9

Windows Certificate MMC snapin shows that there're two "root" certificate stores on Windows:

  • Trusted Root Certification Authorities
  • Third-Party Root Certification Authorities

I'm trying to setup mutual SSL for an application running in IIS and it looks like the client self-signed certificate must be added into either of the listed stores or otherwise IIS refuses to even pass the request to application code.

So to me they look identical. Both contain some certificates of well-known certificate authorities (such as VeriSign).

What's the difference between the two? Suppose I decide to import the self-signed client certificate into either of them - which do I prefer and why?

Improve this question

1 Answer 1

Reset to default
7

The Third-Party Root Certification Authorities is a subset of Trusted Root Certification Authorities.

The Trusted Root are all the Microsoft certificates and the certificates for your organization plus the certificates in the Third-party Root.

The Third-party Root has all certificates that are not from either Microsoft or your organization.

For more information please check this website.

Improve this answer
5
  • Would it be fair to say that no matter which of them I add the client certificate into it is equally fully trusted?
    – sharptooth
    Oct 19, 2016 at 14:44
  • Indeed, certificates added to Third-party or Trusted Root will both result in a certificate that is trusted.
    – BadSkillz
    Oct 19, 2016 at 14:57
  • Could you please include that into the answer?
    – sharptooth
    Oct 19, 2016 at 15:13
  • Isn't Third-party Root Certification Authorities store intermediate certificates? I don't know if my information is correct but once I heard that a user can't add its self-signed certificate in Trusted Root Certification Authorities to prevent malicious user to add its own self-signed certificate make it appear as trusted. By adding user signed certificates into Third-party Root Certification Authorities it becomes easier to distinguish which certificates are not pre-installed by first-party. Is it partially correct?
    – defalt
    Oct 20, 2016 at 6:02
  • @user334283 I spent the previous week successfully adding various self-signed certificates into all possible stores on a test machine. It might require elevated privileges but it certainly isn't impossible.
    – sharptooth
    Oct 20, 2016 at 7:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .