Recent updates to this article

Date	Update
June 24, 2022	Minor formatting updates and modified the Note about the root certificates expiration in the "Solution" section.
June 22, 2022	Added a Note about the root certificates expiration in the "Solution" section.
June 10, 2022	Added Trellix ("Musarubra") root and intermediate certificates.
December 15, 2021	Added DigiCert reference to the Solution sections.

The product binaries listed below have been signed with updated certificates:
 

Affected Product	Version
Data Exchange Layer	5.0.2 and later
Data Loss Prevention Endpoint	11.3.2.82 and later
Database Security	4.6.6 Update 3 and later
Endpoint Security (ENS) Adaptive Threat Protection	10.7.0 and later 10.6.1 October 2019 Update and later
ENS Firewall	10.7.0 and later 10.6.1 October 2019 Update and later
ENS Platform (Common)	10.7.0 and later 10.6.1 October 2019 Update and later
ENS Threat Prevention	10.7.0 and later 10.6.1 October 2019 Update and later
ENS Web Control	10.7.0 and later 10.6.1 October 2019 Update and later
Host Intrusion Prevention	8.0 Patch 14 and later
McAfee Active Response	2.4.1 and later
McAfee Agent	5.6.2 and later
Application and Change Control	8.2.1 Update 5 and later
McAfee Client Proxy	2.5.0 and later
MVISION Endpoint	1906 and later
VirusScan Enterprise (VSE)	8.8 Patch 14 and later

 
We plan to update the following product binaries with updated certificates in a future product release. We update this article when product binaries are updated.


 

Products Pending Update	Version
Endpoint Intelligence Agent	To be determined
Threat Intelligence Exchange Module for VSE	To be determined

The latest packages include binaries that have been signed with updated SHA-256 certificates. Up-to-date root certificates are needed to validate new digital signatures. Microsoft distributes these certificates.

IMPORTANT: Make sure that you update the root certificate store and replace the missing certificates. Otherwise, you can't successfully install or upgrade any of the products in this article because the operating system can't successfully validate the new certificate binaries.

In some environments, the root certificates might be missing. The reasons for the missing root certificates include, but aren't limited to the following:

• An administrator removed the certificate from the system.
• The system doesn't have internet connectivity, which is needed to perform a Root AutoUpdate (automatic root update).
• The group policy in effect prevents the root certificate update:
  • The registry value HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\DisableRootAutoUpdate is set to 1.
  • The registry key HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots exists.