8 ms·

Windows Certificate Manager does not display the complete trust list

390 points by svenfaw 11y ago

wfunction 11y ago
Is this really true? When I navigate to https://certplusrootcag1-test.opentrust.com/ https://certplusrootcag1-test.opentrust.com/ I see the root certificate is "Certplus Root CA G1", not "OpenTrust Root CA G1"...
- setyfse4 11y ago
  It is "CertplusRoot CA G1" in my system too. This CA was added recently (http://www.infoworld.com/article/2941594/security/microsoft-quietly-pushes-17-new-trusted-root-certificates-to-all-windows-systems.html http://www.infoworld.com/article/2941594/security/microsoft-...).
FreeHugs 11y ago
CTLInfo is the result of a few sleepless nights spent understanding and reverse engineering some of the CTL obscure format I wonder what the reason is to use a userunfriendly system like Windows and then spend hours and hours fighting it? No matter how much time you put in, you will never win against an OS that is working against your interests.
- philtar 11y ago
  1) Because MSFT provides great corporate support for desktops. Keyword: great. Not good. Great. 2) Because people are used to it. 3) Because Office products are the de facto standard, and they run best on windows. I could go on, but you get the point.
  - philliphaydon 11y ago
    Everyone talks about how great the alternatives for office are. Buy they are good. Not great. Even office word online is better than Google docs.
    - zxcvcxz 11y ago
      What is "better" about MS word than google docs? The only reason I see to use word is if you're using files from 1999 that don't work anywhere else. Google docs is a much simpler system, especially for places like schools because of the "cloud" nature of it. Google docs has all the features the average person needs. MSWord is for specialty cases, google docs and the open alternatives are for everyone else. I'm about to earn a masters degree and I've never needed to use MS word. Double spacing, page numbers, and aligning text work in just about every processor. I've rarely received a word document from a professor that used advanced features of word, they're always poorly formatted.
      - sp332 11y ago
        I think you missed the word "online". https://office.live.com/start/Word.aspx https://office.live.com/start/Word.aspx
      - icebraining 11y ago
        In my experience, Docs can't even reliably align the cursor with the position between characters (problem described here[1], except my zoom is at 100% already). Thankfully all my documents have very light formatting, so I can just write in Vim and then upload them. [1] http://www.podiohelp.com/google-docs-cursor-misaligned/ http://www.podiohelp.com/google-docs-cursor-misaligned/
        nightpool 11y ago
        I've seen this happen before, but only very rarely and refreshing would always fix it. Does refreshing not work for you?
        icebraining 11y ago
        Unfortunately not.
        scholia 11y ago
        I get this as well, and I have another problem. I usually work in Word but one company wants things in Google Docs. OK, I create the document in Word in Times Roman and paste it into Google Docs.... which converts it into Arial. If I copy something else from the same Word document into the same Google Doc, then Google keeps it in Times. How does that work? Is there a "smart paste" feature I've missed?
  - LoSboccacc 11y ago
    x) Anything related with drivers, especially video and audio With the exception of printers. Omg printers are such a PITA on windows I often just send a pdf to me and print it with the phone.
    - tracker1 11y ago
      The past several printers I've had... I just had to open the add printer dialog (which is more of a pain than it should be) and it would just detect the printer.. this is from win7 through 10. Now getting a new printer (new hardware) installed in Linux isn't usually so easy.. unless you're using a fairly mainstream HP Laser printer, which is actually what I recommend because it's so straight forward. Outside of that it's almost always a pain. My current printer is rigged up and connected to print from my phone from anywhere, I have it setup for remote printing via Chrome... which is kind of nice, ordering something, or paying a bill on a break at work and being able to print at home. Unless you're using a really off brand, I haven't had trouble installing on windows via the add printer... it may take a while to download a full device list for printers, which aren't pre-installed, but that's time not difficulty.
      - LoSboccacc 11y ago
        I've an epson wifi printer and every time it gets a different ip windows can't find it anymore. I used to have it on a dns reserved ip but damned new telco router doesn't have that option since I upgrades to fiber. Every time the epson setup wants to restart the whole computer to start the detection and it is so annoying, I just let any other airprint device do the thing.
        tracker1 11y ago
        Does the epson itself have a web-ui that you can set a hard-coded address to? I usually just set all mine in the router, but as you said, that doesn't work for you.
      - JupiterMoon 11y ago
        With linux I usually just plug it in then hit print in the application. Then it prints... I've never run into a consumer model that needed installing in any way. I may just have been lucky.
- 6d0debc071 11y ago
  For fun, to illustrate that it can't be trusted, because what you want to use isn't available for the alternatives. First few reasons that spring to mind.
- johnminter 11y ago
