Eh, my point was just that: - Policy is largely encapsulated on the certificate properties in the root store - Local Policy is implemented via registry k

Eh, my point was just that: - Policy is largely encapsulated on the certificate properties in the root store - Local Policy is implemented via registry keys, with somewhere like 100+ odd registry keys (... many undocumented, as they implement customer-specific features whose documentation is provided under a MSFT support agreement) - Policy is a mix of documented (via WinCrypt.h) and undocumented flags - The reason for not documenting some of this is that they’re flags that Microsoft may or may not support; that is, they’re implementation details - CAPI provides, by design, several ways to fully replace their policies, either for single trust purposes or for all - The UI exposes a suitable “general purpose” expression I can totally understand the complaint that this isn’t clear in the UI, and as others have noted, sometimes that’s intentional. I can also totally understand the complaint that this isn’t all meticulously documented. Not everyone can ring up their pet Microsoft engineer to get documentation and show how it connects to a problem that Microsoft benefits from helping us solve (the linked-to crt.sh bug, which as a side-effect helps provide greater automation for Microsoft and the CAs they supervise). However, Microsoft also, from the get-go, designed it to be extensible so you could replace this. Importantly, Microsoft has been able to roll out new features, and remove trust in CAs, without major re-engineering work. That was the “beautiful engineering” part of my comment. They defined a stable API that could be easily extended, or even wholesale replaced, in the Windows 2000/XP era. That API has brought considerable improvements WITHOUT requiring rewriting your code for Windows Vista, 7, 8, or 10 to leverage that. That’s a considerable difference from some other libraries and tools; LibreSSL was hugely constrained fixing OpenSSLs broken chain building, Mozilla Firefox/NSS has undergone three complete and separate rewrites from the ground up of the engine, Apple deprecated dozens of APIs when they ported iOS’s verifier to macOS, etc. As an engineer, 20+ years of stability IS impressive!