Fixing Windows installs that don't receive updates to their trusted roots

Both the self signed and cross signed appear to be installed on my machine, but theCertificate Import Wizard appears unable to find them.

Active
ISRG Root X1 (RSA 4096, O = Internet Security Research Group, CN = ISRG Root X1)
Self-signed: der, pem, txt

I click on the der, and get a dialog box saying "already installed"