Share via

February 2023 Deployment Notice - Microsoft Trusted Root Program

  • Article

On Tuesday, February 28, 2023, Microsoft released an update to the Microsoft Trusted Root Certificate Program.

This release will Disallow Server Authentication to the following roots (CA \ Root Certificate \ SHA-1 Thumbprint):

  1. TrustCor Systems // TrustCor ECA-1 // 58D1DF9595676B63C0F05B1C174D8B840BC878BD
  2. TrustCor Systems // TrustCor RootCert CA-1 // FFBDCDE782C8435E3C6F26865CCAA83A455BC30A
  3. TrustCor Systems // TrustCor RootCert CA-2 // B8BE6DCB56F155B963D412CA4E0634C794B21CC0

This release will Disable the following roots (CA \ Root Certificate \ SHA-1 Thumbprint):

  1. DATEV eG // CA DATEV BT 02 // 39410BC2303748066069A72A664DE4C743481296
  2. DATEV eG // CA DATEV INT 02 // 93F7F48B1261943F6A78210C52E626DFBFBBE260
  3. DATEV eG // CA DATEV STD 02 // AB9D58C03F54B1DAE3F7C2D4C6C1EC3694559C37
  4. Deutsche Telekom Security GmbH // Deutsche Telekom Root CA 2 // 85A408C09C193E5D51587DCDD61330FD8CDE37BF
  5. DigiCert // VeriSign Class 3 Public Primary Certification Authority - G4 // 22D5D8DF8F0231D18DF79DB7CF8A2D64C93F6C3A
  6. DigiCert // GeoTrust Universal CA 2 // 379A197B418545350CA60369F33C2EAF474F2079
  7. DigiCert // Symantec Class 3 Public Primary Certification Authority - G4 // 58D52DB93301A4FD291A8C9645A08FEE7F529282
  8. DigiCert // Symantec Class 2 Public Primary Certification Authority - G4 // 6724902E4801B02296401046B4B1672CA975FD2B
  9. DigiCert // Symantec Class 1 Public Primary Certification Authority - G4 // 84F2E3DD83133EA91D19527F02D729BFC15FE667
  10. DigiCert // thawte // BE36A4562FB2EE05DBB3D32323ADF445084ED656
  11. DigiCert // Cybertrust Global Root // 5F43E5B1BFF8788CAC1CC7CA4A9AC6222BCC34C6
  12. DigiCert // GeoTrust Global CA // DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212
  13. DocuSign (OpenTrust/Keynectis) // CertPlus Class 2 Primary CA // 74207441729CDD92EC7931D823108DC28192E2BB
  14. EDICOM // EDICOM // E0B4322EB2F6A568B654538448184A5036874384
  15. Google Trust Services LLC // Google Trust Services - GlobalSign Root CA-R2 // 75E0ABB6138512271C04F85FDDDE38E4B7242EFE
  16. Government of The Netherlands, PKIoverheid (Logius) // Staat der Nederlanden Root CA - G2 // 59AF82799186C7B47507CBCF035746EB04DDB716
  17. IdenTrust Services, LLC // DST Root CA X3 // DAC9024F54D8F6DF94935FB1732638CA6AD77C13
  18. Japan Local Authority Information Systems (J-LIS) // Application CA G4 Root // 21DACE4C2C34E66468EE06314DB055A0A89D4C1D
  19. Macao Post and Telecommunications Bureau // Macao Post eSign Trust // 06143151E02B45DDBADD5D8E56530DAAE328CF90
  20. NETLOCK Kft. // NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado // 016897E1A0B8F2C3B134665C20A727B7A158E28F
  21. Netrust Pte Ltd // Netrust CA1 // 55C86F7414AC8BDD6814F4D86AF15F3710E104D0
  22. Post of Slovenia // POSTarCA // B1EAC3E5B82476E9D50B1EC67D2CC11E12E0B491
  23. QuoVadis // QuoVadis Root Certification Authority // DE3F40BD5093D39B6C60F6DABC076201008976C9
  24. Sectigo // Sectigo (UTN Client) // B172B1A56D95F91FE50287E14D37EA6A4463768A
  25. Sectigo // Sectigo (AddTrust) // 02FAF3E291435468607857694DF5E45B68851868
  26. Sectigo // Sectigo (UTN Object) // E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46
  27. Telia Company // Sonera Class2 CA // 37F76DE6077C90C5B13E931AB74110B4F2E49A27
  28. Visa // Visa eCommerce Root // 70179B868C00A4FA609152223F9F3E32BDE00562

