Certificate authority
Microsoft as a CA: PKI roots and the Trusted Root Program
Details
- CCADB CA owner
- Microsoft Corporation
- Country
- US
- Country (CCADB)
- United States of America
- ACME
- No
- Free certificates
- No
- Roots
- 2
- Roots trusted for TLS
- Chrome 2 · Mozilla 2 · Apple 2 · Microsoft 2
- Intermediates under its roots
- 42 (14 valid)
- Auditor
- Deloitte
- CAA
microsoft.com
Microsoft is both a root store operator and a certificate authority, but not a CA you can buy from. The Microsoft Trusted Root Program decides which roots Windows trusts, and Microsoft's own PKI issues TLS certificates for Microsoft and Azure services, chaining to Microsoft roots that every major store includes.
Owner and headquarters
The CA owner in the CCADB is Microsoft Corporation, a US company; the certificate of www.microsoft.com names Redmond, Washington. Microsoft's public CAs and their policies are published in the Microsoft PKI repository.
Root certificates
As of November 2026, CCADB lists two Microsoft roots in the TLS report: Microsoft RSA Root Certificate Authority 2017 (RSA 4096) and Microsoft ECC Root Certificate Authority 2017 (ECDSA P-384), both valid until 2042-07-18 and trusted for TLS by Chrome, Mozilla, Apple and Microsoft. Azure's CA documentation also lists Microsoft TLS RSA Root G2, distributed as a cross-certificate signed by DigiCert Global Root G2, and www.microsoft.com currently serves a chain through that cross-certificate.
Certificate products
Microsoft sells no certificates to the public. Its CAs issue certificates for Microsoft-operated services such as Azure, Microsoft 365 and Microsoft websites. Azure customers who need certificates for their own domains get them from other CAs, through Azure's integrations or by uploading their own.
ACME support
Microsoft doesn't offer a public ACME service for its own CAs.
Free certificates
Microsoft doesn't issue certificates for customer domains from its own public CAs, free or paid.
Notable incidents and changes
For site operators the relevant part of Microsoft is its root program. Windows downloads trusted roots on demand, and Microsoft can apply a "NotBefore" restriction that keeps trusting certificates issued before a date while rejecting newer ones; CCADB shows this status, for example, on Entrust's AffirmTrust roots. Applications that pin to specific Microsoft intermediates should follow the Azure CA documentation, because Microsoft rotates its issuing CAs.
CAA records
The CCADB lists 1 CAA issuer domain(s) recognized by the currently valid intermediate certificates of Microsoft. One issue record with any of them lets Microsoft issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.
Copy-ready record(s) for the first 1 domain(s):
example.com. CAA 0 issue "microsoft.com"| Domain | Valid intermediates |
|---|---|
microsoft.com | 28 |
For issuewild, iodef or DNS-provider formats, use the CAA record generator: CAA Generator
Root certificates (CCADB)
Microsoft has 2 root certificate(s) in the CCADB TLS report. Together they have signed 42 intermediate CA certificates, 14 of them still valid.
Roots this CA owner has in the CCADB TLS Server Authentication report, with current status in each root store.
- trusted for TLS
- included with limits (NotBefore / no TLS bit)
- removed or blocked
- not included
| Root certificate | Key | Expires | Ch | Mo | Ap | MS | Intermediates |
|---|---|---|---|---|---|---|---|
| Microsoft ECC Root Certificate Authority 2017 | ECDSA P-384 | 2042-07-18 | Included | Included | Included | Included | 18 (6) |
| Microsoft RSA Root Certificate Authority 2017 | RSA 4096 | 2042-07-18 | Included | Included | Included | Included | 24 (8) |
Valid intermediate CAs operated by Microsoft under roots that other CAs own (CCADB; number of valid intermediates in brackets):
- DigiCert (2)
Audits
Audit data the CCADB records for the TLS roots of Microsoft. Auditor(s): Deloitte. The most recent audit period ended on 2026-04-30.
| Audit | Scheme | Period | Statement | Report |
|---|---|---|---|---|
| Standard audit | WebTrust | 2025-05-01 – 2026-04-30 | 2026-06-18 | cpacanada.ca |
| Network security | WebTrust | 2025-05-01 – 2026-04-30 | 2026-06-18 | cpacanada.ca |
| TLS Baseline Requirements | WebTrust | 2025-05-01 – 2026-04-30 | 2026-06-18 | cpacanada.ca |
CP/CPS documents
Certificate Policy and Certification Practice Statement links that Microsoft has disclosed in the CCADB for its TLS roots, with effective dates:
- CPS: https://www.microsoft.com/pkiops/Docs/Content/policy/Microsoft_PKI_Services_public_tls_CPS_v3.3.7.pdf (effective 2026-09-11)
- CP: https://www.microsoft.com/pkiops/Docs/Content/policy/Microsoft_PKI_Services_CP_v3.2.1.pdf (effective 2026-09-11)
- Document repository: https://www.microsoft.com/pkiops/docs/repository.htm
Report a certificate problem
To report a mis-issued certificate, a compromised private key or other abuse, use the channels Microsoft lists in the CCADB (replace [at] and [dot] in addresses):
Incident reports
CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “Microsoft”:
FAQ
What CAA record allows Microsoft to issue certificates?
Publish example.com. CAA 0 issue "microsoft.com". The CCADB lists 1 recognized domain(s) for Microsoft: microsoft.com.
Who audits Microsoft?
Deloitte, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2025-05-01 to 2026-04-30; the statement is dated 2026-06-18.
How do I report a problem certificate to Microsoft?
Use the channel(s) listed in the CCADB: https://www.microsoft.com/pkiops/docs/repository.htm.
How many root certificates does Microsoft have?
2 in the CCADB TLS report. Trusted for TLS: Chrome 2, Mozilla 2, Apple 2, Microsoft 2. They have signed 42 intermediates, 14 of them still valid.