May 2024 Deployment Notice - Microsoft Trusted Root Program

  • Article

On Tuesday, May 28, 2024, Microsoft released an update to the Microsoft Trusted Root Certificate Program.

This release will add the following roots (CA \ Root Certificate \ SHA-1 Thumbprint):

  • D-TRUST // D-TRUST EV Root CA 2 2023 // 8E8221B2E7D4007836A1672F0DCC299C33BC07D316F132FA1A206D587150F1CE
  • D-TRUST // D-Trust SBR Root CA 1 2022 // D92C171F5CF890BA428019292927FE22F3207FD2B54449CB6F675AF4922146E2
  • D-TRUST // D-Trust SBR Root CA 2 2022 // DBA84DD7EF622D485463A90137EA4D574DF8550928F6AFA03B4D8B1141E636CC
  • D-TRUST // D-TRUST BR Root CA 1 2020 // E59AAA816009C22BFF5B25BAD37DF306F049797C1F81D85AB089E657BD8F0044
  • D-TRUST // D-TRUST BR Root CA 2 2023 // 0552E6F83FDF65E8FA9670E666DF28A4E21340B510CBE52566F97C4FB94B2BD1
  • D-TRUST // D-TRUST EV Root CA 1 2020 // 08170D1AA36453901A2F959245E347DB0C8D37ABAABC56B81AA100DC958970DB
  • NAVER Cloud Trust Service // NAVER Cloud Trust Services ECC Root G1 // 87E73E149246AA634308E3A3142B1417F00FE25D
  • NAVER Cloud Trust Service // NAVER Cloud Trust Services RSA Root G1 // C4DA90EE324D7E4D041CB1F286FBB45388207CA1
  • QuoVadis // QuoVadisSigningECCP384RootG4 // 771535D43D4633BD307EB7B8A3966B5DF00707C088089920080C1AE6D3CB0F68
  • QuoVadis // QuoVadisSigningRSA4096RootG4 // 9F8E6DB31E740285E0C2C2DEB09E442BDD4E74BDEEAE2962BC82D1ECB9F39855
  • QuoVadis // QuoVadisClientECCP384RootG4 // D3C07AC44BD8FF1975BC62F1C7E9840EA8E188A4BA51133B8C4EFF05E34A2729
  • Google Trust Services // GTSR2 // D947432ABDE7B7FA90FC2E6B59101B1280E0E1C7E4E40FA3C6887FFF57A7F4CF
  • Google Trust Services // GTSR3 // 34D8A73EE208D9BCDB0D956520934B4E40E69482596E8B6F73C8426B010A6F48
  • Google Trust Services // GTSR4 // 349DFA4058C5E263123B398AE795573C4E1313C83FE68F93556CD5E8031B3C7D
  • Google Trust Services // GTSR1 // D947432ABDE7B7FA90FC2E6B59101B1280E0E1C7E4E40FA3C6887FFF57A7F4CF
  • Google Trust Services // GSR4 // B085D70B964F191A73E4AF0D54AE7A0E07AAFDAF9B71DD0862138AB7325A24A2
  • Sectigo // Sectigo Public Code Signing Root R46 // 7E76260AE69A55D3F060B0FD18B2A8C01443C87B60791030C9FA0B0585101A38
  • Sectigo // Sectigo Public Code Signing Root E46 // 8F6371D8CC5AA7CA149667A98B5496398951E4319F7AFBCC6A660D673E438D0B

This release will modify the following roots (CA \ Root Certificate \ SHA-1 Thumbprint):

  • QuoVadis // QuoVadisSMIMEECCP384RootG4 // 83FDDB2FD9DAE3B21EEBD33CF46251D746F0D6102B683150DD7B98AD8E4BB9F8
  • QuoVadis //QuoVadisSMIMERSA4096RootG4 // 5232A304AA4A10CFE6C47842EA3381CB31D619E24F58126D534CD50C5CE7845D

Certificate Transparency Log Monitor (CTLM) policy
The Certificate Transparency Log Monitor (CTLM) policy is now included in the monthly Windows CTL. It's a list of publicly trusted logging servers that is for validating certificate transparency on Windows. The list of logging servers is expected to change over time as they're retired or replaced, and this list reflects the CT logging servers that Microsoft trusts. In the upcoming Windows release, users are able to opt in to certificate transparency validation, which will check for the presence of two Signed Certificate Timestamps (SCTs) from different logging servers in the CTLM. This functionality is currently being tested with event logging only to ensure it's reliable before individual applications can opt in to enforcement.

Note

  • As part of this release, Microsoft also updated the Untrusted CTL time stamp and sequence number. No changes were made to the contents of the Untrusted CTL but this will cause your system to download/refresh the Untrusted CTL. This is a normal update that is sometimes done when the Trusted Root CTL is updated.
  • The update package will be available for download and testing at: https://aka.ms/CTLDownload
  • Signatures on the Certificate Trust Lists (CTLs) for the Microsoft Trusted Root Program changed from dual-signed (SHA-1/SHA-2) to SHA-2 only. No customer action required. For more information, please visit: https://support.microsoft.com/en-us/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus