3

This week it was noticed that Microsoft apparently very quietly pushed out 17 new trusted root certificates (Infoworld Article). The lack of public announcement seems a bit strange.

Is anyone aware of a press release by Microsoft or some other publication that might make this event seem less sinister? Furthermore, should I be concerned that my trust stores are being updated without notifying or querying me?

  • 2
    Why is it strange or sinister? They are rolling out a major release in a month, and the certs are probably related to that. Also, all the certs in the trusted root store were added without notifying you. – ztk Jul 1 '15 at 20:04
  • Thanks give me that with a reference or two and I will happily accept it. – zedman9991 Jul 1 '15 at 20:17
3

No, new root certificates are added on a regular basis. Microsoft have a Trusted Root Certificate programme enabling CAs to enroll.

This happens with most products that handle certificate verification. For example, this is Mozilla's list where you can see that there are several added per year.

For Microsoft's list you can simply check your Windows OS's certificate store for root certs.

1

Well the issue here is that Microsoft should have updated their Root Certificate Program member list PDF document and notified their corporate and government customers at the very least, which they haven't.

Also, SilverlightFox is wrong: you cannot "simply check your Windows OS's certificate store for root certs.", as this only provides a list of currently cached root certs, which is usually very different from the full list of root certs that Windows will trust (349 as of today, whatever certmgr.msc shows).

  • How do you mean it only stores cached root certs? Cached from where? – SilverlightFox Jul 3 '15 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.