IE Reinstalling Root Certificates Automatically

PKI Tutorials - Herong's Tutorial Examples

∟IE Reinstalling Root Certificates Automatically

This section provides a tutorial example showing IE reinstalls trusted root certificate automatically when it is needed to validate an HTTPS Web server certificate.

From the previous tutorial, we learned that there is second root CA certificate "VeriSign Class 3 Public Primary Certification Authority (PCA3 G1 SHA1)" that can be used to validate "login.yahoo.com". If I delete "VeriSign Class 3 Public Primary Certification Authority (PCA3 G1 SHA1)" also from IE, what will happen?

1. Run IE as administrator, and go to the "Trusted Root Certificate Authorities" certificate store.

2. Go through the list of root CA certificates, and locate "Class 3 Public Primary Certification Authority certificate. You will see 3 entries.

3. Export all 3 entries of "Class 3 Public Primary Certification Authority" certificates to local files.

4. Remove all 3 entries of "Class 3 Public Primary Certification Authority" certificates.

5. Close and run IE again. Go to https://login.yahoo.com and wait for the log in page to be displayed.

6. Click the lock icon at the end of the Web address field and click the "View certificates" link.

7. Click the "Certificate Path" tab. I am surprised to see that IE validated "login.yahoo.com" certificate with the same certificate path:

VeriSign Class 3 Public Primary Certification Authority (PCA3 G1 SHA1)
 |- VeriSign Class 3 Public Primary Certification Authority - G5
     |- VeriSign Class 3 Secure Server CA - G3
        |- *.login.yahoo.com

8. Close the Certificate and go to the trusted root CA certificate area. I see that "Class 3 Public Primary Certification Authority" with a display name of "VeriSign Class 3 Public Primary Certification Authority (PCA3 G1 SHA1)" has been installed back in IE.