Solved

SSL certificate pack

Posted on 2016-10-29
6
108 Views
Last Modified: 2016-11-01
Hi All,

I have setup a clean build of Windows 7 from DVD downloaded from Microsoft.

For some reason when I browse pretty much all SSL sites it says the certificate is invalid.  The time on the PC is correct.  It looks like the intermediate certificate / root certificate authorities are all missing.

Is there a pack somewhere I can download?

Thanks
0
Comment
Question by:detox1978
  • 2
  • 2
  • 2
6 Comments
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
ID: 41865186
are you using MSDN or VL version of Windows 7?
0
 
LVL 2

Author Comment

by:detox1978
ID: 41865190
VL
0
 
LVL 61

Expert Comment

by:btan
ID: 41865216
You can run certmgr.msc to see if there are really all missing root and intermediate certificate. Update with Windows 7 Service Pack 1. Have the automatic updater

You may configure a file or web server to download the CTL files, and then use group policy to push them to your computer.

The list of trusted root certificates is available as a self-extracting IEXPRESS package in the Microsoft Download Center, the Windows catalog, or by using Windows Server Update Services (WSUS). IEXPRESS packages are released at the same time as the trusted CTL.
More details please refer to the article below:
Configure Trusted Roots and Disallowed Certificates
https://technet.microsoft.com/en-us/library/dn265983.aspx
And you should have the below update applied also:
An update is available that enables administrators to update trusted and disallowed CTLs in disconnected environments in Windows
https://support.microsoft.com/en-us/kb/2813430
Alternatively can update root cert using rootsupd
The customer who had the certificate issues didn’t provide clients with internet access. This was preventing the client from acquiring certificates trough Windows Update. Microsoft solves this with a tool called rootsupd.exe which will download and import all certificates that are part of the Root Certificate Program to the clients root certificates store.
The executable @
http://download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/rootsupd.exe

Another means from https://support.microsoft.com/en-sg/kb/2677070 on the link the cab files
A certificate trust list (CTL) is a predefined list of items that are signed by a trusted entity. All the items in the list are authenticated and approved by a trusted signing entity. This update expands on this existing functionality by adding known untrusted certificates to the untrusted certificate store by using a CTL that contains either their public key or their signature hash. After this update is installed, customers benefit from quick automatic updates of untrusted certificates.

Users who have disconnected systems will not benefit from this feature improvement. These customers will still have to install the root certificate updates when they are made available. Please see the "More Information" section.

As part of this update, the URLs that are used for contacting Windows Update to download the untrusted and trusted CTLs were changed. This could cause problems for enterprises that hardcode these URLs in their firewalls as exceptions.

The following are the new URLs:

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Better to go through auto update where possible
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 37

Expert Comment

by:Bing CISM / CISSP
ID: 41865240
please check if you have got this update installed? if not, install it. this Windows Root Certificate Program enables trusted root certificates to be distributed automatically in Windows.

https://support.microsoft.com/en-au/kb/3004394
0
 
LVL 61

Accepted Solution

by:
btan earned 500 total points
ID: 41865579
To add on for my post, which also menrioned below. You can also

- use certutil to grab all the trusted root certificates from the Windows Update server:
    certutil -generateSSTFromWU roots.sst
- open roots.sst (which defaults to viewing in certmgr) and it will show the whole lot.

Or use certutil -syncWithWU to get all the certs individually.

Alternatively,for the trusted CTL,
- download http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab,
- extract the authroot.stl file (which is in PKCS#7 format, the .cab can be open in explorer to get the stl extracted),
- use 'certutil -dump' to list all the subject key identifiers therein (e.g.  OCTET STRING      [HEX DUMP]:CDD4EEAE6000AC7F40C3802C171E30148030C072),
- download them from the same location as authrootstl.cab by appending ".crt" to the identifier. (e.g. http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CDD4EEAE6000AC7F40C3802C171E30148030C072.crt)
- repeat for the rest of the certificate in the dump from the certutil output

You can do it for the untrusted (disallowed) CTL and others below as well.
(as shared) •authrootstl.cab, which contains a non-Microsoft CTL
(using the link shared in my first post)•disallowedcertstl.cab, which contains a CTL with untrusted certificates
(other)•disallowedcert.sst, which contains a serialized certificate store, including untrusted certificates
(others)•<thumbprint>.crt, which contains non-Microsoft root certificates


The above it is manual way otherwise just
- download  http://download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/rootsupd.exe
- install the updated root certs.
0
 
LVL 2

Author Comment

by:detox1978
ID: 41868961
Thanks,

Running this fixed the issue

certutil -generateSSTFromWU roots.sst
0

Featured Post

Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

Join & Write a Comment

Healthcare organizations in the United States must adhere to the guidance of both the HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health Act) for securing and protec…
This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
This Micro Tutorial will teach you how to the overview of Microsoft Security Essentials. This is a free anti-virus software that guards your PC against viruses, spyware, worms, and other malicious software. This will be demonstrated using Windows…
This Micro Tutorial will go in depth within Systems and Security in Windows 7 and will go into detail regarding Action Center, Windows Firewall, System, etc. This will be demonstrated using Windows 7 operating system.

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now