Update Available to Revoke Fraudulent Microsoft Certificates Issued by VeriSign (293811)

SUMMARY

In March, 2001, VeriSign, Inc. announced that it had issued two digital certificates to an individual who fraudulently claimed to be a Microsoft employee. This issue is discussed at length in Microsoft Security Bulletin MS01-017. VeriSign has revoked these certificates, and they are listed in the current VeriSign Certificate Revocation List (CRL). However, because the VeriSign code-signing certificates do not specify a CRL Distribution Point (CDP), it is not possible for any browser's CRL-checking mechanism to locate and use the VeriSign CRL. Microsoft has developed an update that rectifies this problem. The update package includes a CRL that contains the two certificates, and an installable revocation handler that consults the CRL on the local computer, rather than attempting to use the CDP mechanism.

Important Notes

• If you upgrade or reinstall any version of Internet Explorer or Windows, you must reinstall this update. You also must reinstall this update if you install any IEAK package, including a Single disk branding.
  
  NOTE:You do not need to reinstall this update if you upgrade to Windows XP, Windows 2000 SP2, or Internet Explorer 6.
• If you choose to use a local copy of the VeriSign CRL manually rather than the CRL that is supplied with the update, be aware that the full VeriSign CRL is short-lived and must be refreshed weekly.
• If you manually install the full VeriSign CRL before you install this update, you should install a new version of the CRL afterwards.

For additional information about this issue, click the article number below to view the article in the Microsoft Knowledge Base: For additional information about how to recognize these fraudulent certificates, click the article number below to view the article in the Microsoft Knowledge Base: For additional information about how to revoke these certificates' trusted status, click the article number below to view the article in the Microsoft Knowledge Base: For additional information about how to remove VeriSign Commercial Software Publishers CA from the trusted store, click the article number below to view the article in the Microsoft Knowledge Base: