April 2020 Deployment Notice: Microsoft Trusted Root Program

Due to the COVID-19 pandemic, the Microsoft Trusted Root Program will be making modifications to the change calendar. While April is generally a deprecation month, we will not be completing any deprecations of roots or EKUs that are not urgent and critical. Microsoft will continue to make additive changes to new and existing roots in the program. The month of May will not have any deprecations, per the regular monthly cadence.

We announced at the recent CA/Browser Forum face to face meeting that the root program would be removing the Code Signing EKU and IPSec EKUs from any CAs that haven’t provided current audits. Given the current situation, we have decided to delay this deprecation until the June 2020 release, when these removals will be re-evaluated.