SSL root certificates for Windows Phone OS 7.1

[ This article is for Windows Phone 8 developers. If you’re developing for Windows 10, see the latest documentation. ]

The following tables list all certificate authorities (CAs) and their root certificates that are pre-installed on a Windows Phone. Each table heading includes a CA name and a current country or region. This is the main country or region from which the CA operates. The CA name is the current operator of the root certificate, which includes a root name, a unique thumbprint, and a root expiration date. These tables are a snapshot of ownership, as the ownership of a CA root certificate can change over time.

Important Note:
The root certificates discussed here apply only to Windows Phone OS 7.1. In Windows Phone 8, the list of root certificates is identical to and automatically synced with the root certificates supported by Windows 8. For the full list of supported Windows Phone 8 root certificates, see Windows and Windows Phone 8 SSL Root Certificates.

The information provided about root certificates is reproduced to the best of Microsoft’s knowledge; its accuracy is not warranted or guaranteed in any way. To confirm actual root certificate details, go to a CA's website.

Note

The Windows Phone and CE Root Certificate Program is not the same as the Windows Root Certificate Program. For more info about how to apply to the Windows Phone and CE Root Certificate Program, send an email to medroot@microsoft.com.

This topic contains the following sections.

• Definitions
• AOL (United States)
• Comodo (United States)
• DigiCert (United States)
• Entrust (Canada)
• GlobalSign (United Kingdom)
• GoDaddy (United States)
• Keynectis (France)
• QuoVadis (Bermuda)
• RSA Security (United States)
• SECOM Trust Systems Co. Ltd (Japan)
• Taiwan-CA Inc. (Taiwan)
• TrustCenter (Germany)
• Trustwave (United States)
• VeriSign (United States)
• VeriSign Business (United States)
• Related Topics

Definitions

Term	Definition
CA Root Name	The common name applied to the root certificate, which might or might not also indicate the name of the CA.
CA Root Size	The modulus of the Rivest, Shamir, and Adleman (RSA) algorithm (typically 2048-bit or 4096-bit RSA). You might see references to other algorithms such as Elliptic Curve Cryptography (ECC) or Elliptic Curve Digital Signature Algorithm (ECDSA).
Signature Hash	The hash algorithm chosen by the CA for this root certificate – Message Digest Algorithm 2 (MD2), Message Digest Algorithm 5 (MD5), Secure Hash Algorithm 1 (SHA1), or SHA2 (SHA256). The hash algorithm used to issue end-use certificates might not be the same as the hash algorithm used for the root certificate.
CA Root Expires	The expiration date of the root certificate, after which the CA cannot issue any more end-use certificates from it. Root certificates are typically kept in distribution after expiration by the Windows Phone and CE Root Certificate Program until the last of these end-use certificates expire.
Thumbprint	The hash value which uniquely identifies the root certificate in question. It can be confirmed in the actual root certificate by examining the certificate properties under the Thumbprint field.

Back to Top

AOL (United States)

The following table lists the pre-installed SSL root certificates from AOL.

CA Root Name	CA Root Size	Signature Hash	CA Root Expires	Thumbprint
America Online Root Certification Authority 2	4096	SHA1	9/27/2037	85 b5 ff 67 9b 0c 79 96 1f c8 6e 44 22 00 46 13 db 17 92 84
America Online Root Certification Authority 1	2048	SHA1	11/19/2037	39 21 c1 15 c1 5d 0e ca 5c cb 5b c4 f0 7d 21 d8 05 0b 56 6a

Back to Top

Comodo (United States)

The following table lists the pre-installed SSL root certificates from Comodo.

CA Root Name	CA Root Size	Signature Hash	CA Root Expires	Thumbprint
COMODO RSA Certification Authority	4096	SHA1	11/18/2038	af e5 d2 44 a8 d1 19 42 30 ff 47 9f e2 f8 97 bb cd 7a 8c b4
USERTrust RSA Certification Authority	4096	SHA1	11/18/2038	2b 8f 1b 57 33 0d bb a2 d0 7a 6c 51 f7 0e e9 0d da b9 ad 8e
COMODO ECC Certification Authority	ECDSA384	SHA1	12/31/2028	9f 74 4e 9f 2b 4d ba ec 0f 31 2c 50 b6 56 3b 8e 2d 93 c3 11
USERTrust ECC Certification Authority	ECC secp384r1 (NIST P-384)	SHA1	1/18/2038	d1 cb ca 5d b2 d5 2a 7f 69 3b 67 4d e5 f0 5a 1d 0c 95 7d f0
UTN-USERFirst-Hardware	2048	SHA1	7/9/2019	04 83 ed 33 99 ac 36 08 05 87 22 ed bc 5e 46 00 e3 be f9 d7
UTN - DATACorp SGC	2048	SHA1	6/24/2019	58 11 9f 0e 12 82 87 ea 50 fd d9 87 45 6f 4f 78 dc fa d6 d4
AddTrust External CA Root	2048	SHA1	5/30/2020	02 fa f3 e2 91 43 54 68 60 78 57 69 4d f5 e4 5b 68 85 18 68

