I'm trying to understand how XP versus Server handles updating CA root certificates? For example the godaddy/thawte/entrust etc.

Is it always a manual process? Does it depend on your OS version? Is there a way to get automatic updates?

Thanks in advance for any guidance


CA certificates aren't really updated all that often. For Windows and Internet Explorer they generally come in as part of Windows update.

If you are running your own Certificate Authority or if you want to trust a certificate authority not blessed (eg cacert.org) by Microsoft you usually would do this by setting up a group policy to distribute the CA certificate.

As far as I am aware there isn't really a good way to distribute CA certificates in a way that will be useful for alternate browsers like Firefox. For alternate browsers you usually get updates when you update the browser.

  • It's strange that all of our patched servers had a root cert for Go Daddy Secure Certification Authority except for one. We had to manually add it. – eileen Nov 1 '09 at 1:14

Root certs come in via Windows Update, so however your machine is configured to receive updates is how you'll get them. That could be directly from Windows Update, via WSUS or other (custom) update service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy