Is XP "certificate update" required?

[benali72]

On one Windows XP system, I got a message that updates to the "certificates" were "required," so I updated them. (This was part of the normal Automatic Updates deal).

I have another XP system that has had updates turned off for some time. The reason is that one update failed, so I recovered the system and turned off updates.

My question is: will the second XP system continue to operate ok if it does not get the "required" certificate updates?

Thank you, Windows experts!

[The Gorn]

I've never seen this message before about certificates from Windows Update.

As far as I know, "DRM" in Windows XP only applies to initial activation of the OS. Once the OS is activated on the hardware in question, it should not deactivate by itself or upon a signal or timeout related to an outside provider. In other words Windows XP should not need to be pinged periodically in order to keep running.

The only "DRM" style restriction that I know about in Windows XP is that the OS may be detected as being "Genuine Windows" or not. If it fails this test, which as far as I know is related to tracking of bootlegged site licenses and the like, then further Windows Updates  cannot be automatically applied via the Windows Update system.

[benali72]

Thanks, Gorn, for your feedback.

I was able to find out more about what I'm facing. It's a Root Certificate update.

Here's a good explanatory article I finally located on this --

http://ask-leo.com/what_are_root_certificates_and_why_do_i_need_to_update_them.html

and another one --

http://netsekure.org/2011/04/automatic-ca-root-certificate-updates-on-windows/

Funny thing is, even after all that it's not really clear to me that I have to have these updates!

Fortunately this article tells how to update the root certificates WITHOUT having to have MS Updates do it for you --
http://www.mazecomputer.com/sxs/help/rootcert.htm

I'll try that last option. I'll tell you how it goes later this week.
Thanks.

[The Gorn]

"Doh!" Ok. That makes sense.

So this is not a Windows-ownership-validation thing or a license validity check. This is to keep Windows in sync with certificate authorities for SSL, etc.

You should probably have these updates, if only for the reason that you may connect to a secure web site at some time and Internet Explorer gives you warnings because the certificate authority is not recognized. Maybe it is also related to successful Windows Update operation.

This probably has no day to day bearing on you if you use Firefox or another alternative browser with its own SSL support. But it's a good idea to get this updated if possible.

[DarkHumour]

I didn't read those links but as the image master for 1000+ workstations I constantly track all the updates for XP when compiling a new build.  I believe some certificate authorities got hacked or compromised and were putting out fake certificates.  I think this update/patch fixes that problem...until someone else gets hacked...