March 2019 Deployment Notice (13/March) - Microsoft Trusted Root Program

  • Article

On Tuesday, March 26th, 2019, Microsoft will release a planned update to the Microsoft Trusted Root Certificate Program.

This release will add the following roots (Root Certificate \ SHA-1 Thumbprint):

  1. RCSC RootCA \ FDE7C6FDB32BB8E63939840D6AE052C3D8B73B87
  2. Autoridade Certificadora Raiz Brasileira v5 \ 4ACADAB14B74BF4FBA7BACE64B91801C44B8CC66
  3. NAVER Global Root Certification Authority \ 8F6BF2A9274ADA14A0C4F48E6127F9C01E785DD1

This release will modify the EV OID for the following roots:

  1. NetLock Arany (Class Gold) Főtanúsítvány \ 06083F593F15A104A069A46BA903D006B7970991

This release will modify the friendly name for the following roots:

  1. COMODO CA \ D1EB23A46D17D68FD92564C2F1F1601764D8E349
  2. The USERTrust Network™ \ 02FAF3E291435468607857694DF5E45B68851868
  3. COMODO Certification Authority \ EE869387FFFD8349AB5AD14322588789A457B012
  4. COMODO \ 9F744E9F2B4DBAEC0F312C50B6563B8E2D93C311
  5. COMODO SECURE™ \ AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4
  6. USERTrust \ D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0
  7. USERTrust Secure™ \ 2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E
  8. USERTrust (Client Authentication / Secure Email) \ B172B1A56D95F91FE50287E14D37EA6A4463768A
  9. USERTrust CA \ 0483ED3399AC3608058722EDBC5E4600E3BEF9D7
  10. USERTrust (Code Signing) \ E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46

This release will modify the CA name for the following roots:

  1. Posta CA Root \ D6BF7994F42BE5FA29DA0BD7587B591F47A44F22

Windows 10 allows us to stop trusting roots or EKU's using the "NotBefore" or "Disable" properties, both of which allow us to remove certain capabilities of the root certificate without complete removal. These features are not available on versions prior to Windows 10. Earlier versions of Windows will be unaffected by this change. The update package will be available for download and testing at https://aka.ms/CTLDownload