  I'll add to philtar's comment: Because senior management forces workers to use it. I'm a scientist who analyzes large data sets. I also need to communicate to my co-workers. I need a secure operating system without a lot of eye-candy that makes it look like a tablet and lets me give priority to my data analysis tasks. Windows is not it, but I have to use it.
  - 3pt14159 11y ago
    But you can use things like Excel easily in a VM. Not pull your hair out hard, but easily. Then you can parse Excel or Word with Python in Linux easily. I just don't get how we still allow closed source operating systems for critical business tasks.
    - CrazyCatDog 11y ago
      Try deploying and a different OS with easily understandable UI. Make it easy so that companies can issue laptops and upon first login the machines are appropriately imaged per the user needs. Make sure that strong user limits are in place to prevent users from running bitcoin-mining/porn-servers/or-worse on corporate machines and then and only then, you may have a shot at disrupting the Windows enterprise stronghold. If you were to poll corporate user income and their provided OS, you will likely find that 99% of workers earning low wages (i.e. not trusted by their companies) are provided windows, the more someone earns the more likely they are to have a choice in OS from their employer--just my hypothesis.
    - scholia 11y ago
      I just don't get how we still allow closed source operating systems for critical business tasks. Maybe I'm a bit behind the times, but some collection of VM, MVS, OS/390 aka zOS, CICS, IMS, DB2, RACF, SNA, Oracle, SAP etc etc is probably running the majority of America's critical business tasks. Did it all get open sourced when I wasn't looking? Needless to say, Google Docs and Gmail are not open source either....
- eli 11y ago
  You're reading Hacker News and you want to know why someone would bother reverse engineering a closed source platform?
  - forgottenpass 11y ago
    To be fair, Hacker is weird misnomer in many ways. It's starutp-scene-connected-tech-heavy-news more than anything else.
    - kuschku 11y ago
      Which can also be seen in the fact that the general consensus on startup-news is often the opposite of what the actual hackers, for example those who are in the CCC, think.
      - oblio 11y ago
        CCC = ?
        deleted 11y ago
        [deleted]
        Bob_Sheep 11y ago
        Chaos Computer Club
      - fimdomeio 11y ago
        Oblio that's leet speak. hacker history (well and present) nothing that a google search won't clarify.
    - nota_bene 11y ago
      > It's starutp-scene-connected-tech-heavy-news more than anything else. Yes, and that's because it is a very powerful marketing tool for Paul Graham's huge YC business.
    - nailer 11y ago
TazeTSchnitzel 11y ago
Windows isn't lying. Microsoft openly lists what certificates Windows includes on their site. The fact the root certificate store on your machine only lists certificates it actually contains is to be expected. This is just a UI failure.
- dtech 11y ago
  Yep, they release a periodical PDF with interim updates [1]. Only the most lazy "security researcher" would believe that Windows only trusts two dozen root certificates. [1]: http://social.technet.microsoft.com/wiki/contents/articles/14215.windows-and-windows-phone-8-ssl-root-certificate-program-member-cas.aspx http://social.technet.microsoft.com/wiki/contents/articles/1...
- pandog 11y ago
  But there's a difference between looking at the list of root certificates that Microsoft say Windows trusts and looking at the list of root certificates that Windows trusts.
  - dtech 11y ago
    Only if the two lists differ, that would actually be noteworthy. Currently it's just a blatantly clickbait title.
    - pandog 11y ago
      If it changes and you haven't taken the software update yet the lists will differ.
- tellthetruth1 11y ago
  When an American company lies, it's only a UI failure.
  - benbenolson 11y ago
    Why, specifically, American companies? I've encountered countless companies from other countries that lie.
geographomics 11y ago
You can also use certutil to grab all the trusted root certificates from the Windows Update server: certutil -generateSSTFromWU roots.sst Then open roots.sst (which defaults to viewing in certmgr) and it will show the whole lot. Or use certutil -syncWithWU to get all the certs individually. Alternatively: download http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... [1], extract the authroot.stl file (which is in PKCS#7 format), use 'certutil -dump' to list all the subject key identifiers therein, and then download them from the same location as authrootstl.cab by appending ".crt" to the identifier. Windows is not lying about anything, you just need to look in the right place. Also, if you want to examine the CTL list that Windows is currently using - which should be identical to the one above unless it's brand new or there has been a problem downloading it - this will extract it from the registry: powershell -Command "[IO.File]::WriteAllBytes('authroot-local.stl',(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate').EncodedCtl)" Then use 'certinfo -dump' or whatever you like, it's exactly the same format as the downloaded authroot.stl. This is the same registry data that the OP's CTLInfo tool examines. [1] as specified in https://support.microsoft.com/en-us/kb/2677070 https://support.microsoft.com/en-us/kb/2677070
- mattkrea 11y ago
  The bigger takeaway from this is with a system like this (fully managed by Windows Updates).. how can you remove certificates you don't trust? Latest documentation for this seems to be for IE 5. I sure as hell like to run dkpkg-reconfigure ca-certificates every once in a while after some roots get compromised and don't trust Microsoft to be on the ball.
  - geographomics 11y ago
    It can be added to the disallowed certificate store, which takes precedence over any trusted stores. For example, using the root discussed in the article: 1. Download the root cert from http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/22fdd0b7fda24e0dac492ca0aca67b6a1fe3f766.crt http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... (or save it from the browser's certificate viewer) 2. Open certmgr and import it into 'Untrusted Certificates'. (This just adds it for the current user's store. Could also import into the computer store by running mmc, adding the Certificates snap-in, and specifying 'Computer account' as the target.) 3. Restart browser. Go to https://certplusrootcag1-test.opentrust.com/ https://certplusrootcag1-test.opentrust.com/ - it should say the certificate is revoked. This only works for browsers like IE and Chrome, that use the Windows certificate store. Firefox has its own so would have to be done separately.
brudgers 11y ago
One feature of Windows is defaulting to not showing messy complexity to the user. The other feature is defaulting to backward compatibility. Combined, this means that Windows often has more than two data stores for some aggregate feature [e.g. web browser security, software configuration etc.] as new versions of Windows implement these features in more robust ways. So yeah there are two or more places where certificates are stored. Typical users only care about the abstraction of web security so that's what Windows surfaces. Application developers should choose the new store for new applications. Existing applications can use the old method. System administrators and security consultants should make themselves familiar with all the documentation and double their rates. Bloggers, however, are still free to write linkbait headlines using the Windows bashing meme.
- vtlynch 11y ago
  "Typical users only care about the abstraction of web security so that's what Windows surfaces." Typical users do not open certmgr.msc
  - deleted 11y ago
    [deleted]
  - ryanlol 11y ago
    People that understand what certmgr.msc does (or should do) would immediately realize that it's not telling the full story.
    - corndoge 11y ago
      I'm not a web developer, I am not intimately familiar with the intricate details of SSL, and yet I understand what a root store is and how it works. I have used certmgr.msc in the past, understanding that it should show me the certificates trusted by the system -- no more, no less. I did not immediately realize that it was not showing me all the certs my system trusts and I would like to know how I could have immediately realized that without knowing all the major CA's and the names of their root certs off the back of my hand. Perhaps that could be written off as my failing in not knowing what certmgr.msc "should do", but Windows certainly does not make it very clear and I think it's reasonable for an average power user to assume that it shows all the trusted certs on the system, and not part.
iancarroll 11y ago
If you're interested in seeing new roots, Microsoft has started posting all updates to the cabfpub mailing list: https://cabforum.org/pipermail/public/2015-August/005847.html https://cabforum.org/pipermail/public/2015-August/005847.htm...
benevol 11y ago
Since when did anyone trust Windows/Microsoft/closed source software, anyway? Did I miss anything?
nota_bene 11y ago
Isn't the first question to ask "Can I trust Windows?" (and the answer "no", for all the obvious reasons)?
Animats 11y ago
The Edge browser doesn't display certificate data at all. This has been discussed on the CAB forum mailing list recently.
Animats 11y ago
What seems to be happening with Windows is that Microsoft is making the machine more a slave of their services with each new release. It's as if they're trying to catch up with Chromebooks, which are totally slaved to Google. Especially since Windows 10 is free with ads. Treating the local certificate store as a cache to the main certificate store at Microsoft HQ is consistent with this. How difficult it is to hijack the link between the local and remote certificate stores? That's a potential attack surface. It's not hard-coded; it's a registry key (Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate). The default URL is "ctldl.windowsupdate.com". So what protects that domain from being hijacked via DNS poisoning? It ought to have a valid SSL cert, right? Well, no. Go to "https://ctldl.windowsupdate.com/" https://ctldl.windowsupdate.com/": ctldl.windowsupdate.com uses an invalid security certificate. The certificate is only valid for the following names: a248.e.akamai.net, *.akamaihd.net, *.akamaihd-staging.net, *.akamaized.net, *.akamaized-staging.net (Error code: ssl_error_bad_cert_domain) Uh oh. Am I missing something, or are root certs downloaded over an unsecured channel?
- geographomics 11y ago
  They are transmitted over an unencrypted channel, but the CTL files themselves (authroot.stl and disallowedcert.stl) are signed by Microsoft so it's fine. Any modification in transit can be detected and presumably will cause them not to be updated.
  - Animats 11y ago
    So an attacker could return an old "disallowedcert.stl" to re-activate a revoked cert?
    - geographomics 11y ago
      It would be interesting to try. There's a sequence number in the CTL which could prevent this type of attack, but I don't know if it's actually checked against that which is currently stored.

