I spend whole day by diagnosing issue with my test services using mutual HTTPS. Services are hosted in IIS 7 on a test server running Windows Server 2008 Enterprise edition.

Suddenly few weeks ago all test services stopped working and any request to these services ended with 403.7 "Client certificate required" issue. After a lot of searching I found this article describing similar issue with Windows Server 2003.

In short the issue is caused by too many trusted root CAs installed in local machine certificate store. Server during mutual HTTPS handshake sends "list" of trusted CAs to client and client can select certificate based on this list (unless the site in IIS is configured with CTL but that is for a different question). The problem is that list can have only 16KB so if there is more CAs, they are simply not send to the client. If the used client certificate is issued by one of such truncated CAs it is not send to the server.

After that I checked local machine's trusted root certificate store and I found that there is more than 200 trusted root CAs installed. What is even worse: we didn't install them! I somewhere found a bit of information (sorry can't find it again) that these CAs are installed automatically through Windows Update.

The question: How to turn off installing CA certificates to our computer without turning off windows update?

  • 2
    I don't feel like providing a full blown answer so I'll just leave you this link: technet.microsoft.com/en-us/library/…. That should cover Vista and beyond. For XP and W2K3 you can uninstall it via Add Remove Programs|Add Remove Windows Components. – joeqwerty Aug 16 '12 at 21:06
  • @joeqwerty: I think this is answer to may question. – Ladislav Mrnka Aug 17 '12 at 14:55

I don't think they were all installed by Windows Update, honestly. There would probably be a lot more people having this problem if they were, right?

They can also be installed by GPOs and domain memberships, which is where I'd look first.

But, before looking, I'd want to allow use of HTTPS... (maybe, unless you suspect or know you have malicious CA trusts in there), which would most easily be done by removing the ones you don't want. Certificate Manager Tool, plus scripted removals in the startup or shutdown script portion of a GPO.

They can also be installed maliciously, and if that's the case, you're badly compromised, and I would recommend/you need to start wiping every single machine with malicious certs as trusted CAs.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.