# Microsoft as a CA: PKI roots and the Trusted Root Program > Microsoft runs both a root store (the Microsoft Trusted Root Program) and its own public PKI for Microsoft and Azure services; it doesn't sell TLS certificates. Source: https://ssl.sh/cas/microsoft/ Last updated: 2026-11-10 Microsoft is both a root store operator and a certificate authority, but not a CA you can buy from. The Microsoft Trusted Root Program decides which roots Windows trusts, and Microsoft's own PKI issues TLS certificates for Microsoft and Azure services, chaining to Microsoft roots that every major store includes. ## Owner and headquarters The CA owner in the CCADB is Microsoft Corporation, a US company; the certificate of www.microsoft.com names Redmond, Washington. Microsoft's public CAs and their policies are published in the Microsoft PKI repository. ## Root certificates As of November 2026, CCADB lists two Microsoft roots in the TLS report: Microsoft RSA Root Certificate Authority 2017 (RSA 4096) and Microsoft ECC Root Certificate Authority 2017 (ECDSA P-384), both valid until 2042-07-18 and trusted for TLS by Chrome, Mozilla, Apple and Microsoft. Azure's CA documentation also lists Microsoft TLS RSA Root G2, distributed as a cross-certificate signed by [DigiCert](https://ssl.sh/cas/digicert/) Global Root G2, and www.microsoft.com currently serves a chain through that cross-certificate. ## Certificate products Microsoft sells no certificates to the public. Its CAs issue certificates for Microsoft-operated services such as Azure, Microsoft 365 and Microsoft websites. Azure customers who need certificates for their own domains get them from other CAs, through Azure's integrations or by uploading their own. ## ACME support Microsoft doesn't offer a public ACME service for its own CAs. ## Free certificates Microsoft doesn't issue certificates for customer domains from its own public CAs, free or paid. ## Notable incidents and changes For site operators the relevant part of Microsoft is its root program. Windows downloads trusted roots on demand, and Microsoft can apply a "NotBefore" restriction that keeps trusting certificates issued before a date while rejecting newer ones; CCADB shows this status, for example, on Entrust's AffirmTrust roots. Applications that pin to specific Microsoft intermediates should follow the Azure CA documentation, because Microsoft rotates its issuing CAs. ## Root certificates (CCADB) Microsoft has 2 root certificate(s) in the CCADB TLS report. Together they have signed 42 intermediate CA certificates, 14 of them still valid. | Root certificate | Key | Expires | Chrome | Mozilla | Apple | Microsoft | Intermediates | SHA-256 | |---|---|---|---|---|---|---|---|---| | Microsoft ECC Root Certificate Authority 2017 | ECDSA P-384 | 2042-07-18 | Included | Included | Included | Included | 18 | 358DF39D764AF9E1B766E9C972DF352EE15CFAC227AF6AD1D70E8E4A6EDCBA02 | | Microsoft RSA Root Certificate Authority 2017 | RSA 4096 | 2042-07-18 | Included | Included | Included | Included | 24 | C741F70F4B2A8D88BF2E71C14122EF53EF10EBA0CFA5E64CFA20F418853073E0 | Valid intermediate CAs operated by Microsoft under roots that other CAs own (CCADB; number of valid intermediates in brackets): - DigiCert: 2 ## CAA records The CCADB lists 1 CAA issuer domain(s) recognized by the currently valid intermediate certificates of Microsoft. One issue record with any of them lets Microsoft issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them. ``` example.com. CAA 0 issue "microsoft.com" ``` ## Audits Audit data the CCADB records for the TLS roots of Microsoft. Auditor(s): Deloitte. The most recent audit period ended on 2026-04-30. - Standard audit: WebTrust 2025-05-01 – 2026-04-30 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f96cb60f-890f-4c85-a543-c8ddb3981e7f) - Network security: WebTrust 2025-05-01 – 2026-04-30 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=dd936891-2fd7-45f4-8dd9-72d5c2b86ba6) - TLS Baseline Requirements: WebTrust 2025-05-01 – 2026-04-30 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=78750b95-11a7-414b-8124-530701e6678c) ## CP/CPS documents Certificate Policy and Certification Practice Statement links that Microsoft has disclosed in the CCADB for its TLS roots, with effective dates: - CPS: https://www.microsoft.com/pkiops/Docs/Content/policy/Microsoft_PKI_Services_public_tls_CPS_v3.3.7.pdf - CP: https://www.microsoft.com/pkiops/Docs/Content/policy/Microsoft_PKI_Services_CP_v3.2.1.pdf ## Report a certificate problem To report a mis-issued certificate, a compromised private key or other abuse, use the channels Microsoft lists in the CCADB (replace [at] and [dot] in addresses): - https://www.microsoft.com/pkiops/docs/repository.htm ## Incident reports CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “Microsoft”: https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&product=CA+Program&component=CA+Certificate+Compliance&short_desc_type=allwords&short_desc=Microsoft&order=changeddate+DESC ## FAQ **What CAA record allows Microsoft to issue certificates?** Publish example.com. CAA 0 issue "microsoft.com". The CCADB lists 1 recognized domain(s) for Microsoft: microsoft.com. **Who audits Microsoft?** Deloitte, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2025-05-01 to 2026-04-30; the statement is dated 2026-06-18. **How do I report a problem certificate to Microsoft?** Use the channel(s) listed in the CCADB: https://www.microsoft.com/pkiops/docs/repository.htm. **How many root certificates does Microsoft have?** 2 in the CCADB TLS report. Trusted for TLS: Chrome 2, Mozilla 2, Apple 2, Microsoft 2. They have signed 42 intermediates, 14 of them still valid. Sources: CCADB All Certificate Information (V5), List of CAA Identifiers, List of CA problem reporting mechanisms and TLS Server Authentication report (ccadb.org/resources).