Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha
Patch Microsoft Defender to Security Intelligence version 1.449.430.0 or later to restore removed DigiCert root certificates.
Patch Microsoft Defender to Security Intelligence version 1.449.430.0 or later and verify AuthRoot store for missing DigiCert certificates.
Summary
Microsoft Defender mistakenly identified legitimate DigiCert root certificates as the malware Trojan:Win32/Cerdigent.A!dha, leading to widespread false‑positive alerts and the removal of certificates from the Windows trust store.
The false positives began after a Defender signature update on April 30, 2026, and affected the AuthRoot registry key HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates. Microsoft released Security Intelligence update 1.449.430.0, followed by 1.449.431.0, to correct the detection logic. The updates install automatically, but users can manually trigger them via Windows Security > Virus and threat protection > Protection updates.
Microsoft confirmed the issue was linked to detections for compromised certificates from a recent DigiCert breach, and the fix restores previously removed certificates. The specific certificate IDs flagged were 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 and DDFB16CD4931C973A2037D3FC83A4D7D775D05E4.
Key changes
- Microsoft Defender flagged DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha, causing false positives.
- The false positives removed certificates from the Windows AuthRoot store under HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates.
- Microsoft released Security Intelligence update 1.449.430.0, followed by 1.449.431.0, to correct the detection logic.
- The updates automatically install; users can manually check via Windows Security > Virus and threat protection > Protection updates.
- The issue was linked to detections for compromised certificates from a recent DigiCert breach.
- The specific certificate IDs flagged were 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 and DDFB16CD4931C973A2037D3FC83A4D7D775D05E4.