Updating root certificates for Zoom services

To maintain Zoom’s high-security standards regarding Zoom applications, connectivity, and media across the Zoom platform, Zoom will begin transitioning its global infrastructure to DigiCert Global Root G2 signed certificates. To ensure that the services continue functioning, admins may need to install new certificates. A quick summary of the various services that will be affected is shown below:

*Note: These changes were scheduled to start on January 27th and February 3rd but have been delayed by a week.

How does this affect Zoom Phone?

Zoom is currently in the process of transitioning our root certificate from DigiCert Root CA to DigiCert Global Root G2. As part of this change, customers will be required to upload the DigiCert Global Root G2 into their session border controller (SBC) to ensure that BYOC/BYOP trunks that are configured for TLS continue to operate after the certificate change. These certificates will also need to be uploaded to Generic devices to continue to operate after the certificate change.

Note: To ensure operation, the current DigiCert Root CA certificates will need to remain on the device until Zoom has updated the new certificates.

For additional resources on how to update the certificates on Session Border Controllers, please see the links below or visit your phone manufacturer’s website.

• Audiocodes
• Oracle
• Ribbon
• Cisco
• anynode

How does this affect SIP-based room systems?

Zoom CRC services will begin to use certificates issued by the DigiCert Global Root G2 root certificate and DigiCert Global G2 TLS RSA SHA256 2020 CA1 intermediate certificate for SIP TLS connections.

This change only affects devices connecting to Zoom CRC using SIP TLS. Connections using SIP over TCP, SIP over UDP, and H.323 are unaffected.

Note: To ensure operation, the current DigiCert Root CA certificates will need to remain on the device using SIP TLS to connect to Zoom CRC until Zoom has completed the change. They do not need to be removed from devices using SIP TLS to connect to Zoom CRC after the change.

How can I check whether my SIP-based room system will be impacted?

Zoom understands that this change may have an impact on your SIP-based room systems or integrations that use Zoom CRC services. Zoom performed testing with a variety of common SIP/H.323 conference room equipment in default configuration to ensure the Zoom CRC certificate will not affect their ability to connect to Zoom meetings through Zoom CRC using SIP TLS. Zoom performed the tests with SIP/H.323 conference room equipment using the most recently released device vendor firmware. Zoom tested each device by making direct calls to Zoom CRC with SIP TLS as the configured call protocol. The following device/firmware combinations successfully connected to Zoom CRC using SIP TLS with the new certificates, when the device was in default configuration:

• Cisco EX-series, C-series, and MX-series "generation 1" devices using firmware TC7.3.21
• Cisco DX-series, SX-series, and MX-series "generation 2" devices using firmware CE9.15.17.4
• Cisco Room-series, Desk-series, and Board-series devices using firmware RoomOS 10.19.5.6 (on-premises) or 10.20.1.6 (cloud-registered)
• Cisco Room-series, Desk-series, and Board-series devices using firmware RoomOS 11.1.4.1 and greater (on-premises) or 11.4.1.8 and greater (cloud-registered)
• Polycom HDX devices using firmware 3.1.7 and greater
• Polycom RealPresence Group-series devices using firmware 6.1.7.2 and greater
• Polycom Trio devices (including Visual Plus and Visual Pro configurations) using firmware 7.2.6-0019

Zoom encourages you to review your SIP/H.323 conference room devices to ensure they meet these requirements. Zoom recommends updating your devices, if necessary, to ensure they are supported with Zoom CRC.

If your device, application, or platform is not listed above, and uses SIP, specifically SIP over TLS, to connect to Zoom CRC consult your vendor’s documentation or contact your vendor’s support services to determine whether the trust store certificates available to your device, application, or platform include the DigiCert Global Root G2 root certificate. Your vendor can provide instructions to install additional certificates, if necessary.

How can I perform a confirmation test ahead of the change with my SIP-based room system?

From a SIP/H.323 device that is configured to use SIP TLS to connect to Zoom CRC, dial the SIP URI "0@dvgo.zmus.us" to connect to a Zoom CRC test service. The Zoom CRC services at dvgo.zmus.us use a certificate issued by the DigiCert Global Root G2 root certificate and DigiCert Global G2 TLS RSA SHA256 2020 CA1 intermediate certificate for SIP TLS connections.

If the call fails to connect

A failure to connect is likely due to your device or service not trusting the new Zoom CRC certificate issued by the DigiCert Global Root G2 root certificate and DigiCert Global G2 TLS RSA SHA256 2020 CA1 intermediate certificate. Review your SIP/H.323 device's logs to confirm why the call failed (e.g. couldn't create TLS connection due to a “verification failure” or “self-signed certificate in the certificate chain,” indicating an absence of trust). In this event, you may load the DigiCert Global Root G2 root certificate using your device vendor’s management interface. If the device is not dialing directly to Zoom CRC, e.g. it is registered to on-premises or 3rd party cloud infrastructure, it is also possible the failure is not on the SIP/H.323 device itself, but is somewhere along the call path. Review your infrastructure logs to confirm why the call failed.

If the calls connect successfully

If your SIP/H.323 device connects to the Zoom CRC video IVR and is prompted to enter a meeting ID, the device was likely able to negotiate a SIP TLS connection with Zoom CRC using its new certificate issued by the DigiCert Global Root G2 root certificate and DigiCert Global G2 TLS RSA SHA256 2020 CA1 intermediate certificate. In this case, you don't need to join a meeting; the device’s ability to connect to the video IVR and receive audio/video is sufficient to test SIP TLS certificate trust.

However, Zoom recommends that you look at the SIP/H.323 device's logs to ensure it actually connected over SIP TLS, and did not fall back to SIP over TCP, SIP over UDP, or H.323 connection methods. If the device is not dialing directly to Zoom CRC, e.g. it is registered to on-premises or 3rd party cloud infrastructure, it is also possible a fall-back occurred somewhere along the call path. In this case, review your infrastructure logs to confirm the call is connected using SIP TLS.

What to do if my SIP/H.323 device is impacted?

You may optionally configure your device, application, or platform to use SIP UDP, SIP TCP, or H.323 to connect to the Conference Room Connector, however, Zoom recommends using SIP TLS. Consult your vendor’s documentation or contact your vendor’s support services to determine whether the trust store certificates available to your device, application, or platform include the DigiCert Global Root G2 root certificate. Your vendor can provide instructions to install the additional certificates listed elsewhere on this page, if necessary. If SIP TLS connectivity is not possible due to an inability to add certificates to the trust store of your device, application, or platform vendor, you could consider replacing your hardware with Zoom Rooms instead.

How does this affect single sign-on (SSO)?

In keeping up with standard industry practices, Zoom will be updating its single sign-on (SSO) certificate ahead of its expiration on Tuesday, January 2, 2024. However, before proceeding with the Zoom SSO certificate rotation, please ensure that the DigiCert Global Root G2 is included in your trust stores. Most cloud-based Identity Provider (IdP) services already include this. On-premise-based IDP servers may require an update to the certificate trust store. Failure to have the DigiCert Global Root G2 included in your trust store will result in service disruption when rotating the Zoom SSO certificate.

How to download root certificates for adding manually

Current root and intermediate certificate

As of March 2024, the G1 root certificates are no longer available, and organizations must utilize the new DigiCert Global Root G2 certificates instead.

Current root certificate

DigiCert Global Root CA

Current immediate certificate

DigiCert TLS RSA SHA256 2020 CA1 certificate

New root and intermediate certificates

New root certificates

We currently issue certificates through DigiCert. If the root certificate is not in your system's trust store, it may need to be added manually. Below are the current certificates organizations should utilize by January 1, 2024:

DigiCert Global Root G2 certificate

DigiCert TLS RSA4096 Root G5 certificate

New intermediate certificates

In rare instances, a system may require the intermediate certificate to be added manually:

DigiCert Global G2 TLS RSA SHA256 2020 CA1

DigiCert G5 TLS RSA4096 SHA384 2021 CA1

For more information on downloading Digicert certificates, please Digicert Support.