Download Verisign Root Certificates App
Download Verisign Root Certificate
Download Verisign Root Certificates
Download Verisign Root Certificates Software
Download Verisign Root Certificate G5

A Certification Authority (CA) is an organization that browser vendors (like Mozilla) trust to issue certificates to websites. Last year, Mozilla published and discussed a set of issues with one of the oldest and largest CAs run by Symantec. The discussion resulted in the adoption of a consensus proposal to gradually remove trust in all Symantec TLS/SSL certificates from Firefox. The proposal includes a number of phases designed to minimize the impact of the change to Firefox users:

January 2018 (Firefox 58): Notices in the Browser Console warn about Symantec certificates issued before 2016-06-01, to encourage site owners to replace their TLS certificates.
May 2018 (Firefox 60): Websites will show an untrusted connection error if they use a TLS certificate issued before 2016-06-01 that chains up to a Symantec root certificate.
October 2018 (Firefox 63): Distrust of Symantec root certificates for website server TLS authentication.

After the consensus proposal was adopted, the Symantec CA was acquired by DigiCert; however, that fact has not changed Mozilla’s commitment to implement the proposal.

Firefox 60 is expected to enter Beta on March 13th carrying with it the removal of trust for Symantec certificates issued prior to June 1st, 2016, with the exception of certificates issued by a few subordinate CAs that are controlled by Apple and Google. This change affects all Symantec brands including GeoTrust, RapidSSL, Thawte, and VeriSign. The change is already in effect in Firefox Nightly.

Mozilla telemetry currently shows that a significant number of sites – roughly 1% of the top one million – are still using TLS certificates that are no longer trusted in Firefox 60. While the number of affected sites has been declining steadily, we do not expect every website to be updated prior to the Beta release of Firefox 60. We strongly encourage operators of affected sites to take immediate action to replace these certificates.

If you attempt to visit a site that is using a TLS certificate that is no longer trusted in Firefox 60, you will encounter the following error:

Clicking on the “Advanced” button will allow you to bypass the error and reach the site:

(b) At the top of the page, click the link 'Download a root package' for VeriSign Certificates (roots.zip file). Place it of the Proficy WebSpace server desktop. Unzip the contents.

These changes are expected to be included in the final version of Firefox 60 that is planned to be release on May 9th, 2018.

In Firefox 63, trust will be removed for all Symantec TLS certificates regardless of the date issued (with the exception of certificates issued by Apple and Google subordinate CAs as described above).

Wayne Thayer
Kathleen Wilson

Intermediate certificates are certificates that are designed to mitigate risk by creating a separator between the root certificates and SSL certificates. This is because issuing a certificate straight from the root would be too dangerous if it were to become compromised, as the root certificate has the most authority and needs to be protected. With the reliability and scale of Verisign domains, you can provide your customers with a complete Web services package. Registrar Tools Whether you want to increase registrations or renewals, expand to new markets, or enhance services, we have the tools, resources and registry services to help.

-->

The Microsoft Trusted Root Program no longer supports root certificates that have kernel mode signing capabilities.

For policy requirements, see Windows 10 Kernel Mode Code Signing Requirements.

Existing cross-signed root certificates with kernel mode code signing capabilities will continue working until expiration.As a result, all software publisher certificates, commercial release certificates, and commercial test certificates that chain back to these root certificates also become invalid on the same schedule. To get your driver signed, first Register for the Windows Hardware Dev Center program.

Frequently asked questions

What is the expiration schedule of the trusted cross-certificates?

The majority of cross-signed root certificates will expire in 2021, according to the following schedule:

Common Name	Expiration date
VeriSign Class 3 Public Primary Certification Authority - G5	2/22/2021
thawte Primary Root CA	2/22/2021
GeoTrust Primary Certification Authority	2/22/2021
GeoTrust Primary Certification Authority - G3	2/22/2021
thawte Primary Root CA - G3	2/22/2021
VeriSign Universal Root Certification Authority	2/22/2021
TC TrustCenter Class 2 CA II	4/11/2021
COMODO RSA Certification Authority	4/11/2021
UTN-USERFirst-Object	4/11/2021
DigiCert Assured ID Root CA	4/15/2021
DigiCert High Assurance EV Root CA	4/15/2021
DigiCert Global Root CA	4/15/2021
Entrust.net Certification Authority (2048)	4/15/2021
GlobalSign Root CA	4/15/2021
Go Daddy Root Certificate Authority - G2	4/15/2021
Starfield Root Certificate Authority - G2	4/15/2021
NetLock Arany (Class Gold) Fotanúsítvány	4/15/2021
NetLock Arany (Class Gold) Fotanúsítvány	4/15/2021
NetLock Platina (Class Platinum) Fotanúsítvány	4/15/2021
Security Communication RootCA1	4/15/2021
StartCom Certification Authority	4/15/2021
Certum Trusted Network CA	4/15/2021
COMODO ECC Certification Authority	4/11/2021

Download verisign root certificates program

What alternatives to cross-signed certificates are available for testing drivers?

For all options below, the TESTSIGNING boot option must be enabled.

For testing drivers at boot, see How to Install a Test-signed Driver Required for Windows Setup and Boot.

For more info, see Signing drivers during development and test.

What will happen to my existing signed driver packages?

As long as driver packages are timestamped before the expiration date of the leaf signing certificate, they will continue working.

Is there a way to run production driver packages without exposing it to Microsoft?

No, all production driver packages must be submitted to, and signed by Microsoft.

Does every new Production version of a driver package need to be signed by Microsoft?

Download verisign root certificates free

Yes, every time a Production level driver package is rebuilt, it must be signed by Microsoft.

Will we continue to be able to sign non-driver code with our existing 3rd party issued certificates after 2021?

Yes, these certificates will continue to work until they expire. Code which is signed using these certificates will only be able to run in user mode, and will not be allowed to run in the kernel, unless it has a valid Microsoft signature.

Will I be able to continue using my EV certificate for signing submissions to Hardware Dev Center?

Yes, EV certificates will continue to work until they expire. If you sign a kernel-mode driver with an EV certificate after the expiration of the cross-certificate that issued that EV certificate, the resulting driver will not load, run, or install.

How do I know if my signing certificate will be impacted by these expirations?

If your Cross Certificate Chain ends in Microsoft Code Verification Root, your signing certificate is affected.

To view the cross certificate chain, run signtool verify /v /kp <mydriver.sys>. For example:

How can we automate Microsoft Test Signing to work with our build processes?

Your

Download Verisign Root Certificates