We value your feedback.
Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!
COURSE of the MONTH
9 days, 4 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Update Root Certificates
Posted on 2010-08-17
I would like to know answers for following...
What is the purpose of Update Root Certificates
How do i turn off update root certificates in W2K8
what is the draw back of turning off it.
what is the benefit of turning it on
What is the purpose of Update Root Certificates
How do i turn off update root certificates in W2K8
what is the draw back of turning off it.
what is the benefit of turning it on
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
-
4
2
2
8 Comments
Root certificates are important when it comes to security if you don't update the root certificates you run a chance that you will go to website and you will not be able to access or you will get SSL errors since you have old root certificates.
http://support.microsoft.com/kb/931125
http://ask-leo.com/what_are_root_certificates_and_why_do_i_need_to_update_them.html
http://support.microsoft.com/kb/931125
http://ask-leo.com/what_are_root_certificates_and_why_do_i_need_to_update_them.html
Thanks for posting that links. So to turn off the automatic root certificates updates, here is what i did.
in group policy -> Computer Configuration\Administrati
And
Computer Configuration\Administrati
Is this the right way to turn off Automatic root certificates updates on windows server 2008 box ?? or is there any other way to do that.
Please find the attachment.
1.JPG
in group policy -> Computer Configuration\Administrati
And
Computer Configuration\Administrati
Is this the right way to turn off Automatic root certificates updates on windows server 2008 box ?? or is there any other way to do that.
Please find the attachment.
1.JPG
Well you can just disable the Turn Off Automatic Root Cert Updates. Even with the above setting you can still update manually if you ever need to update.
Answers below:
What is the purpose of Update Root Certificates
The certificate authorities that issue public certificates issue these based on the ROOT certificates that they publish. This list of root certificates is explicitly trusted and changes from time to time for various reasons. Windows automatically gets updates for this trusted list.
How do i turn off update root certificates in W2K8
Do as sudhirgoogle: posted above
what is the draw back of turning off it.
You will have to manually update this list. If it gets too out of date then you will get errors with your public certificates+ security risk.
what is the benefit of turning it on
Saves you time and effort + no errors + better security. There may be instances where you do need to turn this off eg. on an exchange server to support intermediate certificates for older mobile devices.
Hope this answers your questions.
What is the purpose of Update Root Certificates
The certificate authorities that issue public certificates issue these based on the ROOT certificates that they publish. This list of root certificates is explicitly trusted and changes from time to time for various reasons. Windows automatically gets updates for this trusted list.
How do i turn off update root certificates in W2K8
Do as sudhirgoogle: posted above
what is the draw back of turning off it.
You will have to manually update this list. If it gets too out of date then you will get errors with your public certificates+ security risk.
what is the benefit of turning it on
Saves you time and effort + no errors + better security. There may be instances where you do need to turn this off eg. on an exchange server to support intermediate certificates for older mobile devices.
Hope this answers your questions.
Hello grimace606,
Thanks for your response. I do not understand your statement "The certificate authorities that issue public certificates issue these based on the ROOT certificates that they publish"
Can you please explain that little bit more detail..
Thanks for your response. I do not understand your statement "The certificate authorities that issue public certificates issue these based on the ROOT certificates that they publish"
Can you please explain that little bit more detail..
"A CA issues digital certificates that contain a public key and the identity of the owner. The matching private key is not similarly made available publicly, but kept secret by the end user who generated the key pair. The certificate is also a confirmation or validation by the CA that the public key contained in the certificate belongs to the person, organization, server or other entity noted in the certificate. A CA's obligation in such schemes is to verify an applicant's credentials, so that users and relying parties can trust the information in the CA's certificates. CAs use a variety of standards and tests to do so. In essence, the Certificate Authority is responsible for saying "yes, this person is who they say they are, and we, the CA, verify that".
If the user trusts the CA and can verify the CA's signature, then he can also verify that a certain public key does indeed belong to whoever is identified in the certificate."
A user will trust the issuing Public CA - they will do this based on the ROOT certificate issued by the public CA.
Companies that own their own root certificates are root certificate authorities. A trusted root certificate authority is one that your web browser includes in its list of trusted authorities.
Some reading on certificates : http://msdn.microsoft.com/en-us/library/aa376539(VS.85).aspx
For example: Lets say I have a certificate that proves the identity for my web site and you need to know if this is a trusted site or not.
If I get a certificate from say Verisign for my web site and If you have the root certificate for Verisign trusted on your PC - then you will trust any certificate that Verisign issues and hence you will trust my certificate and hence my web site.
Featured Post
Managing Active Directory does not always have to be complicated. If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
I had a question today where the user wanted to know how to delete an SSL Certificate, so I thought that I would quickly add this How to! Article for your reference.
WHY WOULD YOU WANT TO DELETE A CERTIFICATE?
1. If an incorrect certificate was …
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP, Windows Server…
- Ransomware
- Experts Exchange
- Windows XP
- Windows OS
- Windows Server 2008
- Windows Server 2003, Security
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility.
Directly connect an external storage device such as a USB drive, or CD\DVD burner:
If the device is a USB drive, ensure i…
This Micro Tutorial hows how you can integrate Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease.
The following video show how to bind OSX Mavericks to …
Suggested Courses
Course of the Month9 days, 4 hours left to enroll
765 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.