On this Microsoft page, they mention that a new feature in Windows 10 is that it can stop trusting root certificates using the Disabled and NotBefore properties. What is the exact meaning of these properties, and how does disabling a root differ from removing it?

I could not find a Microsoft page explaining (or even mentioning) these new features in any detail.

For instance: what exactly does Windows 10 do if a root gets automatically "disabled" via an update? Does it move the certificate to "Untrusted Certificates" container?

2 Answers 2


These properties are well documemted on this MSDN website.

Not Before

Certificate not valid before this date.


Certificate can be re-enabled, rather than reinstalled.

I assume you are a developer who wants to implement current updates, so here comes example for Visual Studio.

  • - This page only provides a brief definition of NotBefore, which does not address my question. - To clarify: I am not looking for definitions, but authoritative information on the new way that Windows 10 uses these properties. - For instance: what does Windows 10 do if a root gets "disabled" via an update? Does it move the certificate to "Untrusted Certificates" container?
    – John Blatz
    May 10, 2018 at 11:15
  • @JohnBlatz The answer is no. If the root gets disabled, it can by simply re-enabled. No moving to untrusted certificates will occur. Jul 23, 2018 at 8:26

The "Not Before" category has nothing to do with the rest of the issues. They are just certificates not yet in effect. Nothing should or will act on them, updates included.

What does Windows 10 do if a root certificate gets automatically "disabled" via an update is like asking what does Windows 10 do if an update breaks the booting process.

The answer is nothing (else). This is an exceptional situation of bad updates and should not normally occur. But given the very bad reputation of the current update system, anything is possible.

What a windows update can and will do is disable SHA-1 for SSL/TLS Certificates in Microsoft Edge and Internet Explorer 11. That in turn will cause the certificates not to function; in such a scenario, the certificate will be disabled, but the update will most likely prevent you from re-enabling it, unless you alter back the updated related security settings.

Disabled does not mean removing it from any installed/trusted location.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .