Root Certificate in Windows using MMC?
Depending on the circumstance you may be getting mixed results of browser certificate trust or for whatever reason are experiencing an issue with Cross Root Certificates or warning of not fully trusting a chaining root.
Cross Root Certificate where used back in the day by some Certificate Authorities to help certificate trust to older outdated server systems, but due to liability of allowing certificate trust to these systems that practice is no longer practiced.
SSL Certificates are now used to modernize and update industry standards not give loop wholes around staying secure.
To bypass a Cross Root Certificate warning it is a matter of making sure a new updated root is installed on the system in question and that all purposes of that certificate is enabled.
Majority of modern systems typically should be updated with newer roots and this odd 4 chain Cross Root certificate structure is rarely seen (modern secure structures have a 3 chain certificate hierarchy).
Usually, this issue appears in outdated systems like Windows Server 2003. If this is occurring in a more recent system like Windows Server 2008 then the system may have been configured/disabled to do this manually for whatever reason or it was oddly never updated with a newer modern root, which happens on locked-down systems due to security.
Windows systems will always show you the entire Certification Path of an SSL Certificate, and will automatically perform the shortest Channing path if possible with the certificates provided within its certificate stores. In this scenario, we will be using Geotrust as an example.
Learning
- Create an MMC Snap-in for Managing Certificates on a Windows server system.
- Checking to see if you have your Root within an MMC Root store.
- Enabling All purposes of your Root certificate – if Root is found.
- Importing a Root Certificate into MMC Root store.
For more information on SSL/TLS Certificates, Verified Mark Certificates (VMCs), Public Key Infrastructure Certificates, SSL/TLS Certificate Lifecycle Management, and Matter Certificates email to sslsupport@acmetek.com or visit https://www.acmetek.com/contact-us/
