# Microsoft ECC Root Certificate Authority 2017 root certificate (Microsoft)

> Microsoft ECC Root Certificate Authority 2017 is a root CA certificate operated by Microsoft (ECDSA P-384, valid until 2042-07-18, SHA-256 358DF39D). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/microsoft-ecc-root-ca-2017/
Last updated: 2026-11-10

Microsoft ECC Root Certificate Authority 2017 is a root CA certificate operated by Microsoft (ECDSA P-384, valid until 2042-07-18, SHA-256 358DF39D). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Microsoft |
| Subject | CN=Microsoft ECC Root Certificate Authority 2017,O=Microsoft Corporation,C=US |
| SHA-256 | 358DF39D764AF9E1B766E9C972DF352EE15CFAC227AF6AD1D70E8E4A6EDCBA02 |
| SPKI SHA-256 | 35F53CE1264611E03340FE37E1EC7D4CC986C5613DCA70FD04AA44545F2DAF28 |
| Valid from | 2019-12-18 |
| Expires | 2042-07-18 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | 66F23DAF87DE8BB14AEA0C573101C2EC |
| SHA-1 (Windows thumbprint) | 999A64C37FF47D9FAB95F14769891460EEC4C3C5 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.54 / Firefox 79; Inclusion bug: #1448093 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication |

The CCADB lists no EV policy OID for Microsoft ECC Root Certificate Authority 2017.

## Intermediate CAs issued by this root

The CCADB lists 18 intermediate CA certificates signed directly by Microsoft ECC Root Certificate Authority 2017: 6 currently valid, 8 expired and 4 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Microsoft TLS G1 ECC CA 02 | Microsoft Corporation | 2030-08-28 | Valid | C8201D6406020821C00855E25CF826983BBD143F074935F440FB3BF980A2F90A |
| Microsoft TLS G1 ECC CA 01 | Microsoft Corporation | 2030-08-28 | Valid | 2B5F1CA6E115D42112224720694D73BA50CA9B5C64E9DA2529B8F4AAF38DF384 |
| Microsoft Azure ECC TLS Issuing CA 07 | Microsoft Corporation | 2028-05-25 | Valid | BD3816423553ED993FA44A02F5562470C0CFB0D3B00532E3526A4A3AEC87522F |
| Microsoft Azure ECC TLS Issuing CA 04 | Microsoft Corporation | 2028-05-25 | Valid | 4D0F5DA23B099209B048E1871B4BB1C4B4E812E3FA0249BB8D19E00FFA9E91BC |
| Microsoft Azure ECC TLS Issuing CA 03 | Microsoft Corporation | 2028-05-25 | Valid | 2EC9A5BA68B60F81E5F8662F7645743CCE1EDCE06AF686C775431F7BBB69ABD4 |
| Microsoft Azure ECC TLS Issuing CA 08 | Microsoft Corporation | 2028-05-25 | Valid | 2C99B917B7A068578F7EFB4FB8E60B9CB5A0E73BF300E0E1DC112E5654C5AE52 |
| Microsoft ECC TLS Issuing AOC CA 02 | Microsoft Corporation | 2026-06-24 | Expired | 808CA1ABBFE2FF1A9AC71887DDA71FF6FCA6C3B5224827F547515A4D9F7AF209 |
| Microsoft ECC TLS Issuing EOC CA 02 | Microsoft Corporation | 2026-06-24 | Expired | 659C0F902D6059FBD1FCA528839F20604B80C74364E58F9D48A2291F813ED82D |
| Microsoft ECC TLS Issuing AOC CA 01 | Microsoft Corporation | 2026-06-24 | Expired | 5C64B1731A8138DEA7D11C9AE8622891F945EBA46825E7ABFE4754F0A6011AF8 |
| Microsoft ECC TLS Issuing EOC CA 01 | Microsoft Corporation | 2026-06-24 | Expired | 2769381532D96183ED39BDC4E323F3C520FBE6ACF3BDA30222239DDFC44C8380 |
| Microsoft Azure ECC TLS Issuing CA 05 | Microsoft Corporation | 2024-06-27 | Expired | 624D5576A652B2130768BFE84B965EEFFFD91603D25CD5F7155A7DC2789DAC38 |
| Microsoft Azure ECC TLS Issuing CA 02 | Microsoft Corporation | 2024-06-27 | Expired | 4EC439672A443401A66E27947CC3B5897F132B667F712CC1A37018A3CC85B16A |
| Microsoft Azure ECC TLS Issuing CA 01 | Microsoft Corporation | 2024-06-27 | Expired | 2CAEFBB55E70DF5A8985FE9BC10DD56A40C3DEDAB3DA1530A29682015C5B7C66 |
| Microsoft Azure ECC TLS Issuing CA 06 | Microsoft Corporation | 2024-06-27 | Expired | 151A3E5969C6616EB637A8722B174CFD95387AACE78D57C3BD23F0CB3008186A |
| Microsoft ECC TLS Issuing AOC CA 01 | Microsoft Corporation | 2026-03-11 | Revoked | 9D8BB150C07B81C25799B7945978B036E4B49C593C882BE379A58D08E1C25074 |
| Microsoft ECC TLS Issuing EOC CA 01 | Microsoft Corporation | 2026-03-11 | Revoked | 568E4046F384D0FDD9D06A8029E6BF38EED8904C1E0B44F99DA607F68672093E |
| Microsoft ECC TLS Issuing EOC CA 02 | Microsoft Corporation | 2026-03-11 | Revoked | 2DEEA0712931179BF1EF721070A30A1AB997F64C683EAB88DCE258D040D9AD25 |
| Microsoft ECC TLS Issuing AOC CA 02 | Microsoft Corporation | 2026-03-11 | Revoked | 12FB2F53AC2D09E62128B00487E8B77D6E4A0F459DD8744D009393BD0DF697B5 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as Microsoft ECC Root Certificate Authority 2017 with a different issuer, so a client has to carry Microsoft ECC Root Certificate Authority 2017 itself in its root store to trust it.


## What happens when it expires

Microsoft ECC Root Certificate Authority 2017 is valid until 2042-07-18, about 15.7 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Microsoft ECC Root Certificate Authority 2017 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does Microsoft ECC Root Certificate Authority 2017 expire?**

On 2042-07-18, about 15.7 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Microsoft ECC Root Certificate Authority 2017 issued?**

The CCADB lists 18: 6 valid, 8 expired and 4 revoked. The newest valid one is Microsoft TLS G1 ECC CA 02, valid until 2030-08-28.

**Is Microsoft ECC Root Certificate Authority 2017 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).