EDIT 2/4/2026: We’ve been notified that some email providers may distrust the DigiCert G1 root on April 15, which could result in broad ecosystem‑wide email impact. To ensure Exchange Online can rota...
Updated Feb 10, 2026
Version 4.0
Blog Post
6 MIN READ
Trust DigiCert Global Root G2 Certificate Authority to Avoid Exchange Online Email Disruption
On edge trasnport servers with connectors to O365 I have DigiCert Global Root G2 Certificate in place.
However, my check of
certutil -verifyctl AuthRoot | findstr /i "lastsynctime"
certutil -verifyctl Disallowed | findstr /i "lastsynctime"
shows date of August 8th 2025.
Windows CTL update is not disabled in GPO, neither in registry. I have it working on MBX servers and I suspect firewall is blocking the updater.
Is this the correct URLs for updater?
https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/certificate-trust#automatic-certificate-trust-list-updates
Nino_Bilic
Microsoft
MicrosoftAs far as I understand this - yes. But note that this is a Windows component and I don't think I'm super comfortable telling you why it might not be working for you (could be blocked, as you say).
In any case - you should be OK though; the certificate in question has actually been published since sometime in 2024. So your last refresh was after certificate was already out. You can verify by running:
Get-ChildItem -Path Cert:\LocalMachine\Root\ | Where-Object { $_.Thumbprint -eq "DF3C24F9BFD666761B268073FE06D1CC8D4F82A4" }
If you find the rest (like the one in the blog post screenshot) - you are OK as far as this change does (but yes, keep figuring why updating seems to not work is a good idea!)