November 2023 Deployment Notice - Microsoft Trusted Root Program

  • Article

On Tuesday, November 28, 2023, Microsoft released an update to the Microsoft Trusted Root Certificate Program.

This release will add the following roots (CA \ Root Certificate \ SHA-1 Thumbprint):

  1. Altron(Lawtrust) // LAWtrust Root CA2 (4096) // eca2d530a9ab2c7d0e7561644e0ae016a154387d
  2. Atos // Atos TrustedRoot Root CA RSA TLS 2021 // 18523b0d0637e4d63adf23e498fb5b16fb867448
  3. Atos // Atos TrustedRoot Root CA ECC G2 2020 // 612556da6294e5aeb33cf811bdb1dcf8a5d8b3e4
  4. Atos // Atos TrustedRoot Root CA ECC TLS 2021 // 9ebc751042b302f381f4f73062d48fc3a751b2dd
  5. Atos // Atos TrustedRoot Root CA RSA G2 2020 // 32d127fa93b1c14c99e24a40bc7f94411b5aaca4
  6. A-Trust // A-Trust-Root-09 // D05849DE4004DA6E867DEE000671CDA8F423266F
  7. Deutsche Telekom Security GmbH // Telekom Security TLS ECC Root 2020 // c0f896c5a93b01062107da184248bce99d88d5ec
  8. Deutsche Telekom Security GmbH // Telekom Security SMIME ECC Root 2021 // b7f91d98ec2593f35014849aa87e22103cc43927
  9. Deutsche Telekom Security GmbH // Telekom Security SMIME RSA Root 2023 // 893f6f1ce24d7ffbc3d3147a0580a7dee10a5e4d
  10. Deutsche Telekom Security GmbH // Telekom Security TLS RSA Root 2023 // 54d3acb3bd5756f6859dcee5c321e2d4ad83d093
  11. Entrust // Entrust 4K EV TLS Root CA - 2022 // EADB0AB9DC7938021435FED13E488406A1AA292A
  12. Entrust // Entrust P384 TLS Root CA // 424AAE6D0C8C7624817CDB9CCB510DED6232191D
  13. Entrust // Entrust 4K TLS Root CA - 2022 // 193C2A76F8CADD84F35BF52EE7AA506657917A38
  14. Entrust // Entrust P384 EV TLS Root CA - 2022 // 1E6C44DC6473D4819BE89FB237AF4883FC376987
  15. Entrust // Entrust SMIME Root CA - 2022 // B8B1C5AAC29BEDF0AD71B2F14BFEAA38F817535E
  16. Entrust // Entrust Digital Signing Root Certification Authority - DSR1 // 104FE73700186E692E78A0156A3F9ED807B0608E
  17. Entrust // AffirmTrust 4K TLS Root CA - 2022 // 2E03931CD19C3FF5985FB87AADC153EB5DBDF1E3
  18. Government of Korea, KLID(Ministry of the Interior and Safety) // MOIS SSL Root CA // 65f9901c549c9bec6bf422b7fd8ee382f626186b
  19. SSL.com // SSL.com Client RSA Root CA 2022 // aa5970e520329fcbd0d5799ffb1b821dfd1f7965
  20. SSL.com // SSL.com Client ECC Root CA 2022 // 807b1d9d65723dc756f9ecc5008349f6f2acf486
  21. SSL.com // SSL.com Code Signing RSA Root CA 2022 // d4695284cd1798d9cb1699464c064994c4e2bbfd
  22. SSL.com // SSL.com Code Signing ECC Root CA 2022 // 0d9e9ab20765a89ed9cd8df2c7a63bc77495ef31
  23. SSL.com // SSL.com Document Signing RSA Root CA 2022 // 2f686dc8d4e39553ed32938e6357133bb7d9910c
  24. SSL.com // SSL.com Document Signing ECC Root CA 2022 // 3cc1a683ffe66836491af36be1d3fe0a37f59dae
  25. SSL.com // SSL.com TLS RSA Root CA 2022 // ec2c834072af269510ff0ef203ee3170f6789dca
  26. SSL.com // SSL.com TLS ECC Root CA 2022 // 9f5fd91a546df50c71f0ee7abd1749988473e239
  27. SwissSign AG // SwissSign RSA TLS Root CA 2022 – 1 // 193144F431E0FDDB740717D4DE926A571133884B4360D30E272913CBE660CE41
  28. SwissSign AG // SwissSign RSA SMIME Root CA 2022 - 1 // 9A12C392BFE57891A0C545309D4D9FD567E480CB613D6342278B195C79A7931F
  29. TAIWAN-CA (TWCA) // TWCA CYBER Root CA // f6b11c1a8338e97bdbb3a8c83324e02d9c7f2666
  30. TAIWAN-CA (TWCA) // TWCA Global Root CA G2 // 73fe922f836391ffc8c6c4dad6202f6b072e7f1b

This release will modify from the following roots (CA \ Root Certificate \ SHA-1 Thumbprint):

  1. GlobalSign // GlobalSign Root R46 // 4FA3126D8D3A11D1C4855A4F807CBAD6CF919D3A5A88B03BEA2C6372D93C40C9
  2. GlobalSign // GlobalSign Root E46 // CBB9C44D84B8043E1050EA31A69F514955D7BFD2E2C6B49301019AD61D9F5058
  3. GlobalSign // GlobalSign Secure Mail Root R45 // 319AF0A7729E6F89269C131EA6A3A16FCD86389FDCAB3C47A4A675C161A3F974
  4. GlobalSign // GlobalSign Secure Mail Root E45 // 5CBF6FB81FD417EA4128CD6F8172A3C9402094F74AB2ED3A06B4405D04F30B19

Note

  • As part of this release, Microsoft also updated the Untrusted CTL time stamp and sequence number. No changes were made to the contents of the Untrusted CTL but this will cause your system to download/refresh the Untrusted CTL. This is a normal update that is sometimes done when the Trusted Root CTL is updated.
  • The update package will be available for download and testing at: https://aka.ms/CTLDownload
  • Signatures on the Certificate Trust Lists (CTLs) for the Microsoft Trusted Root Program changed from dual-signed (SHA-1/SHA-2) to SHA-2 only. No customer action required. For more information, please visit: https://support.microsoft.com/en-us/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus