Topic starter
24/06/2026 7:15 pm
TL;DR: Microsoft Defender incorrectly flagged certain DigiCert root certificates as malware, and DigiCert also noted a separate April 2026 misissuance event involving a limited number of code-signing certificates that were revoked, according to DigiCert. Security teams need stronger certificate verification, revocation, and endpoint-detection hygiene because trust failures now arise as much from control-plane mistakes as from compromise.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Microsoft and code-signing certificates: What to know”.
Key questions
Q: What should teams do when a security tool flags a legitimate certificate as malware?
A: Teams should verify the certificate chain, revocation status, and the security tool's signature state before treating the event as compromise.
Q: Why do certificate false positives create operational risk even when nothing is compromised?
A: They consume incident-response time, can disrupt software signing and distribution, and may cause teams to distrust valid trust anchors.
Q: How should security teams handle code-signing certificate revocation after misissuance?
A: They should treat revocation as a lifecycle control with notification, endpoint cleanup, and confirmation that impacted certificates are no longer trusted.
Practitioner guidance
- Verify Defender signature state Confirm Microsoft Defender is fully up to date across endpoints so incorrectly removed certificates are restored through the updated detection logic.
- Cross-check certificate trust status Validate certificate chain, revocation status, and issuing authority before escalating a certificate-related alert as compromise.
- Track revocation as an operational event Treat revocation as a coordinated workflow that includes notification, endpoint cleanup, and confirmation that affected code-signing certificates are no longer in circulation.
Bottom line: The article separates a Defender false positive from a separate certificate misissuance event, and that distinction matters for response and governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:28 am
Certificate trust now depends on two control planes at once: the CA lifecycle and the endpoint detection stack. When Microsoft Defender mislabels a root certificate, the issue is not only a false alert, it is a trust collision between validation and detection. Practitioners should treat certificate trust as an end-to-end governance problem, not a single control.
A few things that frame the scale:
- 48% of organisations cite cloud-based services as a driver for PKI deployment, according to the 2023 State of Machine Identity Management report.
A question worth separating out:
Q: What is the difference between certificate compromise and certificate misissuance?
A: Compromise means an attacker has obtained and is abusing a valid credential or certificate. Misissuance means the certificate was created incorrectly in the first place. The operational response differs: compromise focuses on containment and abuse, while misissuance focuses on revocation, customer notification, and validating which assets were actually impacted.
👉 Read our full editorial: Microsoft Defender false positives and code-signing certificate trust