<story><title>Windows Certificate Manager does not display the complete trust list</title><url>http://hexatomium.github.io/2015/08/29/why-is-windows/</url></story><parent_chain></parent_chain><comment><author>geographomics</author><text>You can also use certutil to grab all the trusted root certificates from the Windows Update server:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    certutil -generateSSTFromWU roots.sst
&lt;/code&gt;&lt;/pre&gt;
Then open roots.sst (which defaults to viewing in certmgr) and it will show the whole lot. Or use certutil -syncWithWU to get all the certs individually.&lt;p&gt;Alternatively: download &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;ctldl.windowsupdate.com&amp;#x2F;msdownload&amp;#x2F;update&amp;#x2F;v3&amp;#x2F;static&amp;#x2F;trustedr&amp;#x2F;en&amp;#x2F;authrootstl.cab&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;ctldl.windowsupdate.com&amp;#x2F;msdownload&amp;#x2F;update&amp;#x2F;v3&amp;#x2F;static&amp;#x2F;t...&lt;/a&gt; [1], extract the authroot.stl file (which is in PKCS#7 format), use &amp;#x27;certutil -dump&amp;#x27; to list all the subject key identifiers therein, and then download them from the same location as authrootstl.cab by appending &amp;quot;.crt&amp;quot; to the identifier.&lt;p&gt;Windows is not lying about anything, you just need to look in the right place.&lt;p&gt;Also, if you want to examine the CTL list that Windows is currently using - which should be identical to the one above unless it&amp;#x27;s brand new or there has been a problem downloading it - this will extract it from the registry:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    powershell -Command &amp;quot;[IO.File]::WriteAllBytes(&amp;#x27;authroot-local.stl&amp;#x27;,(Get-ItemProperty -Path &amp;#x27;HKLM:\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate&amp;#x27;).EncodedCtl)&amp;quot;
&lt;/code&gt;&lt;/pre&gt;
Then use &amp;#x27;certinfo -dump&amp;#x27; or whatever you like, it&amp;#x27;s exactly the same format as the downloaded authroot.stl. This is the same registry data that the OP&amp;#x27;s CTLInfo tool examines.&lt;p&gt;[1] as specified in &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;support.microsoft.com&amp;#x2F;en-us&amp;#x2F;kb&amp;#x2F;2677070&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;support.microsoft.com&amp;#x2F;en-us&amp;#x2F;kb&amp;#x2F;2677070&lt;/a&gt;</text></comment>
<story><title>Windows Certificate Manager does not display the complete trust list</title><url>http://hexatomium.github.io/2015/08/29/why-is-windows/</url></story><parent_chain></parent_chain><comment><author>brudgers</author><text>One feature of Windows is defaulting to not showing messy complexity to the user. The other feature is defaulting to backward compatibility. Combined, this means that Windows often has more than two data stores for some aggregate feature [e.g. web browser security, software configuration etc.] as new versions of Windows implement these features in more robust ways.&lt;p&gt;So yeah there are two or more places where certificates are stored. Typical users only care about the abstraction of web security so that&amp;#x27;s what Windows surfaces. Application developers should choose the new store for new applications. Existing applications can use the old method. System administrators and security consultants should make themselves familiar with all the documentation and double their rates.&lt;p&gt;Bloggers, however, are still free to write linkbait headlines using the Windows bashing meme.</text></comment>