I was just looking at my certificate store and saw a bunch of root CAs that look kind of suspicious; specifically numerous ones that:
- have ALL CAPS text
- use foreign languages/text
- have extremely long expiration dates
- include every certificate purpose possible
I strongly believe that some of these are bad (the Intermediate CA list looks clean, only the Root CA list looks bad.) However, there are enough certificates in the store to make investigating each one a real chore. (I see in the Event Log that Windows has not auto-updated the trusted third-party root list for over two weeks.)
Does anyone know of a way to verify certificates and weed out the bad ones (or at least to manually trigger an update)?