JSI Tip 3534. Update to revoke fraudulent Microsoft Certificates issued by VeriSign is available.

In tip 3514, I described the subject problem and a workaround.

Microsoft Knowledge Base Article 293811 contains the following summary:

In March, 2001, VeriSign, Inc. announced that it had issued two digital certificates to an individual who fraudulently claimed to be a Microsoft employee. This issue is discussed at length in Microsoft Security Bulletin MS01-017. VeriSign has revoked these certificates, and they are listed in the current VeriSign Certificate Revocation List (CRL). However, because the VeriSign code-signing certificates do not specify a CRL Distribution Point (CDP), it is not possible for any browser's CRL-checking mechanism to locate and use the VeriSign CRL. Microsoft has developed an update that rectifies this problem. The update package includes a CRL that contains the two certificates, and an installable revocation handler that consults the CRL on the local computer, rather than attempting to use the CDP mechanism.

Important Notes

For additional information about this issue, click the article number belowto view the article in the Microsoft Knowledge Base:293818 Erroneous VeriSign-Issued Digital Certificates Pose Spoofing HazardFor additional information about how to recognize these fraudulent certificates, click the article number belowto view the article in the Microsoft Knowledge Base:293817 How to Recognize Erroneously-Issued VeriSign Code-Signing CertificatesFor additional information about how to revoke these certificates' trusted status, click the article number belowto view the article in the Microsoft Knowledge Base:293816 How to Determine Whether You Have Accepted Trust for Fraudulent VeriSign-Issued CertificatesFor additional information about how to remove VeriSign Commercial Software Publishers CA from the trusted store, click the article number belowto view the article in the Microsoft Knowledge Base:293819 How to Remove a Root Certificate from the Trusted Root Store