How is a trusted root certificate appearing in my trusted roots list?

Question

Google is in the process of removing CNNIC as a trusted root.

I wanted to make sure i don't have them in my certificate store anyway. So i check certmgr.msc, and look for them. They are neither in my:

• Trusted Root Certificate Authorities, nor
• Third-party Root Certification Authorites

Then i browse to their site

Then i browse to https://www.cnnic.cn/, to confirm that their certificate is invalid. And while there are the usual warnings about css and images being unsecure (and warnings about using weak encryption), the certificate itself is valid!:

So I decide to view the certificate, so I can see its certification chain. Surely they must chain back to a trusted root that my computer does consider valid.

But the very act of viewing the certificate causes it to be added to my Trusted Root store:

I'm fairly certain that they're not hacking Chrome on-the-fly like that. So how is this certificate ending up in my trusted roots list without my permission?

This also leads to the larger question:

• how do i prevent trusted root certificates from being added to my trusted root certificates list without my permission
• how do i locally revoke, or "untrust", a certificate

Bonus Chatter

China Internet Network Information Center

• Subject: CNNIC ROOT
• Issuer: CNNIC ROOT (it's a self-signed of course)
• Valid From: ‎Monday, ‎April ‎16, ‎2007 3:09:14 AM
• Valid To: ‎Friday, ‎April ‎16, ‎2027 3:09:14 AM
• Thumbprint (sha): ‎8b af 4c 9b 1d f0 2a 92 f7 da 12 8e b9 1b ac f4 98 60 4b 6f

Answer 1

You can do that by just moving it to the "Untrusted Certificates" yourself. Which is all Microsoft would do if they were to blacklist the root certificate, although they would do it at a higher level, and it would effect all users if they were to do so.

This only works for browsers that respect the operating system's certificate store. Since Firefox uses its own certificate store you would have to indicate to Firefox you no longer trust the root certificate in question.

If you want to view the computer's certificate store which will be what is the starting point for all user's certifcate store by doing the following.

1. Start > type mmc in the run prompt
2. This will bring up Microsoft Management Console.
3. Select File > Add/Remove Snap-In
4. Select Certificates > Add
5. Select Computer Account
6. Select Local Computer
7. Select Finsh and OK

It looks like you would need to "export" the certificate from the user's certificate store and import it into the computer's certificate store and simply place it in the "Untrusted Certificate" this would have the result have revocation across all users on the computer itself.

How you would do it on a domain would be slightly different but the same principle applies.