390 points by svenfaw 11y ago

Is this really true? When I navigate to https://certplusrootcag1-test.opentrust.com/ https://certplusrootcag1-test.opentrust.com/ I see the root certificate is "Certplus Root CA G1", not "OpenTrust Root CA G1"...

setyfse4 11y ago
It is "CertplusRoot CA G1" in my system too. This CA was added recently (http://www.infoworld.com/article/2941594/security/microsoft-quietly-pushes-17-new-trusted-root-certificates-to-all-windows-systems.html http://www.infoworld.com/article/2941594/security/microsoft-...).

FreeHugs 11y ago

CTLInfo is the result of a few sleepless nights spent understanding and reverse engineering some of the CTL obscure format I wonder what the reason is to use a userunfriendly system like Windows and then spend hours and hours fighting it? No matter how much time you put in, you will never win against an OS that is working against your interests.

philtar 11y ago
1) Because MSFT provides great corporate support for desktops. Keyword: great. Not good. Great. 2) Because people are used to it. 3) Because Office products are the de facto standard, and they run best on windows. I could go on, but you get the point.
- philliphaydon 11y ago
  Everyone talks about how great the alternatives for office are. Buy they are good. Not great. Even office word online is better than Google docs.
  - zxcvcxz 11y ago
    What is "better" about MS word than google docs? The only reason I see to use word is if you're using files from 1999 that don't work anywhere else. Google docs is a much simpler system, especially for places like schools because of the "cloud" nature of it. Google docs has all the features the average person needs. MSWord is for specialty cases, google docs and the open alternatives are for everyone else. I'm about to earn a masters degree and I've never needed to use MS word. Double spacing, page numbers, and aligning text work in just about every processor. I've rarely received a word document from a professor that used advanced features of word, they're always poorly formatted.
    - sp332 11y ago
      I think you missed the word "online". https://office.live.com/start/Word.aspx https://office.live.com/start/Word.aspx
    - icebraining 11y ago
      In my experience, Docs can't even reliably align the cursor with the position between characters (problem described here[1], except my zoom is at 100% already). Thankfully all my documents have very light formatting, so I can just write in Vim and then upload them. [1] http://www.podiohelp.com/google-docs-cursor-misaligned/ http://www.podiohelp.com/google-docs-cursor-misaligned/
      - nightpool 11y ago
        I've seen this happen before, but only very rarely and refreshing would always fix it. Does refreshing not work for you?
        icebraining 11y ago
        Unfortunately not.
      - scholia 11y ago
        I get this as well, and I have another problem. I usually work in Word but one company wants things in Google Docs. OK, I create the document in Word in Times Roman and paste it into Google Docs.... which converts it into Arial. If I copy something else from the same Word document into the same Google Doc, then Google keeps it in Times. How does that work? Is there a "smart paste" feature I've missed?
- LoSboccacc 11y ago
  x) Anything related with drivers, especially video and audio With the exception of printers. Omg printers are such a PITA on windows I often just send a pdf to me and print it with the phone.
  - tracker1 11y ago
    The past several printers I've had... I just had to open the add printer dialog (which is more of a pain than it should be) and it would just detect the printer.. this is from win7 through 10. Now getting a new printer (new hardware) installed in Linux isn't usually so easy.. unless you're using a fairly mainstream HP Laser printer, which is actually what I recommend because it's so straight forward. Outside of that it's almost always a pain. My current printer is rigged up and connected to print from my phone from anywhere, I have it setup for remote printing via Chrome... which is kind of nice, ordering something, or paying a bill on a break at work and being able to print at home. Unless you're using a really off brand, I haven't had trouble installing on windows via the add printer... it may take a while to download a full device list for printers, which aren't pre-installed, but that's time not difficulty.
