Untrusted root certificate for outlook.com mx server

Question

Untrusted root certificate for outlook.com mx server

Stanley Quinn 25

On April 15, 2026, Mozilla and Google Chrome removed DigiCert G1 roots from their trust stores. This was notified by DigiCert here:

https://docs.digicert.com/de/certcentral/order-and-manage-certificates/reports-and-advisories/review-the-g1-root-removal-advisory.html

Since Linux distributions typically source their root certificates from Mozilla, and since the outlook.com mx server tls certificates terminate at the DigiCert G1 certificate, this means tls connections to the outlook.com mx server are no longer trusted by software like Postfix.

Whilst most configurations will continue to deliver mail without trust, some configurations, particularly where mta-sts is enforced, will now refuse to deliver mail.

Please review "unable to get local issuer certificate" warnings in output below.

Are there any plans to update the tls certificate chain of trust for outlook-com.olc.protection.outlook.com to terminate at a newer root certificate?

debian@server:~$ dig outlook.com mx +short
5 outlook-com.olc.protection.outlook.com.

debian@server:~$ openssl s_client -starttls smtp -connect outlook-com.olc.protection.outlook.com:25 -servername outlook-com.olc.protection.outlook.com -verify_return_error
Connecting to 52.101.68.4
CONNECTED(00000003)
depth=1 C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1
verify error:num=20:unable to get local issuer certificate
20ED2F8FFFFF0000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:2125:
---
Certificate chain
 0 s:C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=mail.protection.outlook.com
   i:C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Aug 27 00:00:00 2025 GMT; NotAfter: Aug 26 23:59:59 2026 GMT
 1 s:C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1
   i:C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Sep 25 00:00:00 2020 GMT; NotAfter: Sep 24 23:59:59 2030 GMT
---
no peer certificate available
---
No client certificate CA names sent
Requested Signature Algorithms: RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA1:ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA1:DSA+SHA1:RSA+SHA512:ECDSA+SHA512
Shared Requested Signature Algorithms: RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:ECDSA+SHA256:ECDSA+SHA384:RSA+SHA512:ECDSA+SHA512
Peer Temp Key: ECDH, secp384r1, 384 bits
---
SSL handshake has read 4794 bytes and written 2047 bytes
Verification error: unable to get local issuer certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Protocol: TLSv1.3
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 20 (unable to get local issuer certificate)
---
20ED2F8FFFFF0000:error:0A000197:SSL routines:SSL_shutdown:shutdown while in init:../ssl/ssl_lib.c:2804:

Hornblower409 12,980 Reputation points

2026-06-21T02:25:50.87+00:00

I am not that knowledgeable about certificate chains. So please excuse me if I'm suggesting things you already know about.

Does this updated Microsoft 365 Root Certificate Chain Bundle have the new certs you need?

https://www.microsoft.com/en-us/download/details.aspx?id=102267

Anything about the removed DigiCert in the latest release notes?

https://learn.microsoft.com/en-us/security/trusted-root/

If no one else picks up on this question here, I would suggest you reach out to Microsoft Support directly with your Question.

Qualified MS 365 Subscription - Admin Only Support
https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-support

All others
https://support.microsoft.com/home/contact
Stanley Quinn 25 Reputation points

2026-06-21T05:45:04.0266667+00:00

Thank you for your reply. The resources appear to reference Microsoft root certificates rather than the DigiCert root which Microsoft is using for their mail MX server. I will attempt to contact Microsoft support as you suggested.
Kolatat Thangkasemvathana 5 Reputation points

2026-06-22T16:12:55.1366667+00:00

Confirming the same for MS365 tenant MX, not just the consumer endpoint. {tenant-name}.mail.protection.outlook.com presents the identical chain: leaf CN=mail.protection.outlook.com → DigiCert Cloud Services CA-1 → DigiCert Global Root CA (G1); failing with "Verify return code: 20 (unable to get local issuer certificate)" from OpenSSL on some Linux with an updated trust store.

As you note, it only breaks where verification is enforced (in our case DANE), where it affects mail to any EOP domain, not just outlook.com. +1 on the question: is there a timeline for rotating the MX certificates to the newer DigiCert Global Root G2 chain?
Hornblower409 12,980 Reputation points

2026-06-23T13:27:23.9866667+00:00

Just FYI - If you have not already seen it, there is a discussion about this in the Mozilla Security Policy mailing list. Search for mozilla.org Microsoft MX servers use certificate chaining to obsolete DigiCert Global Root CA

1 answer

Your answer

Hornblower409 12,980 Reputation points

2026-06-21T02:25:50.87+00:00

I am not that knowledgeable about certificate chains. So please excuse me if I'm suggesting things you already know about.

