5 ms·
Even worse, there has been at least one "security program" that installed its own CA and went on to prevent any further modification to the CA list. It was pro
by kijin 4y ago
Even worse, there has been at least one "security program" that installed its own CA and went on to prevent any further modification to the CA list.
It was probably meant to prevent malware from adding their own CAs. In practice, though, it even stopped Windows from keeping its official CA list up to date.
In October 2021, the root certificate used by Let's Encrypt expired. All existing certs were cross-signed by another broadly supported (but more recently included) CA, so this should have been a non-issue on any reasonably up-to-date device. Uh oh, a lot of South Korean PCs had had their CA lists frozen for several years. Suddenly, random people all over the country were unable to connect to websites using Let's Encrypt despite being on the latest version of Windows 10. It was nearly impossible for ordinary users to track down the offending program and uninstall it, and there was no guarantee that the CA list would be restored upon uninstallation. A lot of website owners just switched to ZeroSSL or some other CA because of this clusterfsck.
- i67vw3 4y agoCan you a cite source for it, will be interesting to read about this situation in south korea.
- kijin 4y agoUnfortunately there isn't a definitive source, only a bit of noise in the blogs for a few days. AFAIK it was difficult to pinpoint exactly which version of which program was the culprit, since people aren't free to install an arbitrary version of a government-mandated security program. Most website owners just got tired of the bullshit and bought a cheap Sectigo cert instead. But the symptoms were very clear. Some program, at some point before ISRG Root X1 became included in Windows, had set the registry key \HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\DisableRootAutoUpdate to 1, when it should have been 0 by default. I remember having seen a name being mentioned, but can't find the name now. The program was probably from a healthcare and/or welfare related website, since most of the complaints that came across my desk were from physicians, pharmacists, and welfare workers. No complaints at all from casual shoppers and bank users.