Certificate authority
Google Trust Services: Google's CA, GTS roots and free ACME
Details
- CCADB CA owner
- Google Trust Services LLC
- Country
- US
- Country (CCADB)
- United States of America
- ACME
- Yes
- Free certificates
- Yes
- Products
- DV wildcard multi-domain
- Roots
- 10
- Roots trusted for TLS
- Chrome 3 · Mozilla 4 · Apple 5 · Microsoft 10
- Intermediates under its roots
- 43 (16 valid)
- Auditor
- Ernst & Young, LLP
- CAA
pki.goog
Google Trust Services (GTS) is Google's own public certificate authority. It issues the certificates for Google's services and, through a public ACME API, free DV certificates for anyone, making it one of the free alternatives to Let's Encrypt.
Owner and headquarters
GTS is operated by Google; the CA owner in the CCADB is Google Trust Services LLC, a US entity. Its website at pki.goog says the service is built on Google's distributed infrastructure.
Root certificates
As of November 2026, CCADB shows GTS Root R1 (RSA 4096) and GTS Root R4 (ECDSA P-384), both valid from 2016-06-22 to 2036-06-22, trusted for TLS by Chrome, Mozilla, Apple and Microsoft. GTS Root R2 (RSA) and R3 (ECDSA) are still in the Mozilla, Apple and Microsoft stores but listed as removed from Chrome's. CCADB also lists under GTS a root named "GlobalSign" (ECDSA P-256, valid until 2038-01-19), plus older cross-signed versions of the GTS roots that Apple and Mozilla have removed. The full table is below.
Certificate products
GTS issues DV certificates only, including multi-domain and wildcard names. It doesn't sell OV or EV certificates, code signing or S/MIME.
ACME support
The production ACME directory is https://dv.acme-v02.api.pki.goog/directory, with a staging directory for tests. Any ACME client that supports External Account Binding works, for example certbot or acme.sh. You enable the Public CA API in a Google Cloud project, request an EAB key ID and HMAC, and register once; Google's documentation notes that one ACME account can be registered per EAB key.
Free certificates
Certificates from the GTS ACME API are free, as pki.goog states, and the site doesn't need to run on Google Cloud. It's a common second CA for redundancy: if one CA has an outage or rate-limits you, your ACME client can fall back to the other.
Notable incidents and changes
We found no major distrust event involving GTS. The visible changes are root-store housekeeping: Chrome's store dropped GTS Root R2 and R3, keeping R1 and R4, and Apple and Mozilla removed older cross-signed copies of the GTS roots. Check that your chain ends at a root your clients trust, especially on old Android or embedded devices.
CAA records
The CCADB lists 2 CAA issuer domain(s) recognized by the currently valid intermediate certificates of Google Trust Services. One issue record with any of them lets Google Trust Services issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.
Copy-ready record(s) for the first 2 domain(s):
example.com. CAA 0 issue "pki.goog"
example.com. CAA 0 issue "globalsign.com"| Domain | Valid intermediates |
|---|---|
pki.goog | 12 |
globalsign.com | 2 |
For issuewild, iodef or DNS-provider formats, use the CAA record generator: CAA Generator
Root certificates (CCADB)
Google Trust Services has 10 root certificate(s) in the CCADB TLS report. Together they have signed 43 intermediate CA certificates, 16 of them still valid.
Roots this CA owner has in the CCADB TLS Server Authentication report, with current status in each root store.
- trusted for TLS
- included with limits (NotBefore / no TLS bit)
- removed or blocked
- not included
| Root certificate | Key | Expires | Ch | Mo | Ap | MS | Intermediates |
|---|---|---|---|---|---|---|---|
| GlobalSign | ECDSA P-256 | 2038-01-19 | Included | Included | Included | Included | 11 (4) |
| GlobalSign | ECDSA P-256 | 2038-01-19 | Not included | Removed | Removed | Included | 0 (0) |
| GTS Root R1 | RSA 4096 | 2036-06-22 | Included | Included | Included | Included | 10 (4) |
| GTS Root R1 | RSA 4096 | 2036-06-22 | Not included | Removed | Removed | Included | 0 (0) |
| GTS Root R2 | RSA 4096 | 2036-06-22 | Removed | Included | Included | Included | 6 (2) |
| GTS Root R2 | RSA 4096 | 2036-06-22 | Not included | Removed | Removed | Included | 0 (0) |
| GTS Root R3 | ECDSA P-384 | 2036-06-22 | Removed | Included | Included | Included | 6 (1) |
| GTS Root R3 | ECDSA P-384 | 2036-06-22 | Not included | Removed | Removed | Included | 0 (0) |
| GTS Root R4 | ECDSA P-384 | 2036-06-22 | Included | Included | Included | Included | 10 (5) |
| GTS Root R4 | ECDSA P-384 | 2036-06-22 | Not included | Removed | Removed | Included | 0 (0) |
Valid intermediate CAs operated by Google Trust Services under roots that other CAs own (CCADB; number of valid intermediates in brackets):
- GlobalSign nv-sa (2)
Audits
Audit data the CCADB records for the TLS roots of Google Trust Services. Auditor(s): Ernst & Young, LLP. The most recent audit period ended on 2025-09-30.
| Audit | Scheme | Period | Statement | Report |
|---|---|---|---|---|
| Standard audit | WebTrust | 2024-10-01 – 2025-09-30 | 2025-10-30 | cpacanada.ca |
| Network security | WebTrust | 2024-10-01 – 2025-09-30 | 2025-10-30 | cpacanada.ca |
| TLS Baseline Requirements | WebTrust | 2024-10-01 – 2025-09-30 | 2025-10-30 | cpacanada.ca |
CP/CPS documents
Certificate Policy and Certification Practice Statement links that Google Trust Services has disclosed in the CCADB for its TLS roots, with effective dates:
- CP/CPS: https://pki.goog/repo/cp-cps-tls/6.10/GTS-CP-CPS-TLS.html (effective 2026-10-02)
- CP/CPS: https://pki.goog/repo/cp-cps-smime/6.7/GTS-CP-CPS-SMIME.html (effective 2026-10-02)
- Document repository: https://pki.goog/repository
Report a certificate problem
To report a mis-issued certificate, a compromised private key or other abuse, use the channels Google Trust Services lists in the CCADB (replace [at] and [dot] in addresses):
Incident reports
CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “Google Trust”:
ACME directories (CCADB)
DV ACME directory URLs that Google Trust Services has disclosed in the CCADB for its valid certificates:
https://dv.acme-v02.api.pki.goog/directoryhttps://dv-sxg.acme-v02.api.pki.goog/directory
FAQ
Is Google Trust Services free for any website?
Yes, for DV certificates via its ACME API. You need a Google Cloud project to create the External Account Binding (EAB) key used to register your ACME account, but you don't have to host the site on Google Cloud.
What CAA record allows Google Trust Services to issue certificates?
Publish example.com. CAA 0 issue "pki.goog". The CCADB lists 2 recognized domain(s) for Google Trust Services: pki.goog, globalsign.com.
Who audits Google Trust Services?
Ernst & Young, LLP, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2024-10-01 to 2025-09-30; the statement is dated 2025-10-30.
How do I report a problem certificate to Google Trust Services?
Use the channel(s) listed in the CCADB: https://pki.goog/.