Windows has a feature called Automatic Root Update, when CryptoAPI does a chain build, exhausts the locally installed root certificates it downloads (if it has not already done so) a list of certificates it should trust. This list contains attributes about those certificates (hashes of their subject name and keys, what Microsoft believes it should … Continue reading Understanding Windows Automatic Root Update