Windows doesn&#x27;t use the certificate store for windows updates. Installing a root CA does not allow you to provide windows updates because I believe they hardcode the cert in the updater.<p>Other non-windows updates do allow you to install other software.<p>To set this up, Kazakhstan will have to set up their CA with the bit set for software signing. This bit will be visible by everyone and it&#x27;ll be very telling instead of just being allowed as a root CA for ssl&#x2F;https sites.