Back to Top

DigiCert (United States)

The following table lists the pre-installed SSL root certificates from DigiCert.

CA Root Name	CA Root Size	Signature Hash	CA Root Expires	Thumbprint
DigiCert Assured ID Root CA	2048	SHA1	11/9/2031	05 63 b8 63 0d 62 d7 5a bb c8 ab 1e 4b df b5 a8 99 b2 4d 43
DigiCert High Assurance EV Root CA	2048	SHA1	11/9/2031	5f b7 ee 06 33 e2 59 db ad 0c 4c 9a e6 d3 8f 1a 61 c7 dc 25
DigiCert Global Root CA	4096	SHA1	11/9/2031	a8 98 5d 3a 65 e5 e5 c4 b2 d7 d6 6d 40 c6 dd 2f b1 9c 54 36

Back to Top

Entrust (Canada)

The following table lists the pre-installed SSL root certificates from Entrust.

CA Root Name	CA Root Size	Signature Hash	CA Root Expires	Thumbprint
Entrust.net Certification Authority (2048)	2048	SHA1	12/24/2019	80 1d 62 d0 7b 44 9d 5c 5c 03 5c 98 ea 61 fa 44 3c 2a 58 fe

Back to Top

GlobalSign (United Kingdom)

The following table lists the pre-installed SSL root certificates from GlobalSign.

CA Root Name	CA Root Size	Signature Hash	CA Root Expires	Thumbprint
GlobalSign Root CA - R1	2048	SHA1	1/28/2028	b1 bc 96 8b d4 f4 9d 62 2a a8 9a 81 f2 15 01 52 a4 1d 82 9c
GlobalSign Root CA - R2	2048	SHA1	12/15/2021	75 e0 ab b6 13 85 12 27 1c 04 f8 5f dd de 38 e4 b7 24 2e fe
GlobalSign Root CA – R3	2048	SHA1	3/18/2029	d6 9b 56 11 48 f0 1c 77 c5 45 78 c1 09 26 df 5b 85 69 76 ad
GlobalSign Root CA	2048	SHA1	1/28/2014	2f 17 3f 7d e9 96 67 af a5 7a f8 0a a2 d1 b1 2f ac 83 03 38

Back to Top

GoDaddy (United States)

The following table lists the pre-installed SSL root certificates from GoDaddy.

CA Root Name	CA Root Size	Signature Hash	CA Root Expires	Thumbprint
Go Daddy Class 2 Certification Authority	2048	SHA1	6/29/2034	27 96 ba e6 3f 18 01 e2 77 26 1b a0 d7 77 70 02 8f 20 ee e4
ValiCert Class 2 Policy Validation Authority	1024	SHA1	6/25/2019	31 7a 2a d0 7f 2b 33 5e f5 a1 c3 4e 4b 57 e8 b7 d8 f1 fc a6
Starfield Class 2 Certification Authority	2048	SHA1	6/29/2034	ad 7e 1c 28 b0 64 ef 8f 60 03 40 20 14 c3 d0 e3 37 0e b5 8a

Back to Top

Keynectis (France)

The following table lists the pre-installed SSL root certificates from Keynectis.

CA Root Name	CA Root Size	Signature Hash	CA Root Expires	Thumbprint
KEYNECTIS ROOT CA	2048	SHA1	5/26/2020	9c 61 5c 4d 4d 85 10 3a 53 26 c2 4d ba ea e4 a2 d2 d5 cc 97
Class 2 Primary CA	2048	SHA1	7/7/2019	74 20 74 41 72 9c dd 92 ec 79 31 d8 23 10 8d c2 81 92 e2 bb

Back to Top

QuoVadis (Bermuda)

The following table lists the pre-installed SSL root certificates from QuoVadis.

