StoreFront management console fails to open when upgrading StoreFront 3.12. (7.15 LTSR) to StoreFront 3.12.x (7.15 LTSR CUx), or after a clean installation of StoreFront 3.12.X (7.15 LTSR).
In these situations, attempting to start the StoreFront management console displays the following errors:

In the StoreFront Console:

"MMC could not create the snap-in. The snap-in might not have been installed correctly.

Name: Citrix StoreFront
CLSID: Fx:{cddcebf0-2d45-44de-8b7d-a4f0940d46a7"

In the Windows Event Viewer:

Or

In the StoreFront Console Panel:
The management console is unavailable because the root certificate is missing
Go to VeriSign and download the certificate "VeriSign Class 3 Primary CA - G5"

Use one of the methods described here according to your organization's security policy, and whether the system has access to the Internet.

Method 1

If your organization permits automatic root certificate updates, and the system has access to the Internet, 

1. Check the Group Policy Administrative Templates setting "Turn off Automatic Root certificate update". The setting is located in:
   "Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication Settings\Turn off Automation Root certificate update"

2. If this setting is Enabled (that is, automatic root certificate update is turned off), delete this setting.

3. Close and re-open StoreFront management console.

Note: if this setting is being applied via domain Group Policy, consult your domain administrator.

Method 2

If your organization does not permit automatic root certificate updates, or the system does not have access to the Internet, download and install the following Root Certificates:

• DigiCert Assured ID Root CA, available at https://www.digicert.com/digicert-root-certificates.htm
• GlobalSign Root CA, available at https://support.globalsign.com/customer/en/portal/articles/1426602-globalsign-root-certificates
•  VeriSign Class 3 Public Primary Certification Authority - G5, available at https://knowledge.digicert.com/solution/SO5624.html

Problem Cause

The PowerShell code is now signed with a different certificate. There are two new root certificates involved, one for the signature, and one for the countersignature (for timestamping).

In some environments, these root certificates are not installed automatically. This prevents the StoreFront management console from opening because the PowerShell code signature cannot be verified.

Applicable Versions: StoreFront 3.12.1000.
Tested on 3.12.4000 by deepanshus