I noticed that some applications installed root certificates on my computer.

  • Is it possible to prevent this?
  • Or is there a firewall or such that notifies me?
  • 2
    what OS? I'm not sure about firewall rules, but I reckon this could be done with a script easily enough.
    – Jay
    Commented Apr 4, 2016 at 7:53
  • 3
    Please see How to Ask and The perfect question.
    – Tobi Nary
    Commented Apr 4, 2016 at 7:54
  • 3
    What applications did install root certificates?
    – techraf
    Commented Apr 4, 2016 at 8:19
  • 1
    Why does it matter? Commented Apr 4, 2016 at 8:35
  • 1
    How about restricting access to the trust store to the admin? It should be that way anyways, so @techraf has a good point: If any application does so, it would've to run with admin priviliges.
    – Tobi Nary
    Commented Apr 4, 2016 at 10:05

2 Answers 2


Windows Environments.


Windows servers that have internet connectivity reach out to CA servers and automatically update Trusted Root Authority certs, CTL, STL and Revoked certificates. This occurs in the background and requires zero input or interaction from the user.

Why control it?

Many government environments like to shut this setting off as it's all about control. For instance when the Dell's eDellRoot CA certificate was first shown to be a vulnerability - Microsoft didn't revoke it right away. It took a few days before it ended up on any Untrusted or Revoked list. So many in the security field feel as though they can react faster by controlling the lists themselves. Many reduce the threat as soon as they find out through various channels as opposed to waiting for Microsoft teams deeming something unsafe.

How to control it?

To turn off Automatic Root Certificates Update via Local Group Policy Editor:

  • Click Start, and then click Run.

  • Type gpedit.msc, and then click OK.

  • If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  • Under computer configuration, Double-click Administrative Templates, double-click System, double-click Internet Communication Management, and then click Internet Communication settings.
  • Double-click Turn off Automatic Root Certificates Update, click Enabled, and then click OK.
  • Close the Local Group Policy Editor.

Note that doing it this way is safer than turning off Automatic Updates. Because you still want other security patches to be applied. (Assuming you have an internet connection.)


If you know the directory where root CAs are installed, then you could adjust the permissions for writing to that directory. If you set that directory to only be readable and not writeable, then you would prevent installation of new certificates.

Also, you could set up an alert system that would notify you when anything in that directory changes. This way, you could allow new CAs to be installed, and you would be able to check up on the changes to verify them.

This can all be done in Linux/Unix/BSD/Mac operating systems.

  • 1
    But in Windows this store is not file system based. Commented Apr 14, 2016 at 8:58
  • The above scheme works for Linux/Unix/BSD/Mac. Commented Apr 14, 2016 at 13:17
  • The question is about Windows.
    – Tobi Nary
    Commented Jun 30, 2016 at 4:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .