Addendum - How Roots Get Trusted
While I mentioned roots being manually trusted, most of the time your trusted root certificates are going to be distributed to your machine by non-manual mechanisms, often bundled into every version of the software and/or distributed with automatic updates. Here's a list of common methods and policies for major website-interfacing certificate-using software:
Microsoft Trusted Root Certificate Program Updates
You can get the latest certificate package here.
Active Directory Domain-based distribution (note the linked article also covers the method to manually add a trusted root to a local windows computer.)
The above methods both update the Windows OS certificate store which is used by multiple applications including IE and Edge.
- Mozilla Root Store Policy
- Root Certificate Policy - The Chromium Projects (incl. google chrome)
Both Mozilla and Chrome are capable of trusting certificates independently from the OS (effectively maintaining their own trusted root stores), and also subscribing to the OS trusted root store, depending on settings configured in the application and the specific OS.
Applications that run their own trusted root program will include the trusted roots with any installation of the software. This will be updated when the software is repackaged (e.g. version update), and will also often be provided via automatic updates. Trusted CA's will be added and removed based on the auspices of their trusted root program.