be worth checking Windows Update history on the affected machines to pin down the exact KB so others troubleshooting the same symptom can cross-reference it.