This release will NotBefore the following roots (CA \ Root Certificate \ SHA-1 Thumbprint):

  1. AC Camerfirma, S.A. // Chambersign Global Root // 339B6B1450249B557A01877284D9E02FC3D2D8E9
  2. Carillon Information Security Inc. // Carillon Information Security Inc. // A69E0336C4E59023FF653C71F928EB73F21C00F0
  3. DATEV eG // CA DATEV STD 03 // 27EED22AFD58A2C64A855E3680AF898BF36CE503
  4. DATEV eG // CA DATEV BT 03 // 3DB66DFEBEB6712889E7C098B32805896B6218CC
  5. DATEV eG // CA DATEV INT 03 // 924AEA47F73CB690565E552CFCC6E8D63EEE4242
  6. Digicert // GeoTrust Universal CA // E621F3354379059A4B68309D8A2F74221587EC79
  7. Government of Taiwan, Government Root Certification Authority (GRCA) // TW Government Root Certification Authority 2 // B091AA913847F313D727BCEFC8179F086F3A8C0F
  8. Government of Taiwan, Government Root Certification Authority (GRCA) // TW Government Root Certification Authority // F48B11BFDEABBE94542071E641DE6BBE882B40B9
  9. Network Solutions // Network Solutions ECC Certificate Authority // 80F95B741C38399495C34F20C23E7336314D3C6B
  10. Network Solutions // Network Solutions RSA Certificate Authority // 8E928C0FC27BB7ABA34E6BC0CA1250CB57B60F84
  11. Network Solutions // Network Solutions // 71899A67BF33AF31BEFDC071F8F733B183856332
  12. SwissSign AG // SwissSign Platinum CA - G2 // 56E0FAC03B8F18235518E5D311CAE8C24331AB66

This release will NotBefore Code Signing EKU for the following roots (CA \ Root Certificate \ SHA-1 Thumbprint):

  1. Entrust // Entrust // B31EB1B740E36C8402DADC37D44DF5D4674952F9

This release will NotBefore Server Authentication EKU for the following roots (CA \ Root Certificate \ SHA-1 Thumbprint):

  1. Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) // Agencia Catalana de Certificacio (NIF Q-0801176-I) // 28903A635B5280FAE6774C0B6DA7D6BAA64AF2E8

This release will Remove the following roots (CA \ Root Certificate \ SHA-1 Thumbprint):

  1. Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) // Fabrica Nacional de Moneda y Timbre // 43F9B110D5BAFD48225231B0D0082B372FEF9A54
  2. Government of The Netherlands, PKIoverheid (Logius) // Staat der Nederlanden EV Root CA // 76E27EC14FDB82C1C0A675B505BE3D29B4EDDBBB

This release will Remove EV SSL from the following roots (CA \ Root Certificate \ SHA-1 Thumbprint): 1.AC Camerfirma, S.A. // GLOBAL CHAMBERSIGN ROOT - 2016 // 1139A49E8484AAF2D90D985EC4741A65DD5D94E2 2. AC Camerfirma, S.A. // Chambers of Commerce Root - 2008 // 786A74AC76AB147F9C6A3050BA9EA87EFE9ACE3C 3. AC Camerfirma, S.A. // CHAMBERS OF COMMERCE ROOT - 2016 // 2DE16A5677BACA39E1D68C30DCB14ABE22A6179B 4. Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) // Agencia Catalana de Certificacio (NIF Q-0801176-I) // 28903A635B5280FAE6774C0B6DA7D6BAA64AF2E8

This release will Remove EV CS from the following roots (CA \ Root Certificate \ SHA-1 Thumbprint): 1.Entrust // Entrust // B31EB1B740E36C8402DADC37D44DF5D4674952F9 2. AC Camerfirma, S.A. // CHAMBERS OF COMMERCE ROOT - 2016 // 2DE16A5677BACA39E1D68C30DCB14ABE22A6179B

Note

  • As part of this release, Microsoft also updated the Untrusted CTL time stamp and sequence number. No changes were made to the contents of the Untrusted CTL but this will cause your system to download/refresh the Untrusted CTL. This is a normal update that is sometimes done when the Trusted Root CTL is updated.
  • The update package will be available for download and testing at: https://aka.ms/CTLDownload
  • Signatures on the Certificate Trust Lists (CTLs) for the Microsoft Trusted Root Program changed from dual-signed (SHA-1/SHA-2) to SHA-2 only. No customer action required. For more information, please visit: https://support.microsoft.com/en-us/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus