What do the Disabled and NotBefore properties do for root certificates on Windows 10?

Question

On this Microsoft page, they mention that a new feature in Windows 10 is that it can stop trusting root certificates using the Disabled and NotBefore properties. What is the exact meaning of these properties, and how does disabling a root differ from removing it?

I could not find a Microsoft page explaining (or even mentioning) these new features in any detail.

For instance: what exactly does Windows 10 do if a root gets automatically "disabled" via an update? Does it move the certificate to "Untrusted Certificates" container?

Answer 1

These properties are well documemted on this MSDN website.

Not Before

Certificate not valid before this date.

Disabled

Certificate can be re-enabled, rather than reinstalled.

I assume you are a developer who wants to implement current updates, so here comes example for Visual Studio.

Answer 2

The "Not Before" category has nothing to do with the rest of the issues. They are just certificates not yet in effect. Nothing should or will act on them, updates included.

What does Windows 10 do if a root certificate gets automatically "disabled" via an update is like asking what does Windows 10 do if an update breaks the booting process.

The answer is nothing (else). This is an exceptional situation of bad updates and should not normally occur. But given the very bad reputation of the current update system, anything is possible.

What a windows update can and will do is disable SHA-1 for SSL/TLS Certificates in Microsoft Edge and Internet Explorer 11. That in turn will cause the certificates not to function; in such a scenario, the certificate will be disabled, but the update will most likely prevent you from re-enabling it, unless you alter back the updated related security settings.

Disabled does not mean removing it from any installed/trusted location.