You can use sigcheck -tv (sysinternals) to test against Microsoft's list. I prefer RCC (root certificate checker) and have used it in the past, but the website

You can use sigcheck -tv (sysinternals) to test against Microsoft's list. I prefer RCC (root certificate checker) and have used it in the past, but the website seems to be suspended.