# Google Trust Services: Google's CA, GTS roots and free ACME

> Google Trust Services is Google's public CA: GTS Root R1–R4, free DV certificates via its ACME API with Google Cloud EAB keys, and Chrome root store status.

Source: https://ssl.sh/cas/google-trust-services/
Last updated: 2026-11-10

Google Trust Services (GTS) is Google's own public certificate authority. It issues the certificates for Google's services and, through a public [ACME](https://ssl.sh/glossary/acme/) API, free DV certificates for anyone, making it one of the free alternatives to [Let's Encrypt](https://ssl.sh/cas/lets-encrypt/).

## Owner and headquarters

GTS is operated by Google; the CA owner in the CCADB is Google Trust Services LLC, a US entity. Its website at pki.goog says the service is built on Google's distributed infrastructure.

## Root certificates

As of November 2026, CCADB shows GTS Root R1 (RSA 4096) and GTS Root R4 (ECDSA P-384), both valid from 2016-06-22 to 2036-06-22, trusted for TLS by Chrome, Mozilla, Apple and Microsoft. GTS Root R2 (RSA) and R3 (ECDSA) are still in the Mozilla, Apple and Microsoft stores but listed as removed from Chrome's. CCADB also lists under GTS a root named "GlobalSign" (ECDSA P-256, valid until 2038-01-19), plus older cross-signed versions of the GTS roots that Apple and Mozilla have removed. The full table is below.

## Certificate products

GTS issues DV certificates only, including multi-domain and [wildcard](https://ssl.sh/glossary/wildcard-certificate/) names. It doesn't sell OV or EV certificates, code signing or S/MIME.

## ACME support

The production ACME directory is `https://dv.acme-v02.api.pki.goog/directory`, with a staging directory for tests. Any ACME client that supports External Account Binding works, for example certbot or acme.sh. You enable the Public CA API in a Google Cloud project, request an EAB key ID and HMAC, and register once; Google's documentation notes that one ACME account can be registered per EAB key.

## Free certificates

Certificates from the GTS ACME API are free, as pki.goog states, and the site doesn't need to run on Google Cloud. It's a common second CA for redundancy: if one CA has an outage or rate-limits you, your ACME client can fall back to the other.

## Notable incidents and changes

We found no major distrust event involving GTS. The visible changes are root-store housekeeping: Chrome's store dropped GTS Root R2 and R3, keeping R1 and R4, and Apple and Mozilla removed older cross-signed copies of the GTS roots. Check that your chain ends at a root your clients trust, especially on old Android or embedded devices.


## Root certificates (CCADB)

Google Trust Services has 10 root certificate(s) in the CCADB TLS report. Together they have signed 43 intermediate CA certificates, 16 of them still valid.

| Root certificate | Key | Expires | Chrome | Mozilla | Apple | Microsoft | Intermediates | SHA-256 |
|---|---|---|---|---|---|---|---|---|
| GlobalSign | ECDSA P-256 | 2038-01-19 | Included | Included | Included | Included | 11 | B085D70B964F191A73E4AF0D54AE7A0E07AAFDAF9B71DD0862138AB7325A24A2 |
| GlobalSign | ECDSA P-256 | 2038-01-19 | Not included | Removed | Removed | Included | 0 | BEC94911C2955676DB6C0A550986D76E3BA005667C442C9762B4FBB773DE228C |
| GTS Root R1 | RSA 4096 | 2036-06-22 | Included | Included | Included | Included | 10 | D947432ABDE7B7FA90FC2E6B59101B1280E0E1C7E4E40FA3C6887FFF57A7F4CF |
| GTS Root R1 | RSA 4096 | 2036-06-22 | Not included | Removed | Removed | Included | 0 | 2A575471E31340BC21581CBD2CF13E158463203ECE94BCF9D3CC196BF09A5472 |
| GTS Root R2 | RSA 4096 | 2036-06-22 | Removed | Included | Included | Included | 6 | 8D25CD97229DBF70356BDA4EB3CC734031E24CF00FAFCFD32DC76EB5841C7EA8 |
| GTS Root R2 | RSA 4096 | 2036-06-22 | Not included | Removed | Removed | Included | 0 | C45D7BB08E6D67E62E4235110B564E5F78FD92EF058C840AEA4E6455D7585C60 |
| GTS Root R3 | ECDSA P-384 | 2036-06-22 | Removed | Included | Included | Included | 6 | 34D8A73EE208D9BCDB0D956520934B4E40E69482596E8B6F73C8426B010A6F48 |
| GTS Root R3 | ECDSA P-384 | 2036-06-22 | Not included | Removed | Removed | Included | 0 | 15D5B8774619EA7D54CE1CA6D0B0C403E037A917F131E8A04E1E6B7A71BABCE5 |
| GTS Root R4 | ECDSA P-384 | 2036-06-22 | Included | Included | Included | Included | 10 | 349DFA4058C5E263123B398AE795573C4E1313C83FE68F93556CD5E8031B3C7D |
| GTS Root R4 | ECDSA P-384 | 2036-06-22 | Not included | Removed | Removed | Included | 0 | 71CCA5391F9E794B04802530B363E121DA8A3043BB26662FEA4DCA7FC951A4BD |

Valid intermediate CAs operated by Google Trust Services under roots that other CAs own (CCADB; number of valid intermediates in brackets):

- GlobalSign nv-sa: 2

## CAA records

The CCADB lists 2 CAA issuer domain(s) recognized by the currently valid intermediate certificates of Google Trust Services. One issue record with any of them lets Google Trust Services issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.

```
example.com. CAA 0 issue "pki.goog"
example.com. CAA 0 issue "globalsign.com"
```

## Audits

Audit data the CCADB records for the TLS roots of Google Trust Services. Auditor(s): Ernst & Young, LLP. The most recent audit period ended on 2025-09-30.

- Standard audit: WebTrust 2024-10-01 – 2025-09-30 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2)
- Network security: WebTrust 2024-10-01 – 2025-09-30 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7)
- TLS Baseline Requirements: WebTrust 2024-10-01 – 2025-09-30 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77)

## CP/CPS documents

Certificate Policy and Certification Practice Statement links that Google Trust Services has disclosed in the CCADB for its TLS roots, with effective dates:

- CP/CPS: https://pki.goog/repo/cp-cps-tls/6.10/GTS-CP-CPS-TLS.html
- CP/CPS: https://pki.goog/repo/cp-cps-smime/6.7/GTS-CP-CPS-SMIME.html

## Report a certificate problem

To report a mis-issued certificate, a compromised private key or other abuse, use the channels Google Trust Services lists in the CCADB (replace [at] and [dot] in addresses):

- https://pki.goog/

## Incident reports

CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “Google Trust”: https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&product=CA+Program&component=CA+Certificate+Compliance&short_desc_type=allwords&short_desc=Google+Trust&order=changeddate+DESC

## FAQ

**Is Google Trust Services free for any website?**

Yes, for DV certificates via its ACME API. You need a Google Cloud project to create the External Account Binding (EAB) key used to register your ACME account, but you don't have to host the site on Google Cloud.

**What CAA record allows Google Trust Services to issue certificates?**

Publish example.com. CAA 0 issue "pki.goog". The CCADB lists 2 recognized domain(s) for Google Trust Services: pki.goog, globalsign.com.

**Who audits Google Trust Services?**

Ernst & Young, LLP, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2024-10-01 to 2025-09-30; the statement is dated 2025-10-30.

**How do I report a problem certificate to Google Trust Services?**

Use the channel(s) listed in the CCADB: https://pki.goog/.

Sources: CCADB All Certificate Information (V5), List of CAA Identifiers, List of CA problem reporting mechanisms and TLS Server Authentication report (ccadb.org/resources).