2023 年 2 月部署通知 - Microsoft 受信任根计划
2023 年 2 月 28 日星期二,Microsoft 发布了对 Microsoft 受信任根证书计划的计划内更新。
此版本将为以下根(CA \ 根证书 \ SHA-1 指纹)禁用服务器身份验证:
- TrustCor Systems // TrustCor ECA-1 // 58D1DF9595676B63C0F05B1C174D8B840BC878BD
- TrustCor Systems // TrustCor RootCert CA-1 // FFBDCDE782C8435E3C6F26865CCAA83A455BC30A
- TrustCor Systems // TrustCor RootCert CA-2 // B8BE6DCB56F155B963D412CA4E0634C794B21CC0
此版本将禁用以下根(CA \ 根证书 \ SHA-1 指纹):
- DATEV eG // CA DATEV BT 02 // 39410BC2303748066069A72A664DE4C743481296
- DATEV eG // CA DATEV INT 02 // 93F7F48B1261943F6A78210C52E626DFBFBBE260
- DATEV eG // CA DATEV STD 02 // AB9D58C03F54B1DAE3F7C2D4C6C1EC3694559C37
- Deutsche Telekom Security GmbH // Deutsche Telekom Root CA 2 // 85A408C09C193E5D51587DCDD61330FD8CDE37BF
- DigiCert // VeriSign Class 3 Public Primary Certification Authority - G4 // 22D5D8DF8F0231D18DF79DB7CF8A2D64C93F6C3A
- DigiCert // GeoTrust Universal CA 2 // 379A197B418545350CA60369F33C2EAF474F2079
- DigiCert // Symantec Class 3 Public Primary Certification Authority - G4 // 58D52DB93301A4FD291A8C9645A08FEE7F529282
- DigiCert // Symantec Class 2 Public Primary Certification Authority - G4 // 6724902E4801B02296401046B4B1672CA975FD2B
- DigiCert // Symantec Class 1 Public Primary Certification Authority - G4 // 84F2E3DD83133EA91D19527F02D729BFC15FE667
- DigiCert // thawte // BE36A4562FB2EE05DBB3D32323ADF445084ED656
- DigiCert // Cybertrust Global Root // 5F43E5B1BFF8788CAC1CC7CA4A9AC6222BCC34C6
- DigiCert // GeoTrust Global CA // DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212
- DocuSign (OpenTrust/Keynectis) // CertPlus Class 2 Primary CA // 74207441729CDD92EC7931D823108DC28192E2BB
- EDICOM // EDICOM // E0B4322EB2F6A568B654538448184A5036874384
- Google Trust Services LLC // Google Trust Services - GlobalSign Root CA-R2 // 75E0ABB6138512271C04F85FDDDE38E4B7242EFE
- Government of The Netherlands, PKIoverheid (Logius) // Staat der Nederlanden Root CA - G2 // 59AF82799186C7B47507CBCF035746EB04DDB716
- IdenTrust Services, LLC // DST Root CA X3 // DAC9024F54D8F6DF94935FB1732638CA6AD77C13
- Japan Local Authority Information Systems (J-LIS) // Application CA G4 Root // 21DACE4C2C34E66468EE06314DB055A0A89D4C1D
- Macao Post and Telecommunications Bureau // Macao Post eSign Trust // 06143151E02B45DDBADD5D8E56530DAAE328CF90
- NETLOCK Kft. // NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado // 016897E1A0B8F2C3B134665C20A727B7A158E28F
- Netrust Pte Ltd // Netrust CA1 // 55C86F7414AC8BDD6814F4D86AF15F3710E104D0
- Post of Slovenia // POSTarCA // B1EAC3E5B82476E9D50B1EC67D2CC11E12E0B491
- QuoVadis // QuoVadis Root Certification Authority // DE3F40BD5093D39B6C60F6DABC076201008976C9
- Sectigo // Sectigo (UTN Client) // B172B1A56D95F91FE50287E14D37EA6A4463768A
- Sectigo // Sectigo (AddTrust) // 02FAF3E291435468607857694DF5E45B68851868
- Sectigo // Sectigo (UTN Object) // E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46
- Telia Company // Sonera Class2 CA // 37F76DE6077C90C5B13E931AB74110B4F2E49A27
