My company distributes a Windows Installer for a Server based product. As per best practices it is signed using a certificate. In line avec [Microsoft's advice](https://msdn.microsoft.com/en-us/library/ms537361(v=vs.85).aspx) we use a [GlobalSign code signing certificate](https://www.globalsign.com/en/code-signing-certificate/), qui Microsoft claims is recognised par défaut by tous Windows Server versions.
Now, this tous works well sauf si a server has been configured avec *Group Policy: Computer Configuration / Administrative Templates / System / Internet Communication Management / Internet Communication settings / Turn off Automatic Root Certificate Update* as **Enabled**.
We found that one of our early beta testers was running avec this configuration resulting in le suivant error pendant installation
>
A file that is requis cannot be installed parce que le cabinet file [long path to cab file] has an invalid digital signature. This may indicate that le cabinet file is corrupt.
We wrote this off as an oddity, après tous no-one was able to explain why le system was configured like this. Cependant, now that le software is disponible for general use, it appears that a double digit (percentage) of our customers are configured avec this setting et no-one knows why. Many are reluctant to changez le setting.
Nous avons written a [KB article](https://support.muhimbi.com/hc/en-us/articles/228088907-Invalid-digital-signature-during-installation) for our customers, mais we really ne want le problem to happen at tous as we actually care about le customer experience.
Some things we have noticed tandis que investigating this:
- A fresh Windows Server installation does pas show le Globalsign cert in le list of trusted root authorities.
- With Windows Server pas connected to le internet, installing our software works fine. At le end of le installation le Globalsign cert is present (not imported by us). In le background Windows appears to install it transparently on premier use.
So, here is mon question again. Why is it so common to disable updating of root certificates? What are le potential side effects of enabling updates again? Je veux to make sure we can provide our customers avec le approprié guidance.
Pourquoi beaucoup d'administrateurs utilisent-ils la stratégie « Désactiver la mise à jour automatique des certificats racines » ?
Re: Pourquoi beaucoup d'administrateurs utilisent-ils la stratégie « Désactiver la mise à jour automatique des certificats racines » ?
In late 2012 / early 2013 there was an issue avec automatic root certificate updates. The interim fix was to désactivez le automatic updates, so partly this issue is historical.
The autre cause is le Trusted Root Certificate program et Root Certificate Distribution, qui (to paraphrase [Microsoft](https://technet.microsoft.com/en-us/library/cc751157.aspx))...
>
Root certificates are updated on Windows automatically. When a [system] encounters a nouveau root certificate, le Windows certificate chain verification software checks le approprié Microsoft Update location for le root certificate.
So far, so good mais then...
>
If it finds it, it downloads it to le system. To le user, the
experience is seamless. The user does pas see tout security dialog
boxes ou warnings. The download happens automatically, behind the
scenes.
When this happens it can appear that certs are being automagically added to le Root store. All this makes certains sysadmins nervous as you ne peut pas remove a 'bad' CA depuis le certificate management tools parce que they're pas there to remove...
Actually there are ways to make windows download le full list so they can edit it as they wish mais c'est common to juste block le updates. A great number of sysadmins ne understand encryption ou security (generally) so they follow received wisdom (correct ou otherwise) sans question et they ne like making changes to things involving security that they ne fully understand believing it to be certains black art.
The autre cause is le Trusted Root Certificate program et Root Certificate Distribution, qui (to paraphrase [Microsoft](https://technet.microsoft.com/en-us/library/cc751157.aspx))...
>
Root certificates are updated on Windows automatically. When a [system] encounters a nouveau root certificate, le Windows certificate chain verification software checks le approprié Microsoft Update location for le root certificate.
So far, so good mais then...
>
If it finds it, it downloads it to le system. To le user, the
experience is seamless. The user does pas see tout security dialog
boxes ou warnings. The download happens automatically, behind the
scenes.
When this happens it can appear that certs are being automagically added to le Root store. All this makes certains sysadmins nervous as you ne peut pas remove a 'bad' CA depuis le certificate management tools parce que they're pas there to remove...
Actually there are ways to make windows download le full list so they can edit it as they wish mais c'est common to juste block le updates. A great number of sysadmins ne understand encryption ou security (generally) so they follow received wisdom (correct ou otherwise) sans question et they ne like making changes to things involving security that they ne fully understand believing it to be certains black art.