CA Root Name	CA Root Size	Signature Hash	CA Root Expires	Thumbprint
QuoVadis Root Certification Authority	2048	SHA1	3/17/2021	de 3f 40 bd 50 93 d3 9b 6c 60 f6 da bc 07 62 01 00 89 76 c9
QuoVadis Root CA 2	4096	SHA1	11/24/2031	1f 49 14 f7 d8 74 95 1d dd ae 02 c0 be fd 3a 2d 82 75 51 85
QuoVadis Root CA 3	4096	SHA1	11/24/2031	1f 49 14 f7 d8 74 95 1d dd ae 02 c0 be fd 3a 2d 82 75 51 85

Back to Top

RSA Security (United States)

The following table lists the pre-installed SSL root certificates from RSA Security.

CA Root Name	CA Root Size	Signature Hash	CA Root Expires	Thumbprint
ValiCert Class 3 Policy Validation Authority	1024	SHA1	6/25/2019	69 bd 8c f4 9c d3 00 fb 59 2e 17 93 ca 55 6a f3 ec aa 35 fb

Back to Top

SECOM Trust Systems Co. Ltd (Japan)

The following table lists the pre-installed SSL root certificates from SECOM Trust Systems Co. Ltd.

CA Root Name	CA Root Size	Signature Hash	CA Root Expires	Thumbprint
Security Communication EV RootCA1	2048	SHA1	6/6/2037	fe b8 c4 32 dc f9 76 9a ce ae 3d d8 90 8f fd 28 86 65 86 65 64 7d
Security Communication RootCA1	2048	SHA1	9/30/2023	36 b1 2b 49 f9 81 9e d7 4c 9e bc 38 0f c6 56 8f 5d ac b2 f7
Security Communication RootCA2	2048	SHA256	5/29/2029	5f 3b 8c f2 f8 10 b3 7d 78 b4 ce ec 19 19 c3 73 34 b9 c7 74

Back to Top

Taiwan-CA Inc. (Taiwan)

The following table lists the pre-installed SSL root certificates from Taiwan-CA Inc. (TWCA).

CA Root Name	CA Root Size	Signature Hash	CA Root Expires	Thumbprint
TWCA Root Certification Authority	2048	SHA1	12/31/2030	cf 9e 87 6d d3 eb fc 42 26 97 a3 b5 a3 7a a0 76 a9 06 23 48

Back to Top

TrustCenter (Germany)

The following table lists the pre-installed SSL root certificates from TrustCenter (a company of Chosen Security).

CA Root Name	CA Root Size	Signature Hash	CA Root Expires	Thumbprint
TC TrustCenter Class 2 CA II	2048	SHA1	12/31/2025	ae 50 83 ed 7c f4 5c bc 8f 61 c6 21 fe 68 5d 79 42 21 15 6e
TC TrustCenter Universal CA I	2048	SHA1	12/31/2025	6b 2f 34 ad 89 58 be 62 fd b0 6b 5c ce bb 9d d9 4f 4e 39 f3
TC TrustCenter Universal CA III	2048	SHA1	12/31/2029	96 56 cd 7b 57 96 98 95 d0 e1 41 46 68 06 fb b8 c6 11 06 87

Back to Top

Trustwave (United States)

The following table lists the pre-installed SSL root certificates from Trustwave.

CA Root Name	CA Root Size	Signature Hash	CA Root Expires	Thumbprint
Secure Global CA	2048	SHA1	12/31/2029	3a 44 73 5a e5 81 90 1f 24 86 61 46 1e 3b 9c c4 5f f5 3a 1b
SecureTrust CA	2048	SHA1	12/31/2029	87 82 c6 c3 04 35 3b cf d2 96 92 d2 59 3e 7d 44 d9 34 ff 11
XRamp Global Certification Authority	2048	SHA1	1/01/2035	b8 01 86 d1 eb 9c 86 a5 41 04 cf 30 54 f3 4c 52 b7 e5 58 c6

Back to Top

VeriSign (United States)

The following table lists the pre-installed SSL root certificates from VeriSign.

