1

I am trying to create a Windows server with an IIS server that has a web site with client certificate authentication. The client certificates are signed by our own root CA. Because of that we must import that CA into the Trusted Root Authorities at the server. I can successfully import the cert and sometimes the first request to the server succeeds. Unfortunately Windows deletes the CA certs quite quickly and after that the request to the server start failing with 403 errors. I've found the following in the Event Viewer:

Successful auto delete of third-party root certificate:: Subject: Sha1 thumbprint: <"The thumbprint of our cert">.

How do I make Windows stop doing this? The server is running on Amazon EC2 and we want to avoid using a custom AMI. I therefore need to be able to disable this using a script (preferably PowerShell).

  • Did you search for this error message at all? A quick search reveals a number of different solutions. Which ones have you tried already? – devicenull Jul 28 '13 at 1:20
  • Yes, I searched for it. However, I only found solutions where you changed the setting using some Windows UI. As you can see from my question, I must be able to script it. Did you find any solution involving a script? – Yrlec Jul 28 '13 at 16:36
2

You should be able to set the relevant group policy setting (Turn off Automatic Root Certificate Updates) via scripting by using the LOCALGPO command found here or by setting the registry value directly:

Key:   HKLM\Software\Policies\Microsoft\SystemCertificates\AuthRoot\
Name:  DisableRootAutoUpdate
Value: 1 
Type:  REG_DWORD
  • This solution disables Windows automatic Root Certificates updates completely. That sounds like a bad idea to me. Is there a way to tell Windows to leave a particular root CA alone, rather than disabling the feature altogether? – richb Feb 24 '14 at 4:26
  • @richb, typically you would not need to do this sort of mod. Third-party certs are specifically separated so they can be maintained automatically. If you are adding your own CA, use "Trusted Root Certificate Authorities" and it will not get removed by updates. – Mitch Feb 24 '14 at 4:39
  • Mitch: Thanks for the reply. I am installing my CA in "Trusted Root Certificate Authorities". It works for a few days, then Windows deletes it. – richb Feb 24 '14 at 5:08
  • @richb, is your certificate valid? is it expired? do you have all intermediate certs installed? It shouldn't be deleted from trusted roots without reason. – Mitch Feb 24 '14 at 5:20
  • 1
    Yes it is valid. The problem is Windows deletes it from Trusted Root Certificate Authorities every few days. I thought that was the point of the original question: "Preventing Windows from deleting our root CA". I can set DisableRootAutoUpdate but I don't want to. I want to mark just one root CA (which I created with makecert) as valid permanently, without setting DisableRootAutoUpdate. – richb Feb 24 '14 at 5:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.