If no-one else will say it, I will. Microsoft screwed up years ago and published an update to the trusted root CAs that broken any machine lucky enough to get said update prior to Microsoft pulling the update. To this day, I still deal with this problem.
Because I understand the security implications, I am not providing direct links to these issues. Instead, this is what one searches for in Google to find the related information:
Update KB3004394 breaks Root Certificate in Windows 7/ Windows Server 2008 R2
Microsoft releases 'Silver Bullet' patch KB 3024777 to eliminate KB 3004394
And the one I experienced and to this day causes countless issues:
SSL/TLS communication problems after you install KB 931125
This package installed more than 330 Third-party Root Certication
Authorities. Currently, the maximum size of the trusted certificate
authorities list that the Schannel security package supports is 16
kilobytes (KB). Having a large amount of Third-party Root Certication
Authorities will go over the 16k limit, and you will experience
TLS/SSL communication problems.
Another reason is because Microsoft has distrusted a number of root CAs over the years. Lazy admins will simply disable this feature for their Intranet servers and never resolve the root problem -- re-signing everything no longer trusted.
Anyway, simple answer is to use a different code signing certificate.