Like I said, it's exactly the set of conditions that happens to satisfy Outlook. The typical scenario is that you can't connect to a secure server because of an invalid certificate and then forcibly import the certificate. The invalid certificates I tried on Windows where added to the root store.
But you don't check whether those conditions are true, and you march ahead and install the certificate into the root store whether or not they are true. I'm sorry, but the code is just not correct. Please write some test cases. --Juan