Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1239
  • Last Modified:

SSL certificate pack

Hi All,

I have setup a clean build of Windows 7 from DVD downloaded from Microsoft.

For some reason when I browse pretty much all SSL sites it says the certificate is invalid.  The time on the PC is correct.  It looks like the intermediate certificate / root certificate authorities are all missing.

Is there a pack somewhere I can download?

Thanks
0
detox1978
Asked:
detox1978
  • 2
  • 2
  • 2
1 Solution
 
bbaoIT ConsultantCommented:
are you using MSDN or VL version of Windows 7?
0
 
detox1978Author Commented:
VL
0
 
btanExec ConsultantCommented:
You can run certmgr.msc to see if there are really all missing root and intermediate certificate. Update with Windows 7 Service Pack 1. Have the automatic updater

You may configure a file or web server to download the CTL files, and then use group policy to push them to your computer.

The list of trusted root certificates is available as a self-extracting IEXPRESS package in the Microsoft Download Center, the Windows catalog, or by using Windows Server Update Services (WSUS). IEXPRESS packages are released at the same time as the trusted CTL.
More details please refer to the article below:
Configure Trusted Roots and Disallowed Certificates
https://technet.microsoft.com/en-us/library/dn265983.aspx
And you should have the below update applied also:
An update is available that enables administrators to update trusted and disallowed CTLs in disconnected environments in Windows
https://support.microsoft.com/en-us/kb/2813430
Alternatively can update root cert using rootsupd
The customer who had the certificate issues didn’t provide clients with internet access. This was preventing the client from acquiring certificates trough Windows Update. Microsoft solves this with a tool called rootsupd.exe which will download and import all certificates that are part of the Root Certificate Program to the clients root certificates store.
The executable @
http://download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/rootsupd.exe

Another means from https://support.microsoft.com/en-sg/kb/2677070 on the link the cab files
A certificate trust list (CTL) is a predefined list of items that are signed by a trusted entity. All the items in the list are authenticated and approved by a trusted signing entity. This update expands on this existing functionality by adding known untrusted certificates to the untrusted certificate store by using a CTL that contains either their public key or their signature hash. After this update is installed, customers benefit from quick automatic updates of untrusted certificates.

Users who have disconnected systems will not benefit from this feature improvement. These customers will still have to install the root certificate updates when they are made available. Please see the "More Information" section.

As part of this update, the URLs that are used for contacting Windows Update to download the untrusted and trusted CTLs were changed. This could cause problems for enterprises that hardcode these URLs in their firewalls as exceptions.

The following are the new URLs:

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Better to go through auto update where possible
0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 
bbaoIT ConsultantCommented:
please check if you have got this update installed? if not, install it. this Windows Root Certificate Program enables trusted root certificates to be distributed automatically in Windows.

https://support.microsoft.com/en-au/kb/3004394
0
 
btanExec ConsultantCommented:
To add on for my post, which also menrioned below. You can also

- use certutil to grab all the trusted root certificates from the Windows Update server:
    certutil -generateSSTFromWU roots.sst
- open roots.sst (which defaults to viewing in certmgr) and it will show the whole lot.

Or use certutil -syncWithWU to get all the certs individually.

Alternatively,for the trusted CTL,
- download http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab,
- extract the authroot.stl file (which is in PKCS#7 format, the .cab can be open in explorer to get the stl extracted),
- use 'certutil -dump' to list all the subject key identifiers therein (e.g.  OCTET STRING      [HEX DUMP]:CDD4EEAE6000AC7F40C3802C171E30148030C072),
- download them from the same location as authrootstl.cab by appending ".crt" to the identifier. (e.g. http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CDD4EEAE6000AC7F40C3802C171E30148030C072.crt)
- repeat for the rest of the certificate in the dump from the certutil output

You can do it for the untrusted (disallowed) CTL and others below as well.
(as shared) •authrootstl.cab, which contains a non-Microsoft CTL
(using the link shared in my first post)•disallowedcertstl.cab, which contains a CTL with untrusted certificates
(other)•disallowedcert.sst, which contains a serialized certificate store, including untrusted certificates
(others)•<thumbprint>.crt, which contains non-Microsoft root certificates


The above it is manual way otherwise just
- download  http://download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/rootsupd.exe
- install the updated root certs.
0
 
detox1978Author Commented:
Thanks,

Running this fixed the issue

certutil -generateSSTFromWU roots.sst
0

Featured Post

Put Machine Learning to Work--Protect Your Clients

Machine learning means Smarter Cybersecurity™ Solutions.
As technology continues to advance, managing and analyzing massive data sets just can’t be accomplished by humans alone. It requires huge amounts of memory and storage, as well as the high-speed power of the cloud.

  • 2
  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now