There are several well known methods of downloading certificate lists from Microsoft, including certutil -generateSSTfromWU c:\my_cert\

Doing that (or just downloading authrootstl.cab) gives me a collection of more than 400 root certificates.

Now, I know that none of my connected servers have that many certificates loaded: and I just looked at a Win10 workstation and it has ~90 trusted root certificates and around 70 third-party root certificates.

Why is it so? How many trusted root certificates does Windows start with, and why is there this much larger list?

  • Windows includes the most common root CA's. There's no linkage with what ships with Windows, and the authorities that have qualified and are registered with the Trusted Root CA program.
    – Greg Askew
    Feb 4, 2022 at 3:41
  • in total, there is around 400 trusted roots in Windows Root Program. Someone just unloaded the full CTL into certificate store.
    – Crypt32
    Feb 4, 2022 at 7:45


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.