Solved

Update Root Certificates

Posted on 2010-08-17
8
5,357 Views
Last Modified: 2012-05-10
I would like to know answers for following...

What is the purpose of Update Root Certificates

How do i turn off update root certificates in W2K8

what is the draw back of turning off it.

what is the benefit of turning it on


0
Comment
Question by:sudhirgoogle
  • 4
  • 2
  • 2
8 Comments
 
LVL 59

Accepted Solution

by:
Darius Ghassem earned 200 total points
Comment Utility
Root certificates are important when it comes to security if you don't update the root certificates you run a chance that you will go to website and you will not be able to access or you will get SSL errors since you have old root certificates.

http://support.microsoft.com/kb/931125

http://ask-leo.com/what_are_root_certificates_and_why_do_i_need_to_update_them.html
0
 
LVL 1

Author Comment

by:sudhirgoogle
Comment Utility
Thanks for posting that links. So to turn off the automatic root certificates updates, here is what i did.

in group policy -> Computer Configuration\Administrative Templates\System\Internet Communication Management -> I made "Restrict Internet Communication" to Not configured.
And
Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings-> I made "Turn Off Automatic Root Certificates Updates" to Enable.

Is this the right way to turn off Automatic root certificates updates on windows server 2008 box ?? or is there any other way to do that.

Please find the attachment.

1.JPG
0
 
LVL 1

Author Comment

by:sudhirgoogle
Comment Utility
another attachment
2.JPG
0
 
LVL 59

Expert Comment

by:Darius Ghassem
Comment Utility
Well you can just disable the Turn Off Automatic Root Cert Updates. Even with the above setting you can still update manually if you ever need to update.
0
Want to promote your upcoming event?

Are you going to an event? Are you going to be exhibiting at a tradeshow? Talking at a conference? Using a promotional banner in your email signature ensures that your organization’s most important contacts stay in the know and can potentially spread the word about the event.

 
LVL 4

Assisted Solution

by:grimace606
grimace606 earned 300 total points
Comment Utility
Answers below:

What is the purpose of Update Root Certificates
The certificate authorities that issue public certificates issue these based on the ROOT certificates that they publish. This list of root certificates is explicitly trusted and changes from time to time for various reasons. Windows automatically gets updates for this trusted list.

How do i turn off update root certificates in W2K8
Do as sudhirgoogle: posted above

what is the draw back of turning off it.
You will have to manually update this list. If it gets too out of date then you will get errors with your public certificates+ security risk.
what is the benefit of turning it on
Saves you time and effort + no errors + better security. There may be instances where you do need to turn this off eg. on an exchange server to support intermediate certificates for older mobile devices.
Hope this answers your questions.
0
 
LVL 1

Author Comment

by:sudhirgoogle
Comment Utility
Hello grimace606,

Thanks for your response. I do not understand your statement "The certificate authorities that issue public certificates issue these based on the ROOT certificates that they publish"

Can you please explain that little bit more detail..

0
 
LVL 4

Assisted Solution

by:grimace606
grimace606 earned 300 total points
Comment Utility

"A CA issues digital certificates that contain a public key and the identity of the owner. The matching private key is not similarly made available publicly, but kept secret by the end user who generated the key pair. The certificate is also a confirmation or validation by the CA that the public key contained in the certificate belongs to the person, organization, server or other entity noted in the certificate. A CA's obligation in such schemes is to verify an applicant's credentials, so that users and relying parties can trust the information in the CA's certificates. CAs use a variety of standards and tests to do so. In essence, the Certificate Authority is responsible for saying "yes, this person is who they say they are, and we, the CA, verify that".
If the user trusts the CA and can verify the CA's signature, then he can also verify that a certain public key does indeed belong to whoever is identified in the certificate."
A user will trust the issuing Public CA - they will do this based  on the ROOT certificate issued by the public CA.
Companies that own their own root certificates are root certificate authorities. A trusted root certificate authority is one that your web browser includes in its list of trusted authorities.

Some reading on certificates : http://msdn.microsoft.com/en-us/library/aa376539(VS.85).aspx
For example: Lets say I have a certificate that proves the identity for my web site and you need to know if this is a trusted site or not.
If I get a certificate from say Verisign for my web site and If you have the root certificate for Verisign trusted on your PC - then you will trust any certificate that Verisign issues and hence you will trust my certificate and hence my web site.
0
 
LVL 1

Author Closing Comment

by:sudhirgoogle
Comment Utility
question answered
0

Featured Post

Are end users causing IT problems again?

You’ve taken the time to design and update all your end user’s email signatures, only to find out they’re messing up the HTML, changing the font and ruining the imagery. What can you do to prevent this? Find out how you can save your signatures from end users today.

Join & Write a Comment

I was asked if I could set up a fax machine so that incoming faxes were delivered to people's Exchange inboxes and so that they could send faxes from their desktops without needing to print the document first.  I knew it was possible but I had no id…
New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

8 Experts available now in Live!

Get 1:1 Help Now