10 minutes · the invisible one

Fix certificate trust

A compromised root can survive in non-browser trust stores long after browsers block it. Update every store your code actually uses.

4 steps15 minno tools required

The procedure

Step 01 · 2 min
Update the Python bundle
certifi is vendored. pip install --upgrade certifi is the whole fix.
Step 02 · 5 min
Update Windows and restart
Root distrust ships through Windows Update, and it often needs a restart to take effect.
Step 03 · 3 min
Check Java and Node separately
Java has its own cacerts. Node bundles its own roots. Neither follows the Windows store automatically.
Step 04 · 5 min
Search your projects for pinned CA files
A vendored cacert.pem in a repository will not update itself. Replace it with a runtime-loaded bundle.

Command

rg -l "BEGIN CERTIFICATE" --glob "*.pem" --glob "*.crt"

Read it before running it. Every command in this repository is a plain shell command, not a downloaded script.