Does this updated Microsoft 365 Root Certificate Chain Bundle have the new certs you need?

https://www.microsoft.com/en-us/download/details.aspx?id=102267

Anything about the removed DigiCert in the latest release notes?

https://learn.microsoft.com/en-us/security/trusted-root/

If no one else picks up on this question here, I would suggest you reach out to Microsoft Support directly with your Question.

Qualified MS 365 Subscription - Admin Only Support
https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-support

All others
https://support.microsoft.com/home/contact
Stanley Quinn 25 Reputation points

2026-06-21T05:45:04.0266667+00:00

Thank you for your reply. The resources appear to reference Microsoft root certificates rather than the DigiCert root which Microsoft is using for their mail MX server. I will attempt to contact Microsoft support as you suggested.
Kolatat Thangkasemvathana 5 Reputation points

2026-06-22T16:12:55.1366667+00:00

Confirming the same for MS365 tenant MX, not just the consumer endpoint. {tenant-name}.mail.protection.outlook.com presents the identical chain: leaf CN=mail.protection.outlook.com → DigiCert Cloud Services CA-1 → DigiCert Global Root CA (G1); failing with "Verify return code: 20 (unable to get local issuer certificate)" from OpenSSL on some Linux with an updated trust store.

As you note, it only breaks where verification is enforced (in our case DANE), where it affects mail to any EOP domain, not just outlook.com. +1 on the question: is there a timeline for rotating the MX certificates to the newer DigiCert Global Root G2 chain?
Hornblower409 12,980 Reputation points

2026-06-23T13:27:23.9866667+00:00

Just FYI - If you have not already seen it, there is a discussion about this in the Mozilla Security Policy mailing list. Search for mozilla.org Microsoft MX servers use certificate chaining to obsolete DigiCert Global Root CA

Answer 1

Hornblower409 12,980

@Stanley Quinn and @Kolatat Thangkasemvathana

Again, this is way out of my area. All I can do is try to give you some leads.

I see a Microsoft Support article from the Exchange Team that I think is a related. You can try commenting on that:

Trust DigiCert Global Root G2 Certificate Authority to Avoid Exchange Online Email Disruption
https://techcommunity.microsoft.com/blog/exchange/trust-digicert-global-root-g2-certificate-authority-to-avoid-exchange-online-ema/4488311

And some Q&A post from Exchange users, who are advised that the migration to the DigiCert Global Root G2 and DigiCert Global Root G3 is automatic. Which obviously doesn't apply to you.

https://learn.microsoft.com/en-us/answers/questions/5818418/azure-managed-certificates

https://learn.microsoft.com/en-us/answers/questions/5698818/a-number-of-customer-are-reporting-ssl-certificate

I can't find any way for someone without a Microsoft Business Subscription to contact the right support team for this. The consumer support site ( https://support.microsoft.com/en-us/home/contact ) doesn't even have a product choice for something like this.

The only Q&A Tags I can find that might be related is the Exchange group:

User's image

If you don't have any way to reach Microsoft Business Support ( https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-support ), all I can suggest is that you repost under an Exchange Tag and reference the "April 2026 DigiCert Global Root CA (G1) industry distrust" and see if someone over there will pick it up. You can include a link to this post for reference.

Please put a link to any new Q&A post, or any other results you find, as a Comment on this thread for the next poor soul who comes here looking for an answer.

Stanley Quinn 25 Reputation points

2026-06-22T19:58:52.7666667+00:00

Thank you. Yes I did see Microsoft's post advising people to trust DigiCert Global Root G2, which my system and any up-to-date system will already trust. The problem is that Microsoft don't seem to have started signing their mx server certificates with that newer root, instead relying on the deprecated one.

Also, I wouldn't say it's technically an "Exchange" issue, as I'm seeing it when using my mail server to send to consumer "outlook.com" addresses.

As a workaround, I am able to import the deprecated "DigiCert Global Root CA" root into my server's trust store, until such time Microsoft updates their server's root certificate: https://knowledge.digicert.com/general-information/digicert-trusted-root-authority-certificates#otherroots

Anyway, I appreciate the help and hope this post finds the attention of someone at Microsoft.
Hornblower409 12,980 Reputation points

2026-06-22T20:34:23.4233333+00:00

@Stanley Quinn said

hope this post finds the attention of someone at Microsoft.

It won't. No one from Microsoft Support monitors this forum. That was why I suggested reposting with different Q&A tags. I suggested an Exchange tag because that may get the attention of an Exchange Forum moderator who might know how to raise this issue with the right Support team.
Stanley Quinn 25 Reputation points

2026-06-22T20:42:23.9666667+00:00

No one from Microsoft Support monitors this forum

Interesting. You can be sure that no one from Microsoft Support posts on the forum, but you can't possibly know that no one from there reads posts occasionally, unless you personally have access to logs.