1

In light of the DigiNotar CA compromise I decided to check my Internet Explorer Trusted Root Certificates on all my Windows PC's, Windows 7 showed none from DigiNotar, but all of my XP PC's did.

enter image description here

I then read this Microsoft bulletin, and under Suggested Actions it said "Microsoft has removed the DigiNotar root certificate from the Microsoft Certificate Trust List."

So why do they still show up in the list for IE8 in XP?

Is Microsoft talking about a different list?

Should I delete both of the DigiNotar Root certificates?

EDIT:

Here is what I have learned so far and what I did.

Windows Vista and higher have been patched according to Microsoft I checked the Application Event log for "CAPI2" events, I found no entries for DigiNotar install or removal, so maybe they were not there in the first place.

XP will have an update soon to take care of this issue, learned this from a link posted in the comments by Linker3000

What I did for XP, Went to Control Panel > Internet Options > Content Tab > Certificates button > Trusted Root Certificate tab. I exported both DigiNotar trusted certificates to a folder, then I deleted them from the Trusted Certs list.

Once deleted, I went to the "Untrusted Publishers" tab and imported the certs I exported earlier, then I closed the Certificates windows. Then clicked the "Clear SSL State" on the Content tab, this clears and certificate caches you have, then closed Internet Options.

You should clear the caches in Vista and Windows 7 also, this will be done on reboot however you may not reboot for a while.

.

EDIT 2: Microsoft has released an update for Windows KB-2607712

All other Windows versions

2
  • 1
    If you have your own answer, then do post it as an answer. Sep 6, 2011 at 7:40
  • I would rather have one from the community if possible. I only answer my own questions when no one else has given a correct or near correct answer for several days,
    – Moab
    Sep 6, 2011 at 14:04

2 Answers 2

2

Update 08-Sep-2011

Microsoft have now issued an official fix that covers XP and server 2003 so the code below is no longer required. See the following:

http://www.microsoft.com/technet/security/advisory/2607712.mspx

http://support.microsoft.com/kb/2607712


Further to my comment about XP and Windows 2003, Microsoft have not (as of 06-Sep-2011) issued an automated patch/fix for this. I have written the batch file below to automate the removal of the DigiNotar certificates on Windows XP and Windows Server 2003 - this is an interim fix and follows the notes in the two Microsoft bulletins in my comment:

http://blogs.technet.com/b/srd/archive/2011/09/04/protecting-yourself-from-attacks-that-leverage-fraudulent-diginotar-digital-certificates.aspx

http://support.microsoft.com/kb/2328240

Please read those bulletins for background info.

Note that this script needs to be run in every account on a Windows XP or Server 2003 machine and the Microsoft bulletins contain further instructions for additional cleanup in some circumstances. Use at your own risk etc..

The certutil.exe program should be in the \windows\system32 folder on XP and 2003 machines, but I have found a couple where it's not.

@ECHO OFF
ECHO DigiNotar Certificate Fix for Windows XP and Windows Server 2003
ECHO:
ECHO This is a interim fix for use until Microsoft release an official update.
ver | find "XP" > nul && goto VER_OK
ver | find "5.2.3790" > nul && goto VER_OK
ECHO:
ECHO Looks like you are not running Windows XP or Windows Server 2003 so there's nothing to do
GOTO DONE

:VER_OK
if exist %SystemRoot%\system32\certutil.exe goto CU_OK
ECHO:
ECHO ***** ERROR: %SystemRoot%\system32\certutil.exe not found on this machine so cannot continue.
GOTO DONE

:CU_OK
ECHO Deleting Certificates...
ECHO:
certutil -delstore authroot "c0 60 ed 44 cb d8 81 bd 0e f8 6c 0b a2 87 dd cf 81 67 47 8c"
certutil -delstore authroot "43 d9 bc b5 68 e0 39 d0 73 a7 4a 71 d8 51 1f 74 76 08 9c c3"
ECHO:
ECHO:
ECHO Deleting certificate cache...
ECHO:
ECHO If the cache is already empty you may see "-URLCache command FAILED" which can be ignored.
ECHO:
certutil -urlcache * delete

ECHO Certificate cleanup done

:DONE
2
  • What about adding it to the untrusted list?
    – Moab
    Sep 6, 2011 at 14:05
  • The script does what MS suggest as the command line way to go about things and it runs in about 5 secs flat so it's handy if you have a lot of machines to work through.
    – Linker3000
    Sep 6, 2011 at 15:27
2

From the same page:

Suggested Actions

All supported editions of Windows Vista, Windows 7, Windows Server 2008, and Windows Server 2008 R2 use the Microsoft Certificate Trust List to validate the trust of a certificate authority. There is no action required for users of these operating systems because Microsoft has removed the DigiNotar root certificate from the Microsoft Certificate Trust List.

No update is available at this time for supported editions of Windows XP and Windows Server 2003.

You can always remove the certificates manually.

6
  • I saw that, does not answer my questions though. If Microsoft removed it why does it still show up, they need to be more specific.
    – Moab
    Sep 5, 2011 at 19:46
  • Is one to assume a future root certificate update from MS will remove them from my list in IE8? Also curious why W7 IE9 does not have the certs.
    – Moab
    Sep 5, 2011 at 19:48
  • 1
    As noted above, Microsoft did not remove it on XP. You'll have to remove the certificates manually.
    – juggler
    Sep 5, 2011 at 19:49
  • @Moab: "All supported editions of Windows Vista, Windows 7, Windows Server 2008, and Windows Server 2008 R2 use the Microsoft Certificate Trust List." This does not include XP, as the second paragraph confirms. Sep 5, 2011 at 19:51
  • See the following two Microsoft tech notes for command line ways to remove the certificates from XP and 2003: blogs.technet.com/b/srd/archive/2011/09/04/… and support.microsoft.com/kb/2328240 The first removes the certificates from local stores and the second shows you how to clear any certificates from cache. Microsoft have stated that they will be releasing a Windows update to do this automatically for XP/2003 but have not given a timeframe.
    – Linker3000
    Sep 5, 2011 at 20:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .