May 2020 Deployment Notice - Microsoft Trusted Root Program
On Tuesday, May 26th, 2020, Microsoft will release a planned update to the Microsoft Trusted Root Certificate Program.
This release will add the following roots (CA \ Root Certificate \ SHA-1 Thumbprint):
- Globalsign \ GlobalSign Code Signing Root E45 \ 79AA505EDD09B321E36D57910A5DF5A9FB85CC57
- Globalsign \ GlobalSign Client Authentication Root E45 \ A2BEE4AD032713ADCE0A0E9B19B6B85FC24ECA8D
- Globalsign \ GlobalSign Client Authentication Root R45 \ DC775C1C874F1BBF51099F6FB129DB99FF08EB52
- Globalsign \ GlobalSign Code Signing Root R45 \ 4EFC31460C619ECAE59C1BCE2C008036D94C84B8
- Globalsign \ GlobalSign Document Signing Root E45 \ CE71315DC098611F608C6CDECCEDC35D18D08548
- Globalsign \ GlobalSign Document Signing Root R45 \ 4F79DF635510276969E823C4B87F793B9748D3EA
- Globalsign \ GlobalSign Secure Mail Root E45 \ 182E1F324F89DFBEFE8889F093C2C4A02B677521
- Globalsign \ GlobalSign Secure Mail Root R45 \ 7618D1F380243D5240C6116AAD5777097D8130A0
- Globalsign \ GlobalSign Timestamping Root R45 \ 139B1C712FD17C3CA5DA6E5701AFBA0158F9D45D
Note
- Windows 10 allows us to stop trusting roots or EKU's using the "NotBefore" or "Disable" properties, both of which allow us to remove certain capabilities of the root certificate without complete removal. These features are not available on versions prior to Windows 10. Earlier versions of Windows will be unaffected by this change.
- The NotBefore and Disable dates are set for the first day of the release month. This means that all certificates issued after April 1st will be affected.
- The update package will be available for download and testing at: https://aka.ms/CTLDownload
- Signatures on the Certificate Trust Lists (CTLs) for the Microsoft Trusted Root Program changed from dual-signed (SHA-1/SHA-2) to SHA-2 only. No customer action required. For more information, please visit: https://support.microsoft.com/en-us/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus