Trusted Root Certification Authorities and Third-Party Root Certification Authorities only show me a couple dozen roots each, https://snag.gy/pLwe3q.jpg where https://hexatomium.github.io/2016/10/11/unannounced-root-cer... says that Microsoft trusts 356 roots total, a list being here: http://social.technet.microsoft.com/wiki/contents/articles/3...

Most notably for me, the list doesn't show any of the foreign roots, Agencia Notarial de Certificación, Autoridad Certificadora Raíz Nacional de Uruguay, etc. Are they kept anywhere else?

EDIT: According to the author, Manage Computer Certificates will only show you that a trusted root exists after you've used it. Trusted roots that you've never used are invisible: http://hexatomium.github.io/2015/08/29/why-is-windows/

The test he provides still works: "OpenTrust Root CA G3" won't show up in Manage Computer Certificates until you visit https://www.opentrust.com/

So, Manage Computer Certificates is useless for untrusting roots Microsoft trusts for you.

Did not know that, thanks for the additional information.

One additional note, most applications in Windows by proxy follow this OS level list of trusted certificates. Notable exceptions are Java and Firefox which maintain their own CA repositories in their installations.

This is the reason I hate JVM from sysadmin/devops perspective. It tries to manage things that should be left to OS (CAs, fonts, time, etc.). It's not too big of a problem for end user applications with package manager maintained JVM, but if you want to use JVM for any kind of daemon (application server, database, messaging system) your sysadmin has to become jvmadmin too. It would not be such a bad thing if you really, really wanted to manage system per application if there was "fallback to OS" option. But then again moderately sized applications have been run in their own virtual machines for quite some time and these days containers are pretty prevalent solution for self containing even small applications.