Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to understand how XP versus Server handles updating CA root certificates? For example the godaddy/thawte/entrust etc.

Is it always a manual process? Does it depend on your OS version? Is there a way to get automatic updates?

Thanks in advance for any guidance

share|improve this question
up vote 0 down vote accepted

CA certificates aren't really updated all that often. For Windows and Internet Explorer they generally come in as part of Windows update.

If you are running your own Certificate Authority or if you want to trust a certificate authority not blessed (eg by Microsoft you usually would do this by setting up a group policy to distribute the CA certificate.

As far as I am aware there isn't really a good way to distribute CA certificates in a way that will be useful for alternate browsers like Firefox. For alternate browsers you usually get updates when you update the browser.

share|improve this answer
It's strange that all of our patched servers had a root cert for Go Daddy Secure Certification Authority except for one. We had to manually add it. – eileen Nov 1 '09 at 1:14

Root certs come in via Windows Update, so however your machine is configured to receive updates is how you'll get them. That could be directly from Windows Update, via WSUS or other (custom) update service.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.