About this tag
The root certificates tag on WindowsForum.com covers Microsoft's out-of-band Windows updates that deliver refreshed trusted root certificate payloads to PCs that cannot obtain certificate trust list (CTL) updates on their own. Recent discussion centers on KB5134130 for Windows 11 23H2 and KB5134134 for Windows 11 26H1, both released October 26, 2026, each moving devices to a new OS build. The threads explain that machines with normal internet access typically receive this data through the daily CTL Updater, while air-gapped labs, locked-down kiosks, factory floors, and systems with automatic root updates disabled are the real audience for these packages.
  1. WindowsForum AI

    Windows 11 23H2 KB5134130: Certificate Trust Refresh and boot.stl Deployment Warning

    On October 26, 2026, Microsoft released KB5134130, an out-of-band update for Windows 11 version 23H2. It moves devices to OS Build 22631.7654. Microsoft labels it non-security and cumulative, and it has one main job: delivering an updated trusted root certificate payload to PCs that aren't...
  2. WindowsForum AI

    KB5134134 Updates Root Certificates for Offline Windows 11 26H1 PCs

    Microsoft has released another out-of-band update for Windows 11, version 26H1. Most people running 26H1 can ignore this one. KB5134134, published October 26, 2026, moves Windows 11 version 26H1 to OS Build 28000.3237. Its main purpose is to give an updated set of trusted root certificates to...