A certificate trust list (CTL) is a predefined list of items that are signed by a trusted entity. All the items in the list are authenticated and approved by a trusted signing entity. This update expands on this existing functionality by adding known untrusted certificates to the untrusted certificate store by using a CTL that contains either their public key or their signature hash. After this update is installed, customers benefit from quick automatic updates of untrusted certificates.
Users who have disconnected systems will not benefit from this feature improvement. These customers will still have to install the root certificate updates when they are made available. Please see the "More Information" section.
As part of this update, the URLs that are used for contacting Windows Update to download the untrusted and trusted CTLs were changed. This could cause problems for enterprises that hardcode these URLs in their firewalls as exceptions.
The following are the new URLs:
For systems that are running Windows Vista, Windows 7, Windows Server 2008, or Windows Server 2008 R2 and that are using the automatic updater of untrusted certificates (that is, if either KB 2677070 or KB 2813430 is already installed), see the rest of this section and also Microsoft Knowledge Base article 2813430 for more information. Customers do not have to take any action because these systems will be automatically protected.
If the system does not have access to Windows Update, either because the system is not connected to the Internet or because Windows Update is blocked by firewall rules, the network retrieval will time-out before the service can continue its startup procedure. In some cases, this network retrieval time-out may exceed the service startup time-out of 30 seconds. If a service cannot report that startup has completed after 30 seconds, the service control manager (SCM) stops the service.
If you cannot avoid installing this update on disconnected systems, you can disable the network retrieval of the trusted and untrusted CTLs. To do this, you disable automatic root updates by using Group Policy settings. To disable automatic root updates by using policy settings, follow these steps:
- Create a Group Policy or change an existing Group Policy in the Local Group Policy Editor.
- In the Local Group Policy Editor, double-click Policies under the Computer Configuration node.
- Double-click Windows Settings, double-click Security Settings, and then double-click Public Key Policies.
- In the details pane, double-click Certificate Path Validation Settings.
- Click the Network Retrieval tab, select Define these policy settings, and then clear the Automatically update certificates in the Microsoft Root Certificate Program (recommended) check box.
- Click OK, and then close the Local Group Policy Editor.
If automatic root updates are disabled, Administrators must manually manage root certificates that are trusted by Windows. Trusted root certificates can be distributed to computers that are running Windows by using Group Policy. For more information about how to manage the root certificates that are trusted by Windows, visit the following Microsoft website:
Update replacement informationThis update replaces the following update:
For all supported x86-based versions of Windows VistaDownload the Windows6.0-KB2677070-x86.msu package now.
For all supported x64-based versions of Windows VistaDownload the Windows6.0-KB2677070-x64.msu package now.
For all supported x86-based versions Windows Server 2008Download the Windows6.0-KB2677070-x86.msu package now.
For all supported x64-based versions of Windows Server 2008Download the Windows6.0-KB2677070-x64 package now.
For all supported IA-64-based versions of Windows Server 2008Download the Windows6.0-KB2677070-ia64.msu package now.
For all supported x86-based versions of Windows 7Download the Windows6.1-KB2677070-x86.msu package now.
For all supported x64-based versions of Windows 7Download the Windows6.1-KB2677070-x64.msu package now.
For all supported x64-based versions of Windows Server 2008 R2Download the Windows6.1-KB2677070-x64.msu package now.
For all supported IA-64-based versions of Windows Server 2008 R2Download the Windows6.1-KB2677070-ia64.msu package now.
Release Date: June 12, 2012
For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: