2

At the company we never really bothered with the root certificates and were under the impression this is something that's managed along with Windows Updates (and there's WSUS for that) and all was well.

However, today, I've noticed that a fresh Windows Server 2016 install, with all the updates, seems to have only very VERY basic root certificates, to the point where I can't even open Google (on account of not trusting their certificate).

(I haven't checked a fresh Windows 10 installation yet...)

I'm a bit confused by this, as this didn't happen before. Either we've made some poor changes in our GPOs (tho I can't think of anything that would have this effect), or this is something that was recently changed? How should I proceed so that things like Google can be accessed without issues? Do I need to manually add trusted certificates via GPOs now?


Here are some screenshots of what the situation looks like on a fresh server install.

SSL certificate error

General

Path

Cert list

1
  • This is unusual. A fresh install of any recent Windows system, including WS2016, automatically trusts common public CAs; Google (as any other web site using public certs) works just fine. Something is probably wrong with this specific system: this is definitely not standard behaviour. – Massimo Jun 27 '19 at 16:13
4

It is ok and expected behavior. By default, only few required certificates are visible in trusted root store. The rest (there are about 300 roots) are installed on demand, when you face them for the first time. There is a hidden copy of root certificates in Crypt32.dll and on Windows Update. There is nothing to worry about.

update:

I've made internal check and found that requested root is embedded in crypt32.dll file. Here is the PowerShell code you can extract embedded certificates from this dll and find expected root:

$signature = @"
[DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Auto)]
public static extern IntPtr LoadLibraryEx(
    String lpFileName,
    IntPtr hFile,
    UInt32 dwFlags
);
[DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
public static extern IntPtr FindResource(
    IntPtr hModule,
    int lpID,
    string lpType
);
[DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
public static extern uint SizeofResource(
    IntPtr hModule,
    IntPtr hResInfo
);
[DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
public static extern IntPtr LoadResource(
    IntPtr hModule,
    IntPtr hResInfo
);
[DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Auto)]
public static extern bool FreeLibrary(
    IntPtr hModule
);
"@
Add-Type -MemberDefinition $signature -Namespace PKI -Name Kernel32
$path = $Env:SystemRoot + "\System32\crypt32.dll"
$hModule = [PKI.Kernel32]::LoadLibraryEx($path,[IntPtr]::Zero,0x2)
$hResInfo = [PKI.Kernel32]::FindResource($hModule,1010,"AUTHROOTS")
$size = [PKI.Kernel32]::SizeOfResource($hModule, $hResInfo)
$resource = [PKI.Kernel32]::LoadResource($hModule, $hResInfo)
$bytes = New-Object byte[] -ArgumentList $size
[Runtime.InteropServices.Marshal]::Copy($resource, $bytes, 0, $size)
$AUTHROOTS = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection
$AUTHROOTS.Import($bytes)
[void][PKI.Kernel32]::FreeLibrary($hModule)
$AUTHROOTS | ?{$_.thumbprint -eq "75E0ABB6138512271C04F85FDDDE38E4B7242EFE"}

just copy-paste this code to PS console and check if any object is returned/

7
  • When do these certificates get installed? Like, in that Google example - I clearly can't access the site from a fresh install, and the certificate doesn't seem to be showing up. I've found some articles on how to download a list of ALL the root certificates (an SST file, which can then be imported), and that resolves the immediate Google issue, but I'm still worried the certificate wasn't installed on demand, as you suggest it should. – Shaamaan Jun 27 '19 at 11:56
  • you should not explicitly install all roots manually, because you will bloat the store. I have no idea what was the problem with Google. You haven't provided any details. – Crypt32 Jun 27 '19 at 12:00
  • Could you be more specific as to what kind of details you'd like to know about? In general: on a fresh install of Windows Server 2016, with all updates installed, accessing almost any SSL site (bar those from Microsoft) throws an "untrusted certificate" warning, since the issuer of the sites' certificate isn't trusted. – Shaamaan Jun 27 '19 at 12:04
  • Can you provide screenshots of General and Certification Path tabs when viewing invalid certificates? – Crypt32 Jun 27 '19 at 12:06
  • I've added the screenshots. The certificate seems to be "OK", if I go only by the description in the certificate window. However, the site is showing as having an invalid certificate, and the issuer isn't trusted. – Shaamaan Jun 27 '19 at 14:16
3

The Trusted Root CAs are updated automatically, if the system has Internet access and the feature is not disabled. You can also use certutil to download the trusted root certificates, publish them in a share, and create a group policy to direct systems where to obtain them.

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn265983(v%3Dws.11)

http://woshub.com/updating-trusted-root-certificates-in-windows-10/

Key: HKLM\Software\Policies\Microsoft\SystemCertificates\AuthRoot

Value: DisableRootAutoUpdate

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.