Certificate authority
TrustAsia: Chinese CA, new TLS roots and Certum cross-sign
Details
- CCADB CA owner
- TrustAsia Technologies, Inc.
- Country
- CN
- Country (CCADB)
- China
- ACME
- No
- Free certificates
- Yes
- Products
- DV OV EV wildcard multi-domain S/MIME code-signing
- Roots
- 4
- Roots trusted for TLS
- Chrome 2 · Mozilla 4 · Apple 0 · Microsoft 0
- Intermediates under its roots
- 50 (48 valid)
- Auditor
- SunRise CPAs / DFK International
- CAA
trustasia.com
TrustAsia is a Chinese certificate authority based in Shanghai, and the main issuer behind Tencent Cloud's free certificates. Its certificates used to chain to DigiCert Global Root G2; it now has its own roots in the Mozilla and Chrome stores and began switching new certificates to them in 2026.
Owner and headquarters
TrustAsia's own website certificate is an EV certificate for 亚数信息科技（上海）有限公司, registered in Xuhui District, Shanghai. The CCADB lists the CA owner as TrustAsia Technologies, Inc., with country CN.
Root certificates
As of November 2026, CCADB lists four TrustAsia roots. TrustAsia TLS RSA Root CA (RSA 4096) and TrustAsia TLS ECC Root CA (ECDSA P-384), valid from 2024-05-15 to 2044-05-15, are trusted for TLS by Chrome and Mozilla. TrustAsia Global Root CA G3 and G4 (2021–2046) are trusted for TLS by Mozilla only. None are in the Apple or Microsoft stores yet, which is why TrustAsia's new root is distributed with a cross-certificate from Certum Trusted Network CA: clients that trust Certum but not TrustAsia can still build a path.
Certificate products
DV, OV and EV TLS certificates (TrustAsia's own site uses an EV certificate), wildcard and multi-domain variants, S/MIME (Mozilla includes its S/MIME roots) and code signing. Its website also promotes SM2 (国密) certificates and certificate automation and management services.
ACME support
We could not find a public ACME directory documented on TrustAsia's website as of November 2026. TrustAsia promotes its own certificate management API and automation tools instead; cloud platforms that resell TrustAsia certificates provide their own automation.
Free certificates
TrustAsia certificates are the basis of free DV certificates on Chinese cloud platforms: Tencent Cloud's announcement says its free certificates, except wildcards, are issued primarily by TrustAsia. TrustAsia itself doesn't run a public free ACME service.
Notable incidents and changes
The main change is the root migration. According to Tencent Cloud, from 2026-01-27 new TrustAsia certificates gradually moved from a chain ending at DigiCert Global Root G2 to TrustAsia TLS RSA Root CA, with Certum Trusted Network CA as the cross-signing root. Tencent Cloud warned that compatibility may vary on some older operating systems, so test old Android, Java and embedded clients after renewing.
CAA records
The CCADB lists 3 CAA issuer domain(s) recognized by the currently valid intermediate certificates of TrustAsia. One issue record with any of them lets TrustAsia issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.
Copy-ready record(s) for the first 3 domain(s):
example.com. CAA 0 issue "trustasia.com"
example.com. CAA 0 issue "certum.eu"
example.com. CAA 0 issue "certum.pl"| Domain | Valid intermediates |
|---|---|
trustasia.com | 67 |
certum.eu | 2 |
certum.pl | 2 |
For issuewild, iodef or DNS-provider formats, use the CAA record generator: CAA Generator
Root certificates (CCADB)
TrustAsia has 4 root certificate(s) in the CCADB TLS report. Together they have signed 50 intermediate CA certificates, 48 of them still valid.
Roots this CA owner has in the CCADB TLS Server Authentication report, with current status in each root store.
- trusted for TLS
- included with limits (NotBefore / no TLS bit)
- removed or blocked
- not included
| Root certificate | Key | Expires | Ch | Mo | Ap | MS | Intermediates |
|---|---|---|---|---|---|---|---|
| TrustAsia Global Root CA G3 | RSA 4096 | 2046-05-19 | Not included | Included | Not included | Not included | 8 (8) |
| TrustAsia Global Root CA G4 | ECDSA P-384 | 2046-05-19 | Not included | Included | Not included | Not included | 8 (8) |
| TrustAsia TLS ECC Root CA | ECDSA P-384 | 2044-05-15 | Included | Included | Not included | Not included | 17 (16) |
| TrustAsia TLS RSA Root CA | RSA 4096 | 2044-05-15 | Included | Included | Not included | Not included | 17 (16) |
Valid intermediate CAs operated by TrustAsia under roots that other CAs own (CCADB; number of valid intermediates in brackets):
Audits
Audit data the CCADB records for the TLS roots of TrustAsia. Auditor(s): SunRise CPAs / DFK International. The most recent audit period ended on 2025-07-31.
| Audit | Scheme | Period | Statement | Report |
|---|---|---|---|---|
| Standard audit | WebTrust | 2024-08-01 – 2025-07-31 | 2025-10-11 | cpacanada.ca |
| Network security | WebTrust | 2024-08-01 – 2025-07-31 | 2025-10-11 | cpacanada.ca |
| TLS Baseline Requirements | WebTrust | 2024-08-01 – 2025-07-31 | 2025-10-11 | cpacanada.ca |
| TLS EV Guidelines | WebTrust | 2024-08-01 – 2025-07-31 | 2025-10-11 | cpacanada.ca |
CP/CPS documents
Certificate Policy and Certification Practice Statement links that TrustAsia has disclosed in the CCADB for its TLS roots, with effective dates:
- CP/CPS: https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.2.0.pdf (effective 2026-07-29)
- Markdown CP/CPS: https://repository.trustasia.com/repo/cps/adoc/TrustAsia-Global-CP-CPS_EN_V2.2.0.adoc (effective 2026-07-29)
- Document repository: https://repository.trustasia.com/
Report a certificate problem
To report a mis-issued certificate, a compromised private key or other abuse, use the channels TrustAsia lists in the CCADB (replace [at] and [dot] in addresses):
revoke[at]trustasia[dot]com
Incident reports
CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “TrustAsia”:
ACME directories (CCADB)
DV ACME directory URLs that TrustAsia has disclosed in the CCADB for its valid certificates:
https://acme.trustcenter.trustasia.com/acme/v2/directory
FAQ
What CAA record allows TrustAsia to issue certificates?
Publish example.com. CAA 0 issue "trustasia.com". The CCADB lists 3 recognized domain(s) for TrustAsia: trustasia.com, certum.eu, certum.pl.
Who audits TrustAsia?
SunRise CPAs / DFK International, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2024-08-01 to 2025-07-31; the statement is dated 2025-10-11.
How do I report a problem certificate to TrustAsia?
Use the channel(s) listed in the CCADB: revoke[at]trustasia[dot]com.
How many root certificates does TrustAsia have?
4 in the CCADB TLS report. Trusted for TLS: Chrome 2, Mozilla 4, Apple 0, Microsoft 0. They have signed 50 intermediates, 48 of them still valid.