Index: /trunk/src/org/openstreetmap/josm/gui/MainApplication.java
===================================================================
--- /trunk/src/org/openstreetmap/josm/gui/MainApplication.java	(revision 16119)
+++ /trunk/src/org/openstreetmap/josm/gui/MainApplication.java	(revision 16120)
@@ -650,5 +650,5 @@
                 "\t--debug                                   "+tr("Print debugging messages to console")+"\n\n"+
                 "\t--skip-plugins                            "+tr("Skip loading plugins")+"\n\n"+
-                "\t--offline=<osm_api|josm_website|all>      "+tr("Disable access to the given resource(s), separated by comma")+"\n\n"+
+                "\t--offline=<osm_api|josm_website|certificates|all> "+tr("Disable access to the given resource(s), separated by comma")+"\n\n"+
                 tr("options provided as Java system properties")+":\n"+
                 align("\t-Djosm.dir.name=JOSM") + tr("Change the JOSM directory name") + "\n\n" +
Index: /trunk/src/org/openstreetmap/josm/gui/ProgramArguments.java
===================================================================
--- /trunk/src/org/openstreetmap/josm/gui/ProgramArguments.java	(revision 16119)
+++ /trunk/src/org/openstreetmap/josm/gui/ProgramArguments.java	(revision 16120)
@@ -62,5 +62,5 @@
         /** --selection=&lt;searchstring&gt;           Select with the given search */
         SELECTION(true),
-        /** --offline=&lt;osm_api|josm_website|all&gt; Disable access to the given resource(s), delimited by comma */
+        /** --offline=&lt;osm_api|josm_website|certificates|all&gt; Disable access to the given resource(s), delimited by comma */
         OFFLINE(true),
         /** --skip-plugins */
Index: /trunk/src/org/openstreetmap/josm/io/CertificateAmendment.java
===================================================================
--- /trunk/src/org/openstreetmap/josm/io/CertificateAmendment.java	(revision 16119)
+++ /trunk/src/org/openstreetmap/josm/io/CertificateAmendment.java	(revision 16120)
@@ -151,6 +151,9 @@
      * Certificates looked into platform native keystore and not embedded in JOSM.
      * Identifiers must match Windows/macOS keystore aliases and Unix filenames for efficient search.
-     * To find correct values, see https://ccadb-public.secure.force.com/mozilla/IncludedCACertificateReport
-     * and https://support.apple.com/en-us/HT208127
+     * To find correct values, see:<ul>
+     * <li><a href="https://ccadb-public.secure.force.com/mozilla/IncludedCACertificateReport">Mozilla List</a></li>
+     * <li><a href="https://ccadb-public.secure.force.com/microsoft/IncludedCACertificateReportForMSFT">Microsoft List</a></li>
+     * <li><a href="https://support.apple.com/en-us/HT210770">Apple List</a></li>
+     * </ul>
      */
     private static final NativeCertAmend[] PLATFORM_CERT_AMEND = {
@@ -190,4 +193,9 @@
                 "3c5f81fea5fab82c64bfa2eaecafcde8e077fc8620a7cae537163df36edbf378",
                 "https://e-szigno.hu"),
+        // #18920 - Spanish Government - https://www.sede.fnmt.gob.es/descargas/certificados-raiz-de-la-fnmt
+        new NativeCertAmend(Collections.singleton("AC RAIZ FNMT-RCM"),
+                "AC_RAIZ_FNMT-RCM.pem",
+                "ebc5570c29018c4d67b1aa127baf12f703b4611ebc17b7dab5573894179b93fa",
+                "https://www.sede.fnmt.gob.es"),
     };
 
Index: /trunk/src/org/openstreetmap/josm/tools/PlatformHookWindows.java
===================================================================
--- /trunk/src/org/openstreetmap/josm/tools/PlatformHookWindows.java	(revision 16119)
+++ /trunk/src/org/openstreetmap/josm/tools/PlatformHookWindows.java	(revision 16120)
@@ -53,4 +53,5 @@
 import java.security.NoSuchAlgorithmException;
 import java.security.cert.Certificate;
+import java.security.cert.CertificateEncodingException;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
@@ -340,4 +341,5 @@
     public X509Certificate getX509Certificate(NativeCertAmend certAmend)
             throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException {
+        MessageDigest md = MessageDigest.getInstance("SHA-256");
         // Get Windows Trust Root Store
         KeyStore ks = getRootKeystore();
@@ -345,4 +347,11 @@
         for (String winAlias : certAmend.getNativeAliases()) {
             Certificate result = ks.getCertificate(winAlias);
+            // Check for SHA-256 signature, as sometimes Microsoft can ship several certificates with the same alias, for example:
+            // AC RAIZ FNMT-RCM: EBC5570C29018C4D67B1AA127BAF12F703B4611EBC17B7DAB5573894179B93FA (SHA256)
+            // AC RAIZ FNMT-RCM: 4D9EBB28825C9643AB15D54E5F9614F13CB3E95DE3CF4EAC971301F320F9226E (SHA1)
+            if (!sha256matches(result, certAmend, md)) {
+                Logging.trace("Ignoring {0} as SHA-256 signature does not match", result);
+                result = null;
+            }
             if (result == null && !NetworkManager.isOffline(OnlineResource.CERTIFICATES)) {
                 // Make a web request to target site to force Windows to update if needed its trust root store from its certificate trust list
@@ -360,10 +369,8 @@
         }
         // If not found, search by SHA-256 (slower)
-        MessageDigest md = MessageDigest.getInstance("SHA-256");
         for (Enumeration<String> aliases = ks.aliases(); aliases.hasMoreElements();) {
             String alias = aliases.nextElement();
             Certificate result = ks.getCertificate(alias);
-            if (result instanceof X509Certificate
-                    && certAmend.getSha256().equalsIgnoreCase(Utils.toHexString(md.digest(result.getEncoded())))) {
+            if (sha256matches(result, certAmend, md)) {
                 Logging.warn("Certificate not found for alias ''{0}'' but found for alias ''{1}''", certAmend.getNativeAliases(), alias);
                 return (X509Certificate) result;
@@ -372,4 +379,9 @@
         // Not found
         return null;
+    }
+
+    private static boolean sha256matches(Certificate result, NativeCertAmend certAmend, MessageDigest md) throws CertificateEncodingException {
+        return result instanceof X509Certificate
+                && certAmend.getSha256().equalsIgnoreCase(Utils.toHexString(md.digest(result.getEncoded())));
     }