When I run package-refresh-contents after running toggle-debug-on-error I get the following backtrace:
Debugger entered--Lisp error: (gnutls-error #<process elpa.gnu.org> -50)
signal(gnutls-error (#<process elpa.gnu.org> -50))
package--download-one-archive(("gnu" . "https://elpa.gnu.org/packages/") "archive-contents" nil)
package--download-and-read-archives(nil)
package-refresh-contents()
funcall-interactively(package-refresh-contents)
call-interactively(package-refresh-contents record nil)
command-execute(package-refresh-contents record)
execute-extended-command(nil "package-refresh-contents" "package-ref")
funcall-interactively(execute-extended-command nil "package-refresh-contents" "package-ref")
call-interactively(execute-extended-command nil nil)
command-execute(execute-extended-command)
Taking reference from the discussion found here I tried the following steps:
Running M-: (gnutls-available-p) produces:
(ClientHello\ Padding Session\ Ticket Extended\ Master\ Secret Encrypt-then-MAC ClientHello\ Padding ALPN Heartbeat SRTP Signature\ Algorithms SRP Supported\ ECC\ Point\ Formats Negotiated\ Groups ...)
Running shell command gnutls-cli -p 443 elpa.gnu.org from Emacs produces:
'gnutls-cli' is not recognized as an internal or external command, operable program or batch file.
Value of the variable gnutls-trustfiles is:
("/etc/ssl/certs/ca-certificates.crt" "/etc/pki/tls/certs/ca-bundle.crt" "/etc/ssl/ca-bundle.pem" "/usr/ssl/certs/ca-bundle.crt" "/usr/local/share/certs/ca-root-nss.crt" "/etc/ssl/cert.pem")
Added paths of ssl/cert.pem and ssl/certs/ca-bundle.crt in Emacs' installation directory to the gnutls-trustfiles variable. In my case they're c:/Program Files/emacs/ssl/cert.pem and c:/Program Files/emacs/ssl/certs/ca-bundle.crt. Running package-refresh-contents after saving from the variable customization menu and running eval-buffer still produces the same error. Restarting Emacs also produces the same error.
On MS-Windows Emacs is supposed to use the system certificate store through MS-Windows native interfaces. No additional certificates in a separate bundle should be needed. So either your GnuTLS version has a bug of some kind, or your Windows system lacks some updates, or there's a genuine problem with ELPA's certificates.
Emacs version is "GNU Emacs 26.3 (build 1, x86_64-w64-mingw32) of 2019-08-29"
