Microsoft → Re: [WIN7] Not Offered KB931125 Root Certificates Update

I'm so sorry Libra.
I misread your posting and gave you the wrong link.
That link is indeed for Windows XP.

The following information applies for Windows Vista, Windows 7:

said by Microsoft.com :

---

Root certificates on Windows Vista and later are distributed via the automatic root update mechanism – that is, per root certificate. When a user visits a secure Web site (by using HTTPS SSL), reads a secure email (S/MIME), or downloads an ActiveX control that is signed (code signing) and encounters a new root certificate, the Windows certificate chain verification software checks Microsoft Update for the root certificate. If it finds it, it downloads the current Certificate Trust List (CTL) containing the list of all trusted root certificates in the Program, and verifies that the root certificate is listed there; it then downloads the specified root certificate to the system and installs it in the Windows Trusted Root Certification Authorities Store. If the root certificate is not found, the certificate chain is not completed, and the system returns an error. To the user, a successful root update is seamless. The user does not see any security dialog boxes or warnings. The download happens automatically. In addition, Windows Vista and later client SKUs support weekly pre-fetching from Microsoft Update to check for updated root certificate properties (for example, extended validation (EV), code signing or server authentication properties, which are certificate properties added to a root certificate).

For detailed technical information about how Windows updates root certificates in Windows Vista and in later versions, visit the following website:
»technet.microsoft.com/en ··· 10).aspx

---

Thanks Dustyn. Although this computer did not receive the KB931125 update, I checked the event viewer again and did find a few Windows log appliication>CAPI2 events, so it is getting the updated certificates. (I had previously checked but used the wrong source CAPI7 so nothing came up.)

I still think it's odd that my Vista and other Windows 7 64 bit computer both received that roots certificate update.

Since I didn't receive any confirmation or denial of the XP update, but did allow the UAC do you think it did anything? I haven't rebooted the computer and I still have the restore point. (I've been delaying installing the new flash and browser update until this is resolved - I guess it is even though it didn't get the update.)

Sincerely, Libra

From what Dustyn posted, it's possible that one computer visited a secure site or whatever that caused a quiet automatic update.

Hi andyross,

I understand that from the article, but I was questioning the KB931125 optional roots certificate update which was offered to two of my computers and not the Win 7 laptop.

(Ifirst saw this in screenshots in the Security Forum regarding the current Windows Updates where it is listed as optional.)

Sincerely, Libra

It seems a bit confusing what is going on. My home computer (7 Home Premium) did get the root update. My work computer (7 Pro) didn't. Both are 32-bit.

I agree about the confusion. After rebooting the laptop after the attempted installs, my boot time went from 52 seconds to 81 seconds. I didn't care for that, so last night I used the system restore - now the computer is taking 92 seconds to boot. I give up.

My Windows 7 computers are both 64 bit and Vista is 32 bit.

Sincerely, Libra