"PowerShell-PKI" project looks promising
Bryan Lockwood has put a a nice project on GitHub:
And here's his blog post that introduced it
You can run the script like so:
Work around a bug: Manually remove the trailing space characters in
(Otherwise the script will report EVERYTHING as untrusted.)
(I suggest you use your favorite text editor's search-and-replace-feature and just nuke all spaces.)
Dot-source the script:
PS C:\Powershell-PKI-master> . .\Audit-TrustedRootCA.ps1 3>&1 | out-null
Run the function:
PS C:\Powershell-PKI-master> Audit-Roots -FilePath .\Nov2015-WindowsRootCAList.NOSPACES.txt -OutputPath .\
The script the Windows trust store (stores?) against a list of known-good hashes.
Hashes-list is same as from certutil.
The origin of this hash-list is not entirely clear to me.
So I decided to generate the hashes myself with a bit of Cygwin-Bash-Scripting:
$ certutil.exe -generateSSTFromWU wuroots.sst
$ certutil.exe -dumpPFX wuroots.sst | grep 'Hash' | tr -d ' ' | tr 'a-z' 'A-Z' | cut -d ':' -f2 | sed 's/$/ /' | sort > wuroots-hashes-pspkiformat.txt
And it turns out: the hashes from
certutil and hashes from GitHub are in fact identical:
$ diff --report-identical-files -- wuroots-hashes-pspkiformat.txt Nov2015-WindowsRootCAList.txt
Files wuroots-hashes-pspkiformat.txt and Nov2015-WindowsRootCAList.txt are identical
Related Twitter Thread
This Twitter thread started by German security researcher Hanno Böck led me to the PowerShell project.
Maybe CertUtil and MMC to reset?
There was a great blog article last month:
Mike outlines a procedure to generate an
.sst certificate container with just the default certificates retrieved from Windows Update and then uses MMC to pick and choose from them.
certutil -generateSSTFromWU rootcas.sst
I haven't tried this, but I'm guessing that throwing out every CA and then simple importing all the default CAs from the SST file should do part of the trick.
Note: I don't know how Windows handles self-signed-CAs in the "Intermediate" store or elsewhere. I think that store is a cache anyway and can be nuked because it will be automatically rebuilt anyway -- but I'm not certain.
EDIT. I just noticed that Tom Leek gave essentially the same answer to a similar question last year: