TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Many of the root certificates on Windows are not needed

255 pointsby svenfawover 4 years ago

17 comments

sleeviover 4 years ago
For folks discovering this: Unfortunately, this isn’t a good idea, and can seriously harm your system.<p>I’ll be the first to tell you that I believe Google and Mozilla have done a lot for supervising TLS, but realize that the trust stores contain many other non-TLS purposes, and with the CAs constrained from TLS issuance (e.g. only trust for S&#x2F;MIME).<p>CryptoAPI, for its warts, is actually beautifully engineered, in that Microsoft has had the ability to add arbitrary constraints and properties to certificates from the very first release (via CERT_PROP_IDs). You don’t really see these in the UI; you only find out about them in WinCrypt.h, or via debugger stepping. However, it means that even if the UI is showing “trusted for TLS”, Microsoft may have disabled trust for TLS via the extended properties, which their APIs respect, and which are delivered through authroots.cab<p>You can see a little bit about this at <a href="https:&#x2F;&#x2F;github.com&#x2F;crtsh&#x2F;certwatch_db&#x2F;issues&#x2F;69" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;crtsh&#x2F;certwatch_db&#x2F;issues&#x2F;69</a> and <a href="http:&#x2F;&#x2F;unmitigatedrisk.com&#x2F;?p=259" rel="nofollow">http:&#x2F;&#x2F;unmitigatedrisk.com&#x2F;?p=259</a><p>Approaches like the OP link fail to take that into consideration, and can easily break core OS services, non-TLS cases like code signing or S&#x2F;MIME, or even reintroduce trust in CAs that Microsoft has programmatically disabled.
评论 #24827858 未加载
评论 #24828861 未加载
评论 #24827875 未加载
评论 #24829939 未加载
评论 #24834526 未加载
DeepYogurtover 4 years ago
I love how the author asks the reader to implicitly distrust the OS vendor, but then also to implicitly trust their random software. Seems legit to me.
评论 #24829647 未加载
yonixwover 4 years ago
Distrust Amazon Root CA 1? This is the root CA for a lot of AWS API gateways. Waaaaay Overkill.
评论 #24833118 未加载
评论 #24828536 未加载
chrismellerover 4 years ago
For reference. I can’t actually find a list of Google’s right now.<p>Mozilla: <a href="https:&#x2F;&#x2F;wiki.mozilla.org&#x2F;CA&#x2F;Included_Certificates" rel="nofollow">https:&#x2F;&#x2F;wiki.mozilla.org&#x2F;CA&#x2F;Included_Certificates</a><p>EDIT: and yes, it would have been nice for the author to link directly to these... Google clearly has their own, but obviously there’s some debate about what that means.
评论 #24827845 未加载
评论 #24828019 未加载
评论 #24829154 未加载
评论 #24827863 未加载
评论 #24827772 未加载
svnpennover 4 years ago
So people are just allowed to post ads for closed source software now?
评论 #24833134 未加载
criddellover 4 years ago
I always wondered how painful it would be to clear out my root store and only re-enable root CAs as I needed them. Would I need more than 5% of them?
评论 #24829625 未加载
评论 #24828860 未加载
评论 #24828769 未加载
morpheuskafkaover 4 years ago
How does Apple&#x27;s iOS&#x2F;macOS trust store look, by comparison?
评论 #24828179 未加载
评论 #24828246 未加载
评论 #24857422 未加载
unnouinceputover 4 years ago
OK, so let&#x27;s continue this trend and we end-up trusting just one. So we concentrate the entire internet power into just one hand. Because it&#x27;s such a good idea, right?
评论 #24828612 未加载
评论 #24828552 未加载
评论 #24828527 未加载
galaxyLogicover 4 years ago
&quot; Windows trusts 322 root certificates issued by 122 different organizations&quot;<p>I think this is a good point I would never trust 122 people in my life with my bank-account details. But if I trust my browser it seems that is exactly what I&#x27;m doing.<p>Isn&#x27;t there a better way?
评论 #24828759 未加载
评论 #24829130 未加载
评论 #24833157 未加载
egberts1over 4 years ago
The Problem, with distrusting them all Root CAs and accepting it back into the fold one-by-one, is simply that you don’t know if that trusting Root CA in question has signed off some other but malicious sub-CA(s).
评论 #24828635 未加载
parliament32over 4 years ago
Interestingly, Debian (in the ca-certificates package) only has 122. These are from Mozilla AFAIK.
评论 #24829597 未加载
unilynxover 4 years ago
fun related certificate fact, TIL that Linkedin&#x27;s share does not seem to support any of the dutch government certificates - <a href="https:&#x2F;&#x2F;www.linkedin.com&#x2F;post-inspector&#x2F;inspect&#x2F;https:%2F%2Fwww.rijksoverheid.nl%2F" rel="nofollow">https:&#x2F;&#x2F;www.linkedin.com&#x2F;post-inspector&#x2F;inspect&#x2F;https:%2F%2F...</a><p>(I wish they wouldn&#x27;t bother with all the EV certificates and just accept LetsEncrypt. So much manual work for broken certificates that need to be replaced whenever the CA messes up the trust bits or Iran hacks the certificate providers again)
skipantsover 4 years ago
In direct contrast to this article, I&#x27;ve had to specifically set `security.enterprise_roots.enabled` to true on Firefox because completely legitimate sites were not trusted.
评论 #24828998 未加载
评论 #24829201 未加载
rswailover 4 years ago
How does this compare to MacOS? I haven&#x27;t gone through Apple&#x27;s default CA roots.
rafaelturkover 4 years ago
IMG this is lame and can break your system. Also creates a single point of failure if one of this, now super certificates, is revoked
评论 #24829220 未加载
philsnowover 4 years ago
I don&#x27;t know anything about this company (rootIQ) but it sounds like a juicy, high-value target.
评论 #24828194 未加载
billpgover 4 years ago
The rot started when browsers started including root certs as trusted by default.
评论 #24827779 未加载