EDIT 2/4/2026: We’ve been notified that some email providers may distrust the DigiCert G1 root on April 15, which could result in broad ecosystem‑wide email impact. To ensure Exchange Online can rota...
Updated Feb 04, 2026
Version 3.0
Blog Post
5 MIN READ
Trust DigiCert Global Root G2 Certificate Authority to Avoid Exchange Online Email Disruption
Hello, I ran:
certutil -verifyctl AuthRoot | findstr /i "lastsynctime"
certutil -verifyctl Disallowed | findstr /i "lastsynctime"
On 2 Windows machines that connect to Exchange Online. Both of them came up with a resent date for "certutil -verifyctl AuthRoot | findstr /i "lastsynctime" but one machine did not have a result for certutil -verifyctl Disallowed | findstr /i "lastsynctime" and the other came up with a very old date.
I checked and both machines have the "DigiCert Global Root G2" in their Trust Root CA store.
Should I be concerned about the results of the certutil -verifyctl Disallowed | findstr /i "lastsynctime" command?
- Arindam_Thokder
Microsoft
Ken_Harrell1145 - As long as you have DigiCert Global Root G2" in the Trust Root CA store, you should be good.
