When accessing https://internetbanking.caixa.gov.br (site of a well known bank in Brazil), the server returns a certificate signed by "Autoridade Certificadora Raiz Brasileira" (Brazilian Root Certification Authority). This certificate is not in Window's list of trusted certificates before the access, but it appears there after the access.
Here's the exact steps (tested in Windows XP and 8 with IExplorer and Google Chrome):
Control Panel -> Internet Options -> Content -> Certificates
- Verify there is no "Autoridade Certificadora Raiz Brasileira" in the list of trusted root or intermediate cerficiates.
- Close the open windows
- Access https://internetbanking.caixa.gov.br
- Verify no warnings, alerts or confirmations appeared (with green padlock nonetheless).
Control Panel -> Internet Options -> Content -> Certificatesagain
- Verify the "Autoridade Certificadora Raiz Brasileira" certificate appeared in the
Trusted Root Certification Authoritiestab.
How did that happen? Is there a mechanism that allows a user application to force the OS to trust new root certificates without alerts or confirmations?