0

Have a look here: https://letsencrypt.org/2018/08/06/trusted-by-all-major-root-programs.html

First paragraph says: "As of the end of July 2018, the Let’s Encrypt root, ISRG Root X1, is directly trusted by Microsoft products."

I have just checked my Windows 10 20H2 certificate store, and ISRG Root X1 is nowhere to be found. I also can't find it on my corporate PC.

Is this expected? I tried searching for this, but since X3 still works I guess not many people noticed.

StanTastic
  • 173
  • 1
  • 9
  • 1
    Windows since Vista automatically adds roots to the Trusted Root store when referenced; see https://security.stackexchange.com/questions/108951/how-much-of-a-problem-is-it-that-windows-hides-some-of-the-trusted-root-ca-cer and https://security.stackexchange.com/questions/81491/are-there-other-roots-of-trust-on-my-computer-aside-from-these-46-root-certifica . Have you actually used a site whose cert chains to ISRG? Remember LE can chain to either DST (still) or ISRG. – dave_thompson_085 Jan 13 '21 at 03:14

1 Answers1

2

You may have accessed your certificates by using Windows Run: certmgr.msc. However I found out if you access your certificates by doing a windows search for "Internet Properties", then clicking on the "Trusted Root Certification Authorities" tab, you will find ISRG Root X1 there.

Compare it to what you see in certmgr.msc, and you will find out that there is obviously and issue. When you open certmgr, you need to show "Physical Certificate Stores" and "Archived Certificates". You can do this by ensuring you're in the "Certificates - Current User" category, and clicking on view. From there click on options then enable the two check boxes underneath "Show the following".

You will find ISRG Root X1 underneath: Trusted Root Certification Authorities > Local Computer > Certificates.

JandyPilot
  • 21
  • 2
  • It also shows up if you use Find. I found that it was installed but hidden in the default view, and not enabled for any purpose. I don't know how this happened but I already have reports from customers of the same. – Hamish Moffatt Oct 01 '21 at 05:04