- Visa // Visa eCommerce Root // 70179B868C00A4FA609152223F9F3E32BDE00562
此版本将为以下根(CA \ 根证书 \ SHA-1 指纹)设置 NotBefore 属性:
- AC Camerfirma, S.A. // Chambersign Global Root // 339B6B1450249B557A01877284D9E02FC3D2D8E9
- Carillon Information Security Inc. // Carillon Information Security Inc. // A69E0336C4E59023FF653C71F928EB73F21C00F0
- DATEV eG // CA DATEV STD 03 // 27EED22AFD58A2C64A855E3680AF898BF36CE503
- DATEV eG // CA DATEV BT 03 // 3DB66DFEBEB6712889E7C098B32805896B6218CC
- DATEV eG // CA DATEV INT 03 // 924AEA47F73CB690565E552CFCC6E8D63EEE4242
- Digicert // GeoTrust Universal CA // E621F3354379059A4B68309D8A2F74221587EC79
- Government of Taiwan, Government Root Certification Authority (GRCA) // TW Government Root Certification Authority 2 // B091AA913847F313D727BCEFC8179F086F3A8C0F
- Government of Taiwan, Government Root Certification Authority (GRCA) // TW Government Root Certification Authority // F48B11BFDEABBE94542071E641DE6BBE882B40B9
- Network Solutions // Network Solutions ECC Certificate Authority // 80F95B741C38399495C34F20C23E7336314D3C6B
- Network Solutions // Network Solutions RSA Certificate Authority // 8E928C0FC27BB7ABA34E6BC0CA1250CB57B60F84
- Network Solutions // Network Solutions // 71899A67BF33AF31BEFDC071F8F733B183856332
- SwissSign AG // SwissSign Platinum CA - G2 // 56E0FAC03B8F18235518E5D311CAE8C24331AB66
此版本将为以下根(CA \ 根证书 \ SHA-1 指纹)的代码签名 EKU 设置 NotBefore 属性:
- Entrust // Entrust // B31EB1B740E36C8402DADC37D44DF5D4674952F9
此版本将为以下根(CA \ 根证书 \ SHA-1 指纹)的服务器身份验证 EKU 设置 NotBefore 属性:
- Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) Agencia Catalana de Certificacio (NIF Q-0801176-I) 28903A635B5280FAE6774C0B6DA7D6BAA64AF2E8
此版本将删除以下根(CA \ 根证书 \ SHA-1 指纹):
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) // Fabrica Nacional de Moneda y Timbre // 43F9B110D5BAFD48225231B0D0082B372FEF9A54
- Government of The Netherlands, PKIoverheid (Logius) // Staat der Nederlanden EV Root CA // 76E27EC14FDB82C1C0A675B505BE3D29B4EDDBBB
此版本将为以下根(CA\ 根证书 \ SHA-1 指纹)删除 EV SSL:1.AC Camerfirma, S.A. // GLOBAL CHAMBERSIGN ROOT - 2016 // 1139A49E8484AAF2D90D985EC4741A65DD5D94E2 2. AC Camerfirma, S.A. // Chambers of Commerce Root - 2008 // 786A74AC76AB147F9C6A3050BA9EA87EFE9ACE3C 3. AC Camerfirma, S.A. // CHAMBERS OF COMMERCE ROOT - 2016 // 2DE16A5677BACA39E1D68C30DCB14ABE22A6179B 4. Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) // Agencia Catalana de Certificacio (NIF Q-0801176-I) // 28903A635B5280FAE6774C0B6DA7D6BAA64AF2E8
此版本将为以下根(CA \ 根证书 \ SHA-1 指纹)删除 EV CS:1.Entrust // Entrust // B31EB1B740E36C8402DADC37D44DF5D4674952F9 2. AC Camerfirma, S.A. // CHAMBERS OF COMMERCE ROOT - 2016 // 2DE16A5677BACA39E1D68C30DCB14ABE22A6179B
备注
- 在此版本中,Microsoft 还更新了不受信任的 CTL 时间戳和序列号。 此发布未对不受信任的 CTL 内容做出任何更改,但这将会导致系统下载/刷新不受信任的 CTL。 这是一次正常更新,有时会在更新受信任的根 CTL 期间完成。
- 可从以下网址下载并测试更新包:https://aka.ms/CTLDownload
- 对于 Microsoft 受信任根证书计划,证书信任列表 (CTL) 的签名已从双重签名 (SHA-1/SHA-2) 更改为仅 SHA-2。 客户无需执行任何操作。 有关详细信息,请访问:https://support.microsoft.com/en-us/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus