Is there a way to quickly disable all trusted root certificates in Windows 7?

Question

(I've posted this earlier to superuser)

I'd like to temporarily disable all trusted root certificates and wondering if there is a quicker way than going through every single one of them, right-click Properties and selecting "Disable all purposes for this certificate" (and then trying to find where I left off after the list in mmc scrolls back to the top)?

Answer 1

Just as @Grant mentioned, Powershell can be used to remove (effectively disabling) the certificates from the store. An export can be done prior to the removal so you can re-import them back to the store.

To export & remove from the store:

Add-Type -AssemblyName System.Security

$exportPath = 'c:\temp\certexport'

$certStore = New-Object System.Security.Cryptography.X509Certificates.X509Store -ArgumentList 'Root', 'LocalMachine'

$certStore.Open('ReadWrite')

foreach ($cert in $certStore.Certificates) {

    # Export cert to a .cer file.
    $certPath = Join-Path -Path $exportPath -ChildPath "$($cert.Thumbprint).cer"
    [System.IO.File]::WriteAllBytes($certPath, $cert.Export('Cert'))

    # Remove the cert from the store.
    $certStore.Remove($cert)

}
$certStore.Close()

To re-import them back to the store:

Add-Type -AssemblyName System.Security

$exportPath = 'c:\temp\certexport'

$certStore = New-Object System.Security.Cryptography.X509Certificates.X509Store -ArgumentList 'Root', 'LocalMachine'

$certStore.Open('ReadWrite')

Get-ChildItem -Path $exportPath -Filter *.cer | ForEach-Object {

    $cert = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Certificate($_.FullName)

    $certStore.Add($cert)
}
$certStore.Close()

Answer 2

Powershell doesn't appear to have any way of disabling the certificates. Which is kind of surprising, perhaps I missed them. But it does have commands to import, export, and delete them.

One could (and test this from a virtual machine with snapshots or something in case the first revision doesn't work out) write a powershell script to export all the certs, delete them all, pause while you do whatever you are doing, then import them again.

This doesn't quite give the same results as disabling them, but since you don't say why you are doing it, it might be close enough for your purposes.

I believe disabling a certificate does the same thing as marking it as untrusted. If that's the case you might be able to select them all and drag them to the untrusted certificates store. But check what is in there already - you wouldn't want to move any existing untrusted ones back when you are done.