Removal of AAA Certificate Services from the Microsoft Root Store

On October 25th, 2026, Microsoft removed the AAA Certificate Services Root CA from the Microsoft Root Store.

This root was already removed from Google Chrome and Mozilla trust stores in April of 2025. 

The removal by Microsoft is done as an emergency measure in response to an incident affecting eMudhra, for which an advisory was previously posted on https://www.sectigo.com/resource-library/advisory-on-compromised-emudhra-intermediate-certificates. As the AAA Certificate Services Root CA had been used to cross-sign eMudhra CAs, the decision was made by Microsoft to remove any trust anchors that could potentially lead to the trust in maliciously issued certificates. 

This removal also marks the next phase in the removal of legacy Root CAs from trusted root programs. As already outlined in both https://www.sectigo.com/resource-library/changes-to-root-ca-hierarchies-and-trust-status and https://www.sectigo.com/resource-library/enhancements-to-root-ca-and-hierarchies, trusted root programs have begun the removal of older Root CAs from their root stores. 

Microsoft themselves have introduced policy changes recently, which limits the Root CA validity period to 8 years. 

Certificate issuance by this Root CA was already halted by Sectigo several years ago, in anticipation of these deprecations. Sectigo has however issued cross-signed CA certificates from this Root CA, to support older, legacy devices, while allowing certificates to be issued from modern hierarchies.

The removal of the AAA Certificate Services Root CA is not expected to lead to any issues with customer devices or infrastructure, unless any form of CA or Public Key Pinning to the specific Root CA is in place. 

If you do utilize pinning, we strongly recommend removing this practice. Certificate pinning can, and has, led to severe critical infrastructure incidents and downtime. For more inquiries around this, please reach out to [email protected].