Fully updated 2011-09-20 12:07 PROBLEM #1/2 - FIXED KB2616676 for XP and W2k3 did not blacklist the mostly used certificates with numbers (7) through (11) described below. Last night (2011-09-19) Microsoft issued an update to correct this. PROBLEM #2/2 - NOT YET FIXED (MAY AFFECT DUCTH GOVERNMENTAL AND HEALTHCARE PC's) Microsoft may have initially distributed two additional "DigiNotar Root CA" certificates somewhere between 2005 and May 2007 that have not been rendered untrusted by any of the current Microsoft updates. Furthermore, these certificates may have been included in various software packages. One or both of these root certificates may still be present in the Windows certificate store. If so, they pose a risk! I found these certificates by downloading the file "rootsupd.exe" indirectly from "Update for Root Certificates [March 2011] (KB931125)" and unpacking it: among others, it contains a file called "delroots.sst" which includes the two old "DigiNotar Root CA" certificates, listed as numbers 12 ...