Windows Certificate MMC snapin shows that there're two "root" certificate stores on Windows:

  • Trusted Root Certification Authorities
  • Third-Party Root Certification Authorities

I'm trying to setup mutual SSL for an application running in IIS and it looks like the client self-signed certificate must be added into either of the listed stores or otherwise IIS refuses to even pass the request to application code.

So to me they look identical. Both contain some certificates of well-known certificate authorities (such as VeriSign).

What's the difference between the two? Suppose I decide to import the self-signed client certificate into either of them - which do I prefer and why?

The Third-Party Root Certification Authorities is a subset of Trusted Root Certification Authorities.

The Trusted Root are all the Microsoft certificates and the certificates for your organization plus the certificates in the Third-party Root.

The Third-party Root has all certificates that are not from either Microsoft or your organization.

For more information please check this website.

  • Would it be fair to say that no matter which of them I add the client certificate into it is equally fully trusted? – sharptooth Oct 19 '16 at 14:44
  • Indeed, certificates added to Third-party or Trusted Root will both result in a certificate that is trusted. – BadSkillz Oct 19 '16 at 14:57
  • Could you please include that into the answer? – sharptooth Oct 19 '16 at 15:13
  • Isn't Third-party Root Certification Authorities store intermediate certificates? I don't know if my information is correct but once I heard that a user can't add its self-signed certificate in Trusted Root Certification Authorities to prevent malicious user to add its own self-signed certificate make it appear as trusted. By adding user signed certificates into Third-party Root Certification Authorities it becomes easier to distinguish which certificates are not pre-installed by first-party. Is it partially correct? – defalt Oct 20 '16 at 6:02
  • @user334283 I spent the previous week successfully adding various self-signed certificates into all possible stores on a test machine. It might require elevated privileges but it certainly isn't impossible. – sharptooth Oct 20 '16 at 7:44

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.