    - LoSboccacc 11y ago
      I've an epson wifi printer and every time it gets a different ip windows can't find it anymore. I used to have it on a dns reserved ip but damned new telco router doesn't have that option since I upgrades to fiber. Every time the epson setup wants to restart the whole computer to start the detection and it is so annoying, I just let any other airprint device do the thing.
      - tracker1 11y ago
        Does the epson itself have a web-ui that you can set a hard-coded address to? I usually just set all mine in the router, but as you said, that doesn't work for you.
    - JupiterMoon 11y ago
      With linux I usually just plug it in then hit print in the application. Then it prints... I've never run into a consumer model that needed installing in any way. I may just have been lucky.
6d0debc071 11y ago
For fun, to illustrate that it can't be trusted, because what you want to use isn't available for the alternatives. First few reasons that spring to mind.
johnminter 11y ago
I'll add to philtar's comment: Because senior management forces workers to use it. I'm a scientist who analyzes large data sets. I also need to communicate to my co-workers. I need a secure operating system without a lot of eye-candy that makes it look like a tablet and lets me give priority to my data analysis tasks. Windows is not it, but I have to use it.
- 3pt14159 11y ago
  But you can use things like Excel easily in a VM. Not pull your hair out hard, but easily. Then you can parse Excel or Word with Python in Linux easily. I just don't get how we still allow closed source operating systems for critical business tasks.
  - CrazyCatDog 11y ago
    Try deploying and a different OS with easily understandable UI. Make it easy so that companies can issue laptops and upon first login the machines are appropriately imaged per the user needs. Make sure that strong user limits are in place to prevent users from running bitcoin-mining/porn-servers/or-worse on corporate machines and then and only then, you may have a shot at disrupting the Windows enterprise stronghold. If you were to poll corporate user income and their provided OS, you will likely find that 99% of workers earning low wages (i.e. not trusted by their companies) are provided windows, the more someone earns the more likely they are to have a choice in OS from their employer--just my hypothesis.
  - scholia 11y ago
    I just don't get how we still allow closed source operating systems for critical business tasks. Maybe I'm a bit behind the times, but some collection of VM, MVS, OS/390 aka zOS, CICS, IMS, DB2, RACF, SNA, Oracle, SAP etc etc is probably running the majority of America's critical business tasks. Did it all get open sourced when I wasn't looking? Needless to say, Google Docs and Gmail are not open source either....
eli 11y ago
You're reading Hacker News and you want to know why someone would bother reverse engineering a closed source platform?
- forgottenpass 11y ago
  To be fair, Hacker is weird misnomer in many ways. It's starutp-scene-connected-tech-heavy-news more than anything else.
  - kuschku 11y ago
    Which can also be seen in the fact that the general consensus on startup-news is often the opposite of what the actual hackers, for example those who are in the CCC, think.
    - oblio 11y ago
      CCC = ?
      - deleted 11y ago
        [deleted]
      - Bob_Sheep 11y ago
        Chaos Computer Club
    - fimdomeio 11y ago
      Oblio that's leet speak. hacker history (well and present) nothing that a google search won't clarify.
  - nota_bene 11y ago
    > It's starutp-scene-connected-tech-heavy-news more than anything else. Yes, and that's because it is a very powerful marketing tool for Paul Graham's huge YC business.
  - nailer 11y ago

