All: Beware!
Changing the CryptSvc logon to Local system account will break future software updates, including Windows updates. Changing it to Local system does solve the CryptSvc blockage when opening sites, but the downside is pretty severe.
A better fix is to disable user added Certificate Authorities, which are seldom used (if you're not a developer or digging around in web certificates) with this .reg file CA HKLM_Pol_PR-DisableCA.reg (This may appear as a .mp3 file. Download and inspect with Notepad. It really is a .reg registry file.)
The real cleanup is to delete (rebuilds automatically, cleanly) the registry data at:
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root
as described earlier in this thread.
For background see Chrome Bug 838707#212 and #213
Or this Chrome Help Community thread.
To undo the CryptSvc Logon damage, restore the logon to Network Service