Version 5.0.0 is a complete rewrite.
Previous versions relied on .NET Framework. This version requires zero dependencies. It is now a single self-contained executable built from Python that fetches Microsoft's current certificate trust lists at runtime and writes them directly to the Windows registry. No .NET, no certutil, no updroots, and no Windows Update required.
How it works
- Downloads authrootstl.cab and disallowedcertstl.cab from Microsoft's CDN
- Parses the PKCS#7/CTL structure directly with no third-party libraries
- Downloads each trusted root certificate in parallel (16 threads)
- Writes certificates directly to HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates
- Removes any disallowed certificates from the trusted root store
- Writes a log to %TEMP%\UpdateRootCertificates.log
Compatibility
Works on Windows XP through Windows 11 with a single binary.
Usage
Place the executable on a flash drive, network share, FTP location, or other accessible path, then launch it on the target machine.
UpdateRootCertificates.exe
UpdateRootCertificates.exe --verboseA reboot is required for changes to take full effect.