Identrust EV certificate not working

Question

We have an Identrust EV code signing certificate that stopped working mid-June. Identrust says that is your issue. When will Microsoft update their certificate chain so that an Identrust EV certificate works again?

Answer 1

Same here, I implemented IdenTrust EV code signing at my company and they rug-pulled our EV code signing without any warning (not even an email). Now none of our customers can update our software. They are by far the worst code signing company - they've given us nothing but problems, and refuse to support automated code signing in our continuous integration.

Will be moving our company off of it and recommending everyone I know to do the same. Microsoft recently released Azure Artifact Signing which seems interesting.

Answer 2

Hi Stefani Warren

What’s happening is that Identrust shifted their PKI hierarchy earlier this year, and the new root chain didn’t line up with what Windows was trusting out of the box. That’s why your EV code signing cert suddenly stopped working mid‑June. Microsoft is rolling out a trust store update to include the new Identrust chain, and once that lands, your EV certs should validate again without any manual tweaks. In the meantime, some teams have worked around it by manually importing the updated Identrust root/intermediate certs into their local trust store, but I know that’s not ideal

The official update is scheduled to hit through Windows Update, so you’ll see it propagate automatically once it’s published. Keep an eye on your update logs, and after patching, try a quick signtool verify to confirm the chain resolves correctly.