TazeTSchnitzel 11y ago

Windows isn't lying. Microsoft openly lists what certificates Windows includes on their site. The fact the root certificate store on your machine only lists certificates it actually contains is to be expected. This is just a UI failure.

dtech 11y ago
Yep, they release a periodical PDF with interim updates [1]. Only the most lazy "security researcher" would believe that Windows only trusts two dozen root certificates. [1]: http://social.technet.microsoft.com/wiki/contents/articles/14215.windows-and-windows-phone-8-ssl-root-certificate-program-member-cas.aspx http://social.technet.microsoft.com/wiki/contents/articles/1...
pandog 11y ago
But there's a difference between looking at the list of root certificates that Microsoft say Windows trusts and looking at the list of root certificates that Windows trusts.
- dtech 11y ago
  Only if the two lists differ, that would actually be noteworthy. Currently it's just a blatantly clickbait title.
  - pandog 11y ago
    If it changes and you haven't taken the software update yet the lists will differ.
tellthetruth1 11y ago
When an American company lies, it's only a UI failure.
- benbenolson 11y ago
  Why, specifically, American companies? I've encountered countless companies from other countries that lie.

geographomics 11y ago

You can also use certutil to grab all the trusted root certificates from the Windows Update server: certutil -generateSSTFromWU roots.sst Then open roots.sst (which defaults to viewing in certmgr) and it will show the whole lot. Or use certutil -syncWithWU to get all the certs individually. Alternatively: download http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... [1], extract the authroot.stl file (which is in PKCS#7 format), use 'certutil -dump' to list all the subject key identifiers therein, and then download them from the same location as authrootstl.cab by appending ".crt" to the identifier. Windows is not lying about anything, you just need to look in the right place. Also, if you want to examine the CTL list that Windows is currently using - which should be identical to the one above unless it's brand new or there has been a problem downloading it - this will extract it from the registry: powershell -Command "[IO.File]::WriteAllBytes('authroot-local.stl',(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate').EncodedCtl)" Then use 'certinfo -dump' or whatever you like, it's exactly the same format as the downloaded authroot.stl. This is the same registry data that the OP's CTLInfo tool examines. [1] as specified in https://support.microsoft.com/en-us/kb/2677070 https://support.microsoft.com/en-us/kb/2677070

mattkrea 11y ago
The bigger takeaway from this is with a system like this (fully managed by Windows Updates).. how can you remove certificates you don't trust? Latest documentation for this seems to be for IE 5. I sure as hell like to run dkpkg-reconfigure ca-certificates every once in a while after some roots get compromised and don't trust Microsoft to be on the ball.
- geographomics 11y ago
  It can be added to the disallowed certificate store, which takes precedence over any trusted stores. For example, using the root discussed in the article: 1. Download the root cert from http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/22fdd0b7fda24e0dac492ca0aca67b6a1fe3f766.crt http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... (or save it from the browser's certificate viewer) 2. Open certmgr and import it into 'Untrusted Certificates'. (This just adds it for the current user's store. Could also import into the computer store by running mmc, adding the Certificates snap-in, and specifying 'Computer account' as the target.) 3. Restart browser. Go to https://certplusrootcag1-test.opentrust.com/ https://certplusrootcag1-test.opentrust.com/ - it should say the certificate is revoked. This only works for browsers like IE and Chrome, that use the Windows certificate store. Firefox has its own so would have to be done separately.