CA Root Name	CA Root Size	Signature Hash	CA Root Expires	Thumbprint
VeriSign Class 3 PublicPrimary Certification Authority - G3	2048	SHA1	7/16/2036	13 2d 0d 45 53 4b 69 97 cd b2 d5 c3 39 e2 55 76 60 9b 5c c6
VeriSign Class 3 Public Primary Certification Authority - G5	2048	SHA1	7/16/2036	4e b6 d5 78 49 9b 1c cf 5f58 1e ad 56 be 3d 9b 67 44 a5 e5
Class 3 Public Primary Certification Authority - G2	1024	SHA1	8/1/2028	85 37 1c a6 e5 50 14 3d ce 28 03 47 1b de 3a 09 e8 f8 77 0f
Class 3 Public Primary Certification Authority	1024	SHA1	8/02/2028	a1 db 63 93 91 6f 17 e4 18 55 09 40 04 15 c7 02 40 b0 ae 6b
VeriSign Class 3 PublicPrimary Certification Authority - G4	ECDSA	SHA384	1/18/2038	22 d5 d8 df 8f 02 31 d1 8d f7 9d b7 cf 8a 2d 64 c9 3f 6c 3a
VeriSign Universal Root Certification Authority	2048	SHA256	12/1/2037	36 79 ca 35 66 87 72 30 4d 30 a5 fb 87 3b 0f a7 7b b7 0d 54
GeoTrust Global CA	2048	SHA1	5/20/2022	de 28 f4 a4 ff e5 b9 2f a3 c5 03 d1 a3 49 a7 f9 96 2a 82 12
GeoTrust Primary Certification Authority - G2	ECC384	ECDSA	1/18/2038	8d 17 84 d5 37 f3 03 7d ec 70 fe 57 8b 51 9a 99 e6 10 d7 b0
GeoTrust Primary Certification Authority - G3	2048	SHA256	12/01/2037	03 9e ed b8 0b e7 a0 3c 69 53 89 3b 20 d2 d9 32 3a 4c 2a fd
GeoTrust Primary Certification Authority	2048	SHA1	7/16/2036	32 3c 11 8e 1b f7 b8 b6 52 54 e2 e2 10 0d d6 02 90 37 f0 96
Thawte Primary Root CA	2048	SHA1	7/16/2036	91 c6 d6 ee 3e 8a c8 63 84 e5 48 c2 99 29 5c 75 6c 81 7b 81
Thawte Primary Root CA - G2	ECDSA	SHA384	1/18/2038	aa db bc 22 23 8f c4 01 a1 27 bb 38 dd f4 1d db 08 9e f0 12
Thawte Primary Root CA – G3	2048	SHA256	12/1/2037	f1 8b 53 8d 1b e9 03 b6 a6 f0 56 43 5b 17 15 89 ca f3 6b f2
Class 2 Public Primary Certification Authority	1024	MD2	8/1/2028	67 82 aa e0 ed ee e2 1a 58 39 d3 c0 cd 14 68 0a 4f 60 14 2a
Class 3 Public Primary Certification Authority	1024	MD2	8/1/2028	74 2c 31 92 e6 07 e4 24 eb 45 49 54 2b e1 bb c5 3e 61 74 e2
Equifax Secure Certificate Authority	1024	SHA1	8/22/2018	d2 32 09 ad 23 d3 14 23 21 74 e4 0d 7f 9d 62 13 97 86 63 3a
Thawte Premium Server CA	1024	MD5	12/31/2020	62 7f 8d 78 27 65 63 99 d2 7d 7f 90 44 c9 fe b3 f3 3e fa 9a
Thawte Server CA	1024	MD5	12/31/2020	23 e5 94 94 51 95 f2 41 48 03 b4 d5 64 d2 a3 a3 f5 d8 8b 8c

Back to Top

VeriSign Business (United States)

The following table lists the pre-installed SSL root certificates from VeriSign Business.

CA Root Name	CA Root Size	Signature Hash	CA Root Expires	Thumbprint
Baltimore CyberTrust Root	2048	SHA1	5/12/2025	d4 de 20 d0 5e 66 fc 53 fe 1a 50 88 2c 78 db 28 52 ca e4 74
GTE CyberTrust Global Root	1024	MD5	8/13/2018	97 81 79 50 d8 1c 96 70 cc 34 d8 09 cf 79 44 31 36 7e f4 74

Back to Top

See Also

Other Resources

Security for Windows Phone 8

Web service security for Windows Phone 8

How to encrypt data for Windows Phone 8