Threat Level: green Handler on Duty: Guy Bruneau

SANS ISC: Microsoft Certificate Updater - SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Microsoft Certificate Updater

Microsoft released an automatic updated for untrusted certificates. A bid sad that we need this, but it does appear to be necessary to have a method to continuously update a bad certificate lists. The goal of the new updater is to allow for updates to the untrusted certificate store in one day or less after a new bad certificate is known.

Key revocation lists and OCSP were designed to notify clients of revoked certificates. However, these protocols haven't shown the scalability necessary to reliably notify clients of invalid certificates.

(thx Alex for pointing this out)


Johannes B. Ullrich, Ph.D.
SANS Technology Institute

I will be teaching next: Application Security: Securing Web Apps, APIs, and Microservices - SANS London June 2022


4473 Posts
ISC Handler
Jun 13th 2012
If these certificate updates keep requiring reboots it's going to greatly slow down their install rate :(
Happy to see a tool like this get released. I would think it wouldn't cause a reboot... anyone know if the KBs for previous cert updates caused a reboot?

19 Posts
#pedant mode on
"A bid sad" should be "A bit sad"
#pedant mode off
But yes, a loss of trust is always sad.
KB2718704 didn't require a reboot.

11 Posts
KB2718704 didn't require a reboot on Vista & Win7 but did on XP

25 Posts
Soon enough, a security hole in this updater will require a Certificate Updater Updater. I hate to tell you this, but it's updaters all the way down.
1 Posts
Does this flaw have anything to do with this news article:

21 Posts

Sign Up for Free or Log In to start participating in the conversation!