# TrustAsia: Chinese CA, new TLS roots and Certum cross-sign > TrustAsia, the Shanghai CA: 2024 roots in Chrome and Mozilla, the 2026 switch from a DigiCert chain to its own root, and Tencent Cloud's free certificates. Source: https://ssl.sh/cas/trustasia/ Last updated: 2026-11-10 TrustAsia is a Chinese certificate authority based in Shanghai, and the main issuer behind Tencent Cloud's free certificates. Its certificates used to chain to [DigiCert](https://ssl.sh/cas/digicert/) Global Root G2; it now has its own roots in the Mozilla and Chrome stores and began switching new certificates to them in 2026. ## Owner and headquarters TrustAsia's own website certificate is an EV certificate for 亚数信息科技（上海）有限公司, registered in Xuhui District, Shanghai. The CCADB lists the CA owner as TrustAsia Technologies, Inc., with country CN. ## Root certificates As of November 2026, CCADB lists four TrustAsia roots. TrustAsia TLS RSA Root CA (RSA 4096) and TrustAsia TLS ECC Root CA (ECDSA P-384), valid from 2024-05-15 to 2044-05-15, are trusted for TLS by Chrome and Mozilla. TrustAsia Global Root CA G3 and G4 (2021–2046) are trusted for TLS by Mozilla only. None are in the Apple or Microsoft stores yet, which is why TrustAsia's new root is distributed with a cross-certificate from [Certum](https://ssl.sh/cas/certum/) Trusted Network CA: clients that trust Certum but not TrustAsia can still build a path. ## Certificate products DV, OV and EV TLS certificates (TrustAsia's own site uses an EV certificate), wildcard and multi-domain variants, S/MIME (Mozilla includes its S/MIME roots) and code signing. Its website also promotes SM2 (国密) certificates and certificate automation and management services. ## ACME support We could not find a public ACME directory documented on TrustAsia's website as of November 2026. TrustAsia promotes its own certificate management API and automation tools instead; cloud platforms that resell TrustAsia certificates provide their own automation. ## Free certificates TrustAsia certificates are the basis of free DV certificates on Chinese cloud platforms: Tencent Cloud's announcement says its free certificates, except wildcards, are issued primarily by TrustAsia. TrustAsia itself doesn't run a public free ACME service. ## Notable incidents and changes The main change is the root migration. According to Tencent Cloud, from 2026-01-27 new TrustAsia certificates gradually moved from a chain ending at DigiCert Global Root G2 to TrustAsia TLS RSA Root CA, with Certum Trusted Network CA as the cross-signing root. Tencent Cloud warned that compatibility may vary on some older operating systems, so test old Android, Java and embedded clients after renewing. ## Root certificates (CCADB) TrustAsia has 4 root certificate(s) in the CCADB TLS report. Together they have signed 50 intermediate CA certificates, 48 of them still valid. | Root certificate | Key | Expires | Chrome | Mozilla | Apple | Microsoft | Intermediates | SHA-256 | |---|---|---|---|---|---|---|---|---| | TrustAsia Global Root CA G3 | RSA 4096 | 2046-05-19 | Not included | Included | Not included | Not included | 8 | E0D3226AEB1163C2E48FF9BE3B50B4C6431BE7BB1EACC5C36B5D5EC509039A08 | | TrustAsia Global Root CA G4 | ECDSA P-384 | 2046-05-19 | Not included | Included | Not included | Not included | 8 | BE4B56CB5056C0136A526DF444508DAA36A0B54F42E4AC38F72AF470E479654C | | TrustAsia TLS ECC Root CA | ECDSA P-384 | 2044-05-15 | Included | Included | Not included | Not included | 17 | C0076B9EF0531FB1A656D67C4EBE97CD5DBAA41EF44598ACC2489878C92D8711 | | TrustAsia TLS RSA Root CA | RSA 4096 | 2044-05-15 | Included | Included | Not included | Not included | 17 | 06C08D7DAFD876971EB1124FE67F847EC0C7A158D3EA53CBE940E2EA9791F4C3 | Valid intermediate CAs operated by TrustAsia under roots that other CAs own (CCADB; number of valid intermediates in brackets): - Asseco Data Systems S.A.: 2 ## CAA records The CCADB lists 3 CAA issuer domain(s) recognized by the currently valid intermediate certificates of TrustAsia. One issue record with any of them lets TrustAsia issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them. ``` example.com. CAA 0 issue "trustasia.com" example.com. CAA 0 issue "certum.eu" example.com. CAA 0 issue "certum.pl" ``` ## Audits Audit data the CCADB records for the TLS roots of TrustAsia. Auditor(s): SunRise CPAs / DFK International. The most recent audit period ended on 2025-07-31. - Standard audit: WebTrust 2024-08-01 – 2025-07-31 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14) - Network security: WebTrust 2024-08-01 – 2025-07-31 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd) - TLS Baseline Requirements: WebTrust 2024-08-01 – 2025-07-31 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=76914bf6-9b3a-4c5f-b739-419a1152c6ca) - TLS EV Guidelines: WebTrust 2024-08-01 – 2025-07-31 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=411bce13-7fd2-46bf-a31b-b3cec80e9ff9) ## CP/CPS documents Certificate Policy and Certification Practice Statement links that TrustAsia has disclosed in the CCADB for its TLS roots, with effective dates: - CP/CPS: https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.2.0.pdf - Markdown CP/CPS: https://repository.trustasia.com/repo/cps/adoc/TrustAsia-Global-CP-CPS_EN_V2.2.0.adoc ## Report a certificate problem To report a mis-issued certificate, a compromised private key or other abuse, use the channels TrustAsia lists in the CCADB (replace [at] and [dot] in addresses): - revoke[at]trustasia[dot]com ## Incident reports CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “TrustAsia”: https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&product=CA+Program&component=CA+Certificate+Compliance&short_desc_type=allwords&short_desc=TrustAsia&order=changeddate+DESC ## FAQ **What CAA record allows TrustAsia to issue certificates?** Publish example.com. CAA 0 issue "trustasia.com". The CCADB lists 3 recognized domain(s) for TrustAsia: trustasia.com, certum.eu, certum.pl. **Who audits TrustAsia?** SunRise CPAs / DFK International, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2024-08-01 to 2025-07-31; the statement is dated 2025-10-11. **How do I report a problem certificate to TrustAsia?** Use the channel(s) listed in the CCADB: revoke[at]trustasia[dot]com. **How many root certificates does TrustAsia have?** 4 in the CCADB TLS report. Trusted for TLS: Chrome 2, Mozilla 4, Apple 0, Microsoft 0. They have signed 50 intermediates, 48 of them still valid. Sources: CCADB All Certificate Information (V5), List of CAA Identifiers, List of CA problem reporting mechanisms and TLS Server Authentication report (ccadb.org/resources).