I need to implement a service that does not start because the certificate cannot be validated. This certificate have a root ca that was recently created, so my windows 7 machines does not trust in this ca. My machines does not have internet access and can't download from windows update the list of trusted root certificates (CTL)


In this technet article say that this CTL can be downloaded from Microsoft download center but I have searched and I just found a KB of 2013 that contains the CTL.

My question is ¿where I can find the latest version of this list of trusted certificated?

Note: I cant add a certificate manually or via script

  • The Technet article explains several methods you can use to download the certificates. Have you read the complete article? – Michael Hampton Mar 2 '16 at 3:36
  • yes I have readed it and have understand that there are two methods to update via a server os a package created with iexpress that contains the list of valid certificates or a web server. – kimo pryvt Mar 2 '16 at 4:28
  • 1
    what i need is one of those iexpress package that contains the list, that is supposedly in Microsoft downloads – kimo pryvt Mar 2 '16 at 4:29
  • What if you just push the Root CA used to generate the server certificate to the Win7 client? This should be enough to validate the service – Jofre Mar 2 '16 at 8:52
  • by adding the certificate manually works fine but i can't do this because the company that I am working requires that the CTL must be updated by this microsoft update – kimo pryvt Mar 2 '16 at 16:18

I found the instructions at the bottom of this page to be useful.

Specifically, running

    CertUtil –generateSSTFromWU Rootstore.sst 

Gave me a file with all the needed Certs. I then was able to transfer that Rootstore.sst file to another machine, open the file and install the desired certs from it.

When opening the file in Certmgr I'm able to see all the certs, I can then add any that I need (to install Visual Studio 2015 on an offline Windows 7 box, I needed the "Microsoft Root Certificate Authority 2010" and "Microsoft Root Certificate Authority 2011") by double clicking to open them, then clicking the install button. However, when I select "Automatically select the certificate store based on the type of certificate" it didn't put these in the trusted root. Instead I had to manually pick the certificate store and then select "Trusted Root Certification Authorities".

| improve this answer | |
  • 2
    Hi, this is quite good except for the fact once I've the file... How can I import all the certificates? I mean, my .sst file has 369 certificates, I could do it manually, but... Well, you get my point ;-) Thx! – curropar Jun 25 '18 at 14:13

The article at https://netflex.nl/automatische-ca-root-updates-op-windows/ suggests that you download the root certificates with rootsupd.exe, available at http://download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/rootsupd.exe. I'm surprised though that the exe is not signed.
Use at your own risk.

| improve this answer | |
  • 404 error on the EXE – Paul Stelian Sep 30 '18 at 9:23
  • The rootsupd.exe (and the updroots.exe inside of it) are outdated and should not be used. In fact, they break the "Microsoft Root Certificate Authority" root certificate on modern systems (at least Windows 10 1803+). – Koraktor Jan 9 '19 at 12:34

Our team actually just developed a tool to automatically update the root certificates on Windows 10, Server 2012/2016/2019.

It's free.


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.