Index: trunk/src/org/openstreetmap/josm/tools/PlatformHookWindows.java
===================================================================
--- trunk/src/org/openstreetmap/josm/tools/PlatformHookWindows.java	(revision 14430)
+++ trunk/src/org/openstreetmap/josm/tools/PlatformHookWindows.java	(revision 14431)
@@ -94,4 +94,9 @@
  */
 public class PlatformHookWindows implements PlatformHook {
+
+    /**
+     * Pattern of Microsoft .NET and Powershell version numbers in registry.
+     */
+    private static final Pattern MS_VERSION_PATTERN = Pattern.compile("(\\d+)\\.(\\d+)(\\.\\d+.*)?");
 
     /**
@@ -468,13 +473,18 @@
     public X509Certificate getX509Certificate(NativeCertAmend certAmend)
             throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException {
-        // Make a web request to target site to force Windows to update if needed its trust root store from its certificate trust list
-        // A better, but a lot more complex method might be to get certificate list from Windows Registry with PowerShell
-        // using (Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate').EncodedCtl)
-        // then decode it using CertUtil -dump or calling CertCreateCTLContext API using JNI, and finally find and decode the certificate
-        Logging.trace(webRequest(certAmend.getWebSite()));
         // Get Windows Trust Root Store
         KeyStore ks = getRootKeystore();
         // Search by alias (fast)
         Certificate result = ks.getCertificate(certAmend.getWinAlias());
+        if (result == null) {
+            // Make a web request to target site to force Windows to update if needed its trust root store from its certificate trust list
+            // A better, but a lot more complex method might be to get certificate list from Windows Registry with PowerShell
+            // using (Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate').EncodedCtl)
+            // then decode it using CertUtil -dump or calling CertCreateCTLContext API using JNI, and finally find and decode the certificate
+            Logging.trace(webRequest(certAmend.getWebSite()));
+            // Reload Windows Trust Root Store and search again by alias (fast)
+            ks = getRootKeystore();
+            result = ks.getCertificate(certAmend.getWinAlias());
+        }
         if (result instanceof X509Certificate) {
             return (X509Certificate) result;
@@ -730,5 +740,5 @@
             String version = WinRegistry.readString(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full", "Version");
             if (version != null) {
-                Matcher m = Pattern.compile("(\\d+)\\.(\\d+)(\\.\\d+.*)?").matcher(version);
+                Matcher m = MS_VERSION_PATTERN.matcher(version);
                 if (m.matches()) {
                     int maj = Integer.parseInt(m.group(1));
@@ -750,14 +760,16 @@
     public static int getPowerShellVersion() {
         try {
-            return Integer.parseInt(Utils.execOutput(Arrays.asList(
-                    "powershell", "-Command", "$PSVersionTable.PSVersion.Major"), 2, TimeUnit.SECONDS));
-        } catch (ExecutionException e) {
-            // PowerShell 2.0 (included in Windows 7) does not even support this
-            Logging.debug(e);
-            return -1;
-        } catch (NumberFormatException | IOException | InterruptedException e) {
+            String version = WinRegistry.readString(
+                    HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Powershell\\3\\PowershellEngine", "PowershellVersion");
+            if (version != null) {
+                Matcher m = MS_VERSION_PATTERN.matcher(version);
+                if (m.matches()) {
+                    return Integer.parseInt(m.group(1));
+                }
+            }
+        } catch (NumberFormatException | IllegalAccessException | InvocationTargetException e) {
             Logging.error(e);
-            return -1;
-        }
+        }
+        return -1;
     }