Updated November 1, 2010 (this post documents an earlier root update completed in May).

Return to Root CA Members Page

Microsoft welcomes two new certification authorities (CAs) to the Windows Root Certificate Program this month.  We have also added a number of new root certificates from existing CAs.

NEW CAs Microsoft welcomes the following two new CAs to the Program -

AffirmTrust is a CA issuing primarily to members of the public located in the U.S.

Česká pošta, or the Czech Post, also known as PostSignum, is a CA operated by the government of the Czech Republic issuing primarily to members of the public located in the Czech Republic.

NEW ROOT CERTIFICATES AND CERTIFICATE ATTRIBUTES Microsoft also adds fifteen new root certificates for existing member CAs. The root certificates for GlobalSign, TC TrustCenter and Unizeto Certum are enabled to support the issuance of Extended Validation (EV) SSL certificates.

REMOVED ROOT CERTIFICATES Microsoft has also removed from distribution the following root certificate belonging to member CA Entrust, at the CA’s own request.

Do you see an error in any of the information above? Contact me here, and I will investigate and correct it. I cannot guarantee total accuracy of this data, but I will commit to correcting errors when they are pointed out to me.

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

EXPLANATION OF TERMS

CA Name indicates the CA who currently operates the CA Root Name with the unique Thumbprint and CA Root expiration date indicated. Over time CA root certificates have changed hands, and this resource attempts to identify the current CA owner. Each Current CA owner should contain a hyperlink to the CA’s website, where you can obtain additional information about their root certificates and their certificate policies.

Country is the main country from which the CA operates.

CA Root Name is the common name applied to the root certificate, which may or may not also indicate the name of the CA.

CA Root Size is the modulus of the RSA algorithm – typically 1024-bit, 2048-bit, or 4096-bit RSA. In the future you may see reference to other algorithms such as ECC or ECDSA.

Signature Hash indicates the hash algorithm chosen by the CA for this root certificate – MD2, MD5, SHA1, or SHA2 (SHA256). The hash algorithm used to issue end-use certificates may not be the same as the hash algorithm used for the root certificate: as of January 15, 2009 for example, to Microsoft’s knowledge no CA issues MD5 end-use certificates from any MD5 root certificate distributed by the Windows Root Certificate Program.

CA Root Expires is the expiration date of the root certificate, after which the CA cannot issue any more end-use certificates from it. Root certificates are typically kept in distribution after expiration by the Program until the last of these end-use certificates expires.

Thumbprint is the hash value which uniquely identifies the root certificate in question. It can be confirmed in the actual root certificate by examining the certificate properties (Details), under the Thumbprint field. NEW Each thumbprint contains a hyperlink to the Windows Update website, where you can access the actual root certificate, download and examine its certificate properties.

Return to Root CA Members Page