With the Symantec-Google drama, it would help to know if the Internet Explorer browser has its own root trust store built in to the browser, or uses the automatically updating Windows System root trust.

There are a few root trust certificates that come with Windows no matter what, but the rest rely on Windows Update.

That is, if I disabled Windows update, would IE still be able to update its stored root trust?


1 Answer 1


IE uses the Windows root trust list. It's not compiled into the kernel, per se, but it's installed into the SYSTEM registry hive.

It also does not have any means of updating the stored trust list independently.

Update 2017-07-16: Per http://netsekure.org/2011/04/automatic-ca-root-certificate-updates-on-windows/ , Internet Explorer's reliance on CryptoAPI (which calls into components with privileged access) means that CryptoAPI can and does update roots, on at least some versions of Windows.

(And if you disable Windows Update and have no other patch management procedure, you're going to have a Bad Time.)

  • // , Many organizations have a vetting & test procedure for every Windows update. More modern IT crowds tend to see more frequent updates as a security advantage. But not all. It's these folks who use the same CD image they made in 2006 to run locked down systems whose plight I'm investigating. Jun 20, 2017 at 17:35
  • 1
    It tends to be the people stuck in 2006's mindset who end up with more and worse compromises over time. (They would be more subject to WannaCry, for example.) People who have an image made in 2006 accepted Microsoft's vetting in 2006 for CAs. Some of those CAs have since been deemed unfit for various reasons, others have ceased operation by natural action, but those who use 2006 trust lists are stuck without additional vetted options, and without removal of unfit options.
    – sjcaged
    Jun 20, 2017 at 19:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .