Enterprise IT teams worldwide faced an unexpected crisis this week when Microsoft Defender began flagging legitimate DigiCert root certificates as malicious software, triggering widespread false-positive alerts and, in many cases, automatically removing critical certificates from Windows systems.
The incident, which cybersecurity experts are calling one of the most disruptive false-positive campaigns in recent memory, began after Microsoft deployed a problematic signature update on April 30th. The antivirus engine started detecting specific DigiCert root certificates as "Trojan:Win32/Cerdigent.A!dha," causing immediate disruption to certificate-based authentication across countless organizations.
Technical Impact and Scope
The false positives targeted two specific DigiCert root certificates identified by their thumbprints: 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 and DDFB16CD4931C973A2037D3FC83A4D7D775D05E4. On affected systems, Microsoft Defender not only flagged these certificates as threats but actively removed them from the Windows AuthRoot certificate store.
The certificate removal occurred at the registry level, specifically targeting entries under the HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\ key. This aggressive action left many systems unable to validate certificates issued by DigiCert, potentially breaking SSL/TLS connections, code signing verification, and other certificate-dependent security functions.
For organizations heavily reliant on DigiCert-issued certificates, the impact was immediate and severe. Web services, application authentication, and secure communications suddenly began failing as Windows systems could no longer establish trust chains back to the compromised root certificates.
Emergency Response and Resolution
Microsoft responded to the crisis with unusual speed, releasing a corrective Security Intelligence update (version 1.449.430.0) within hours of widespread reports. The company has since deployed an even newer version (1.449.431.0) that not only stops the false-positive detections but also automatically restores previously removed certificates to affected systems.
The automatic restoration capability represents a significant technical achievement, as it required Microsoft to develop a mechanism that could reliably identify and reinstall the specific certificates that had been erroneously removed across potentially millions of systems.
Connection to Recent DigiCert Breach
The timing of these false positives has raised questions about their potential connection to a recent security incident at DigiCert. Earlier this month, the certificate authority disclosed that attackers had compromised their support systems and obtained initialization codes for a limited number of extended validation (EV) code-signing certificates.
The DigiCert breach involved a sophisticated social engineering attack targeting customer support personnel. Attackers sent malicious ZIP files disguised as screenshots, eventually compromising support systems after multiple attempts. This access allowed them to view customer accounts and extract initialization codes for pending certificate orders.
DigiCert ultimately revoked 60 code-signing certificates, including 27 linked to a malware campaign dubbed "Zhong Stealer." Security researchers had previously reported that certificates issued to well-known companies like Lenovo, Kingston, and Shuttle Inc were being used to sign malicious software.
While Microsoft has not officially confirmed a connection between the Defender false positives and the DigiCert incident, the timing suggests Microsoft may have implemented overly aggressive detection rules in response to reports of compromised DigiCert certificates being used in malware campaigns.
What You Should Do
Organizations affected by this incident should take several immediate steps to ensure their systems are properly restored:
- Force Microsoft Defender updates: Navigate to Windows Security > Virus and threat protection > Protection updates and click "Check for Updates" to ensure you have the latest corrective signatures
- Verify certificate restoration: Check that previously removed DigiCert root certificates have been automatically restored to your systems' trust stores
- Test certificate-dependent services: Validate that SSL/TLS connections, code signing verification, and other certificate-reliant functions are working properly
- Review security policies: Consider implementing staged deployment for antivirus signature updates to prevent similar incidents from affecting all systems simultaneously
- Monitor for lingering issues: Some applications may have cached certificate validation failures and require restart to function normally
Broader Implications for Enterprise Security
This incident highlights the delicate balance security vendors must maintain between protecting against emerging threats and avoiding disruption to legitimate operations. The aggressive response to potentially compromised DigiCert certificates, while well-intentioned, demonstrates how automated threat detection can sometimes cause more harm than the threats it aims to prevent.
For security teams, the episode serves as a reminder that even the most trusted security tools can become sources of operational risk. The rapid resolution and automatic certificate restoration show Microsoft's commitment to minimizing damage, but the initial impact underscores the need for more sophisticated testing and validation of security signatures before deployment.
