Ok, I have found that you need to use this one:
https://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
And don't forget to do: openssl x509 -inform DER -in certificate.crt -out certificate.pem -outform PEM
(certificate.crt is just the renamed file that you will download from URL above)