# What Is CA Distrust (Distrust)? Definition and Examples

> CA distrust is a root program's decision to stop trusting certificates from a CA, either entirely or only for certificates issued after a cut-off date.

Source: https://ssl.sh/glossary/distrust/
Last updated: 2026-11-10

CA distrust is the strongest sanction a [root program](https://ssl.sh/glossary/root-program/) can apply. It ranges from removing a root from the trust store, which breaks every certificate under it, to a partial distrust that keeps existing certificates working but rejects new ones, often judged by the timestamp of the earliest [SCT](https://ssl.sh/glossary/sct/) because a CA cannot backdate a time signed by a CT log. Decisions typically follow sustained compliance failures, [misissuance](https://ssl.sh/glossary/misissuance/) or compromise.

## Why it matters
Well-known cases show the pattern. Symantec: Chrome 66 (April 2018) distrusted Symantec certificates issued before 2016-06-01, and Chrome 70 (October 2018) distrusted the old Symantec PKI entirely. Entrust: Chrome 131+ distrusts Entrust TLS certificates whose earliest SCT is after 2024-11-11; Mozilla's cut-off was 2024-11-30 and Apple's 2024-11-15; Sectigo later acquired Entrust's public certificate business (announced 2025-01-29). Chunghwa Telecom and NetLock: Chrome 139+ distrusts their certificates with SCTs after 2025-07-31. eMudhra: on 2026-10-20 Google and Mozilla confirmed compromised eMudhra intermediate CAs, and Chrome removed the "emSign ECC Root CA - G3" root, rolled out on 2026-10-27. A CA choice is therefore never permanent; keep automation able to switch CAs.

## Example
A site renews with an affected CA after the cut-off date. Visitors on the distrusting browser see NET::ERR_CERT_AUTHORITY_INVALID, while the CA's older certificates, and other browsers, still work, which makes the failure confusing to diagnose.

## Common misconceptions
- **Distrust immediately breaks all of a CA's certificates.** Partial distrust leaves certificates issued before the cut-off working until they expire.
- **Buying from a reseller protects you.** Resellers sell certificates from an underlying CA; if that CA is distrusted, so are the certificates.
- **Distrust follows a single mistake.** Most cases follow a pattern of incidents and poor responses, or a serious compromise.

## Related terms

- [根证书计划](https://ssl.sh/zh/glossary/root-program/): 根证书计划是浏览器或操作系统厂商用来决定其信任库收录、限制或移除哪些根 CA 的政策与流程。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [SCT](https://ssl.sh/zh/glossary/sct/): SCT 是 CT 日志签发的承诺凭证，表示它会把某张证书收录进公开日志，浏览器以此确认证书已提交记录。
- [错误签发](https://ssl.sh/zh/glossary/misissuance/): 错误签发是指 CA 违反 Baseline Requirements 或根证书计划政策签发证书，从验证缺陷到字段格式错误都算在内。
- [信任库](https://ssl.sh/zh/glossary/trust-store/): 信任库是操作系统、浏览器或编程语言运行时内置的一组根 CA 证书，验证证书链时以它们作为信任锚。
- [证书透明度](https://ssl.sh/zh/glossary/certificate-transparency/): 证书透明度（CT）是一套公开、只可追加的日志系统，记录所有公开信任的 TLS 证书，让任何人都能审计 CA 签发了什么。
- [根证书](https://ssl.sh/zh/glossary/root-certificate/): 根证书是位于证书链顶端、由 CA 自签名的证书，预装在操作系统或浏览器的信任库中，作为验证其他证书的信任锚。