diff --git a/windows/NTMakefile.w32 b/windows/NTMakefile.w32
index 316d76b68..f63b46a3b 100644
--- a/windows/NTMakefile.w32
+++ b/windows/NTMakefile.w32
@@ -510,10 +510,10 @@ SIGNTOOL=signtool.exe
 !ifdef SIGNTOOL_C
 
 !ifndef SIGNTOOL_T
-SIGNTOOL_T=http://timestamp.verisign.com/scripts/timstamp.dll
+SIGNTOOL_T=http://timestamp.digicert.com
 !endif
 !ifndef SIGNTOOL_T_SHA256
-SIGNTOOL_T_SHA256=http://sha256timestamp.ws.symantec.com/sha256/timestamp
+SIGNTOOL_T_SHA256=http://timestamp.digicert.com
 !endif
 
 _CODESIGN=( $(SIGNTOOL) sign /fd sha1 $(SIGNTOOL_O) /t $(SIGNTOOL_T) $(SIGNTOOL_C) /v $@ )
diff --git a/windows/README.md b/windows/README.md
index 75d6fd5ad..0c8614176 100644
--- a/windows/README.md
+++ b/windows/README.md
@@ -94,10 +94,10 @@ work, but have not been tested.
         set SIGNTOOL_O=/du http://example.com/myheimdal
 
   - `SIGNTOOL_T`: SHA1 Timestamp URL for `signtool`.  If not specified,
-    defaults to `http://timestamp.verisign.com/scripts/timstamp.dll`.
+    defaults to `http://timestamp.digicert.com`.
 
   - `SIGNTOOL_T_SHA256`: SHA256 Timestamp URL for `signtool`.  If not
-    specified, defaults to `http://timestamp.geotrust.com/tsa`.
+    specified, defaults to `http://timestamp.digicert.com`.
 
   - `CODESIGN`: SHA1 Code signer command.  This environment variable, if
     defined, overrides the `SIGNTOOL_*` variables.  It should be