# Microsoft RSA Root Certificate Authority 2017 root certificate (Microsoft)

> Microsoft RSA Root Certificate Authority 2017 is a root CA certificate operated by Microsoft (RSA 4096, valid until 2042-07-18, SHA-256 C741F70F). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/microsoft-rsa-root-ca-2017/
Last updated: 2026-11-10

Microsoft RSA Root Certificate Authority 2017 is a root CA certificate operated by Microsoft (RSA 4096, valid until 2042-07-18, SHA-256 C741F70F). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Microsoft |
| Subject | CN=Microsoft RSA Root Certificate Authority 2017,O=Microsoft Corporation,C=US |
| SHA-256 | C741F70F4B2A8D88BF2E71C14122EF53EF10EBA0CFA5E64CFA20F418853073E0 |
| SPKI SHA-256 | B2F7298B52BF2C3CAC4DDFE72DE4D682AC58957595982F2B62301AF597C699C5 |
| Valid from | 2019-12-18 |
| Expires | 2042-07-18 |
| Key | RSA 4096 |
| Signature algorithm | sha384WithRSAEncryption |
| Serial number | 1ED397095FD8B4B347701EAABE7F45B3 |
| SHA-1 (Windows thumbprint) | 73A5E64A3BFF8316FF0EDCCC618A906E4EAE4D74 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.54 / Firefox 79; Inclusion bug: #1448093 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication |

The CCADB lists no EV policy OID for Microsoft RSA Root Certificate Authority 2017.

## Intermediate CAs issued by this root

The CCADB lists 24 intermediate CA certificates signed directly by Microsoft RSA Root Certificate Authority 2017: 8 currently valid, 8 expired and 8 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Microsoft TLS G1 RSA CA 03 | Microsoft Corporation | 2030-08-28 | Valid | 8797D4D4A3473CA1D86A279BED9639937B27C52F3CDA0B6009D695BC373BDEBB |
| Microsoft TLS G1 RSA CA 01 | Microsoft Corporation | 2030-08-28 | Valid | 79DBA0721F6DC1AD8EDC3DC27518702F970044188928BF7E8B42A04531424F73 |
| Microsoft TLS G1 RSA CA 04 | Microsoft Corporation | 2030-08-28 | Valid | 2765F456AA084CC2BA015C44D42EC783F2BF6E706C9132E8A6EFD3C800F32D93 |
| Microsoft TLS G1 RSA CA 02 | Microsoft Corporation | 2030-08-28 | Valid | 04396B0ED932A93150457013D839077784BFB143EA900B6A4990FCA139CBD4D1 |
| Microsoft Azure RSA TLS Issuing CA 04 | Microsoft Corporation | 2028-05-25 | Valid | FD39FFC48F148354262162A2F55DD46DC2564CFC1499309AD53F09C10981DCCA |
| Microsoft Azure RSA TLS Issuing CA 07 | Microsoft Corporation | 2028-05-25 | Valid | FBB7926A451BADF516BE518614A77E6E325E29819908796D807F59320F918EE2 |
| Microsoft Azure RSA TLS Issuing CA 08 | Microsoft Corporation | 2028-05-25 | Valid | CFDD061FCD4CFF3BB9E133264CA7FDE45CA49B70CFAA977AE0DC422B4330A8C1 |
| Microsoft Azure RSA TLS Issuing CA 03 | Microsoft Corporation | 2028-05-25 | Valid | 3D3F4B440F933FFD269565EDA9E20E8DF863C9CBE3651D3B476C5B4F4AF5CE28 |
| Microsoft RSA TLS Issuing AOC CA 02 | Microsoft Corporation | 2026-06-24 | Expired | D77C45C1587731C4632C19D6F3C9FE832626615C879EA053664A4B26EB2293EC |
| Microsoft RSA TLS Issuing EOC CA 01 | Microsoft Corporation | 2026-06-24 | Expired | 5EA3857EACD4C7CA5ACBCA9C4627E26F3072038D191A29D4C3F9464B2E5F00C6 |
| Microsoft RSA TLS Issuing EOC CA 02 | Microsoft Corporation | 2026-06-24 | Expired | 4D55BC4ABEB7D37FAB57E573ACCE83133E36212C864E003FBCB30B5FC248B011 |
| Microsoft RSA TLS Issuing AOC CA 01 | Microsoft Corporation | 2026-06-24 | Expired | 481E582A206A7D7040CCDA17CF25D349785A2AB94ED7552AB254DCD38B032EC0 |
| Microsoft Azure TLS Issuing CA 02 | Microsoft Corporation | 2024-06-27 | Expired | D39CE39FF6F449D4F3391EE2004D705EC22F99CFFCA40A88F85DB26454ADDBD1 |
| Microsoft Azure TLS Issuing CA 05 | Microsoft Corporation | 2024-06-27 | Expired | AB3203B3EA2017D509726A1D82293EFFCB8C42CEB52C9AF1C0EEE96B5C02BCBA |
| Microsoft Azure TLS Issuing CA 06 | Microsoft Corporation | 2024-06-27 | Expired | 7DF4D3EF45798F8C4384FC702BA52A44CE7BD6298B141628D4ABABC7678F6467 |
| Microsoft Azure TLS Issuing CA 01 | Microsoft Corporation | 2024-06-27 | Expired | 0437AB2EC2C2B4890296C135034B21DB146434B8317EE703AA8AA943C5EA51AE |
| Microsoft RSA TLS Issuing AOC CA 01 | Microsoft Corporation | 2026-06-24 | Revoked | EC02314A59A303990772BDF25513D5093581257AD4E242F086F988A98FBA8B7D |
| Microsoft RSA TLS Issuing EOC CA 01 | Microsoft Corporation | 2026-06-24 | Revoked | EB79C04645B9137E67647A7389DAC6EB1D3AAD8AA74D8994AA8F9C01015ECDE0 |
| Microsoft RSA TLS Issuing EOC CA 02 | Microsoft Corporation | 2026-06-24 | Revoked | 3B7D95D4FF780B5EA537D852E24C5485CDA83B2B7931C7AF1C8FEEC9C62146DB |
| Microsoft RSA TLS Issuing AOC CA 02 | Microsoft Corporation | 2026-06-24 | Revoked | 3ACD6F50D569963EDE389E5A3D024FEF52CB537DBF497CA1725E9CE710117807 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as Microsoft RSA Root Certificate Authority 2017 with a different issuer, so a client has to carry Microsoft RSA Root Certificate Authority 2017 itself in its root store to trust it.


## What happens when it expires

Microsoft RSA Root Certificate Authority 2017 is valid until 2042-07-18, about 15.7 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Microsoft RSA Root Certificate Authority 2017 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does Microsoft RSA Root Certificate Authority 2017 expire?**

On 2042-07-18, about 15.7 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Microsoft RSA Root Certificate Authority 2017 issued?**

The CCADB lists 24: 8 valid, 8 expired and 8 revoked. The newest valid one is Microsoft TLS G1 RSA CA 03, valid until 2030-08-28.

**Is Microsoft RSA Root Certificate Authority 2017 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).