brudgers 11y ago

One feature of Windows is defaulting to not showing messy complexity to the user. The other feature is defaulting to backward compatibility. Combined, this means that Windows often has more than two data stores for some aggregate feature [e.g. web browser security, software configuration etc.] as new versions of Windows implement these features in more robust ways. So yeah there are two or more places where certificates are stored. Typical users only care about the abstraction of web security so that's what Windows surfaces. Application developers should choose the new store for new applications. Existing applications can use the old method. System administrators and security consultants should make themselves familiar with all the documentation and double their rates. Bloggers, however, are still free to write linkbait headlines using the Windows bashing meme.

vtlynch 11y ago
"Typical users only care about the abstraction of web security so that's what Windows surfaces." Typical users do not open certmgr.msc
- deleted 11y ago
  [deleted]
- ryanlol 11y ago
  People that understand what certmgr.msc does (or should do) would immediately realize that it's not telling the full story.
  - corndoge 11y ago
    I'm not a web developer, I am not intimately familiar with the intricate details of SSL, and yet I understand what a root store is and how it works. I have used certmgr.msc in the past, understanding that it should show me the certificates trusted by the system -- no more, no less. I did not immediately realize that it was not showing me all the certs my system trusts and I would like to know how I could have immediately realized that without knowing all the major CA's and the names of their root certs off the back of my hand. Perhaps that could be written off as my failing in not knowing what certmgr.msc "should do", but Windows certainly does not make it very clear and I think it's reasonable for an average power user to assume that it shows all the trusted certs on the system, and not part.

iancarroll 11y ago

If you're interested in seeing new roots, Microsoft has started posting all updates to the cabfpub mailing list: https://cabforum.org/pipermail/public/2015-August/005847.html https://cabforum.org/pipermail/public/2015-August/005847.htm...

benevol 11y ago

Since when did anyone trust Windows/Microsoft/closed source software, anyway? Did I miss anything?

nota_bene 11y ago

Isn't the first question to ask "Can I trust Windows?" (and the answer "no", for all the obvious reasons)?

Animats 11y ago

The Edge browser doesn't display certificate data at all. This has been discussed on the CAB forum mailing list recently.

Animats 11y ago

What seems to be happening with Windows is that Microsoft is making the machine more a slave of their services with each new release. It's as if they're trying to catch up with Chromebooks, which are totally slaved to Google. Especially since Windows 10 is free with ads. Treating the local certificate store as a cache to the main certificate store at Microsoft HQ is consistent with this. How difficult it is to hijack the link between the local and remote certificate stores? That's a potential attack surface. It's not hard-coded; it's a registry key (Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate). The default URL is "ctldl.windowsupdate.com". So what protects that domain from being hijacked via DNS poisoning? It ought to have a valid SSL cert, right? Well, no. Go to "https://ctldl.windowsupdate.com/" https://ctldl.windowsupdate.com/": ctldl.windowsupdate.com uses an invalid security certificate. The certificate is only valid for the following names: a248.e.akamai.net, *.akamaihd.net, *.akamaihd-staging.net, *.akamaized.net, *.akamaized-staging.net (Error code: ssl_error_bad_cert_domain) Uh oh. Am I missing something, or are root certs downloaded over an unsecured channel?

geographomics 11y ago
They are transmitted over an unencrypted channel, but the CTL files themselves (authroot.stl and disallowedcert.stl) are signed by Microsoft so it's fine. Any modification in transit can be detected and presumably will cause them not to be updated.
- Animats 11y ago
  So an attacker could return an old "disallowedcert.stl" to re-activate a revoked cert?
  - geographomics 11y ago
    It would be interesting to try. There's a sequence number in the CTL which could prevent this type of attack, but I don't know if it's actually checked against that which is currently stored.