Recent updates to this article

Date	Update
August 27, 2021	Attached an ePO Endpoint Deployment Kit (EEDK) package that you can use to install the certificates using ePO.
August 9, 2021	Added root and intermediate DigiCert certificates.

The McAfee Enterprise products binaries listed below have been signed with updated certificates:
 

Affected Product	Version
Data Exchange Layer (DXL)	5.0.2 and later
Data Loss Prevention Endpoint (DLPE)	11.3.2.82 and later
Database Security	4.6.6 Update 3 and later
Endpoint Security (ENS) Adaptive Threat Protection	10.7.0 and later 10.6.1 October 2019 Update and later
ENS Firewall	10.7.0 and later 10.6.1 October 2019 Update and later
ENS Platform (Common)	10.7.0 and later 10.6.1 October 2019 Update and later
ENS Threat Prevention	10.7.0 and later 10.6.1 October 2019 Update and later
ENS Web Control	10.7.0 and later 10.6.1 October 2019 Update and later
Host Intrusion Prevention (Host IPS)	8.0 Patch 14 and later
McAfee Active Response (MAR)	2.4.1 and later
McAfee Agent (MA)	5.6.2 and later
McAfee Application and Change Control (MACC)	8.2.1 Update 5 and later
McAfee Client Proxy (MCP)	2.5.0 and later
MVISION Endpoint	1906 and later
McAfee VirusScan Enterprise	8.8 Patch 14 and later

 
McAfee Enterprise plans to update the following product binaries with updated certificates in a future product release. This article is updated when the product binaries are updated.


 

Products Pending Update	Version
Endpoint Intelligence Agent (EIA)	To be determined
Threat Intelligence Exchange Module (TIEm) for VirusScan Enterprise	To be determined

The latest McAfee Enterprise packages include binaries that have been signed with updated SHA-1 and SHA-256 certificates. Up-to-date root certificates are needed to validate new digital signatures. Microsoft distributes these certificates.

IMPORTANT: Make sure that you update the root certificate store and replace the missing certificates. Otherwise, you can't successfully install or upgrade any of the products in this article. The reason is because of the inability of the operating system to successfully validate the new certificate binaries.

In some environments, the root certificates might be missing. The reasons for the missing root certificates include, but aren’t limited to:

• An administrator removed the certificate from the system.
• The system doesn’t have internet connectivity, which is needed to perform a Root AutoUpdate (automatic root update).
• The group policy in effect prevents the root certificate update:
  • The registry value HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\DisableRootAutoUpdate is set to 1.
  • The registry key HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots exists.