I have not looked for an online tool, but you can download sigcheck [1] and run `sigcheck -tv` which will display &quot;valid certificates not rooted to the Microsoft Certificate Trust List&quot;.<p>[1] <a href="https:&#x2F;&#x2F;technet.microsoft.com&#x2F;en-us&#x2F;sysinternals&#x2F;bb897441" rel="nofollow">https:&#x2F;&#x2F;technet.microsoft.com&#x2F;en-us&#x2F;sysinternals&#x2F;bb897441</a>