Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to get windows to trust a certificate, without getting it to trust the root CA as a trusted root CA?

say I have the following certificate chain,


I want to trust the Server-Certificate, but do not want to trust Dept-Root-CA because then it could sign any certificate and my servers would trust it. Just because I am willing to trust the certificate on Server-Certificate for a specific operation, doesn't mean I'm willing to trust that Dept-Root-CA has been properly secured.


share|improve this question
What exactly are you wanting to trust it for? HTTPS? Or some other thing? There are ways of indicating that you want to accept a single certificate without accepting anything else from the root CA, but it depends on what you're doing. (You will still get errors if you try to validate the cert though) – Mark Henderson Mar 21 '13 at 23:42
Essentially yes. If it was custom code then it wouldn't be an issue - but this is using ADFS 2 and the only thing I can do in regards to how it treats certificates is change how the server trusts that certificate. There are other cases as well but this is just the current example. – bkr Mar 22 '13 at 0:03
up vote 2 down vote accepted

No. As long as the certificate says "Issued by: xxx" then you must also trust xxx, all the way up the chain. If it is a self-signed certificate, you could put it in the Trusted Root CAs store, and since it is issued to and issued by the same entity, it should be trusted then.

But no it's not generally do-able or advisible to completely circumvent the entire purpose of certificate-based security.

share|improve this answer
I was afraid of that. I would not call it circumventing though. Just because I want a secure channel to talk to a machine in a different organizational group doesn't mean that I want to trust their CA. – bkr Mar 21 '13 at 22:57
Right... but the CA signed that cert, and without that CA cert the other end can just keep changing their certificate. – SpacemanSpiff Mar 21 '13 at 23:10
I'm not sure I understand what you're saying. I want to explicitly trust their certificate. If it was changed, I would want to have to explicitly trust it again. I basically want the model of certificate trust like there is in Firefox. In Firefox, if the cert is not valid under existing trusted CAs, you can choose to trust it anyway - if it changes, you will have to choose to trust the new certificate because it hasn't been explicitly trusted. – bkr Mar 21 '13 at 23:32
just keep changing their certificate If the remote end changed their cert, then it wouldn't match the one you saved. If you ignore all the CA business, aren't you just treating it like a SSH host keys. – Zoredache Mar 21 '13 at 23:44
realistically they'll only change it once every 2 years. the MS product I'm using requires the connection be secured via https. so it has to be trusted. because it's signed with their CA I would have to trust their CA - I don't want to do that because that would allow them to spoof any cert to my server, as opposed to allowing them limited interaction with a specific host name. – bkr Mar 22 '13 at 0:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.