Windows 7 UAC unknown publisher for new programs (2024)

Hi. I have windows 7 updated to latest legal patches (2020.01)
But when I try to install software that supports Windows 7, but with new certificate from 2023 or 2024 UAC shows me yellow warning "unknown publisher". What should I install to fix it? Preferrably offline.

- - - Updated - - -

i tried to install newest authroot.stl (from authroot.cab) but it didn't help.

For example I get "yellow UAC" on Sandboxie installer (certificate from 2024) or Nvcleaninstall (certificate from 2023)
In Exe proprieties there is: "Can't verify certificate" while they shows correct on Windows 10.

I found that KB931125 is something for XP and it is not on Update Catalog, but I found this:
Updating List of Trusted Root Certificates in Windows | Windows OS Hub
They write that on Windows 7 STL file should be converted to SST
When I was looking how to install I found working way here:
System Certificates Updater (The easy way) - Windows 9x/ME - MSFN
It should work also with Windows XP

This is what to do:
1.download files:

Code:

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authroots.sst
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/delroots.sst
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcert.sst
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/roots.sst
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/updroots.sst

2.download updroots.exe

Code:

download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/rootsupd.exe

Link not active - use Wayback Machine.
Attention! Check multiple versions! Some of them are not signed!
(for example files from 2003-2014 are signed while files from 2017 are not!)
Then extract with 7zip: updroots.exe (file always not signed)

3. Then run:

Code:

updroots authroots.sst
updroots updroots.sst
updroots -l roots.sst
updroots -d delroots.sst
updroots -l -u disallowedcert.sst

And new UAC cerificates works!

But one little problem:
This command not working

Code:

updroots -l -u disallowedcert.sst

Option -u is not recognised, can I skip disallowedcert.sst, or it is something important for security?

Btw. Also here someone make certificates pack for old Windows & Android versions:
GitHub - JohnTHaller/RootCertificateUpdatesForLegacyWindows: Root certificate updates for Windows Vista, XP, and 2000
But this is unofficial package.

- - - Updated - - -

Ok. KB931125 should also be something to rootsupdate but can't find it.

The correct file for me was updroots.exe extracted with 7-zip from rvkroots.exe

Code:

https://catalog.s.download.windowsupdate.com/d/msdownload/update/software/secu/2015/03/rvkroots_3f2ce4676450c06f109b5b4e68bec252873ccc21.exe

SHA256: 185e4ecadf0f866f6cb2dc56da13d81788bdf65f5387a90c6cfbc38a6c70d678
(this is update for Server 2003 also called KB3050995)

updroots.exe was from 2014-12-18, version 5.2.3790.4456
SHA1: 466a138fa11e829afb3af35df8b0ca73d5083640
SHA256: 9e538a58aed94a7748df9262ae0343dea9efce8d9117e0868eb404e1098747b6

And this file has described -u option in help window.