Exchange Online, SharePoint Online, and Microsoft Teams: April 2026 industry-wide DigiCert Global Root CA (G1) distrust

Starting April 15, 2026, browsers and platforms will distrust DigiCert Global Root CA (G1). Microsoft 365 services use newer certificates, so most users won’t be affected. Legacy scenarios may face TLS errors. If issues arise, verify the certificate chain and contact Microsoft Support referencing the April 2026 distrust. Introduction To support industry-wide security improvements and modern cryptographic standards, browsers and platforms that follow Mozilla and Chrome trust stores will begin distrusting the DigiCert Global Root CA (G1) starting April 15, 2026. Microsoft has already migrated Microsoft 365 services to newer, more secure certificate hierarchies (such as DigiCert Global Root G2 and G3). We’re sharing this notification to help you quickly identify and respond to any unexpected certificate-related connection issues that may arise in edge scenarios due to this industry trust change. This change is driven by industry trust store updates and does not represent a new change or rollout within Microsoft 365 services. When this will happen April 15, 2026: Industry-wide distrust of DigiCert Global Root CA (G1) begins Microsoft monitoring period: April 15, 2026 and onward How this affects your organization Who is affected Organizations accessing Microsoft 365 services using: Google Chrome or Mozilla Firefox Linux-based systems, containers, appliances, or software stacks that rely on Mozilla/NSS trust stores Only scenarios where a service endpoint still presents a TLS certificate chaining to DigiCert Global Root CA (G1) What will happen Most customers will not experience any impact. In rare legacy scenarios: TLS connections may fail certificate validation Failures may be intermittent depending on: Client OS patch level Browser version Container or image refresh cadence Common error messages may include: NET::ERR_CERT_AUTHORITY_INVALID SEC_ERROR_UNKNOWN_ISSUER SunCertPathBuilderException verify error:num=19:self signed certificate in certificate chain What you can do to prepare If you encounter errors on or after April 15, 2026: No action is required if you are not experiencing certificate or TLS handshake errors. Review the certificate chain presented by the failing endpoint If DigiCert Global Root CA (G1) appears: Stop local debugging or repeated mitigation attempts Collect the following triage information: Target URL or hostname Full error message and timestamp (including time zone) Client OS, version, […]

The post Exchange Online, SharePoint Online, and Microsoft Teams: April 2026 industry-wide DigiCert Global Root CA (G1) distrust appeared first on M365 Admin.