# ACCVRAIZ1 root certificate (ACCV (Spain))

> ACCVRAIZ1 is a root CA certificate operated by ACCV (Spain) (RSA 4096, valid until 2030-12-31, SHA-256 9A6EC012). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/accv-accvraiz1/
Last updated: 2026-11-10

ACCVRAIZ1 is a root CA certificate operated by ACCV (Spain) (RSA 4096, valid until 2030-12-31, SHA-256 9A6EC012). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | ACCV (Spain) |
| Subject | C=ES,O=ACCV,OU=PKIACCV,CN=ACCVRAIZ1 |
| SHA-256 | 9A6EC012E1A7DA9DBE34194D478AD7C0DB1822FB071DF12981496ED104384113 |
| SPKI SHA-256 | 05570AE6EB0FCEB4210E6DB79486B7094CAF200401E149B6677441B5F25E449B |
| Valid from | 2011-05-05 |
| Expires | 2030-12-31 |
| Key | RSA 4096 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 5EC3B7A6437FA4E0 |
| SHA-1 (Windows thumbprint) | 93057A8815C64FCE882FFA9116522878BC536417 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.15.4 / Firefox 27; Inclusion bug: #811352 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email; Not-before cutoff: 2025-09-15 (Code Signing, Secure Email) |

The CCADB lists no EV policy OID for ACCVRAIZ1.

## Intermediate CAs issued by this root

The CCADB lists 8 intermediate CA certificates signed directly by ACCVRAIZ1: 3 currently valid, 0 expired and 5 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| ACCV ROOT RSA TLS 2024 | Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) | 2030-11-30 | Valid | 4F296B826C686FC481DBCCE72C43A0AD6E5A895545BFE2C429D0A4AB866B048E |
| ACCV RSA1 TLS | Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) | 2030-11-30 | Valid | 11F9571C30C2DE232753D5B158C54F77B0A02DFF417135752D32E98B89BC9719 |
| ACCVCA-120 | Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) | 2026-12-31 | Valid | 2DE620F2D1200AA90B16C3CCF670FD7ED14379AB06FA8B031CFEF8DA051EA5A2 |
| ACCVCA-110 | Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) | 2026-12-31 | Revoked | E9327A347CBE1CB94CDC9AA54CB31B6E43D68968D17D09CE326A091BFC2F0B11 |
| ACCVCA-130 | Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) | 2026-12-31 | Revoked | 572BF899FD774362DC19219625ECC157BB55434EA5166D5758DC4B4F890D6653 |
| ACCVCA-130 | Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) | 2026-12-31 | Revoked | 8F7CC455E9A5507804120655D7139186253E43B00422E734263A0769D2F89F7D |
| ACCVCA-120 | Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) | 2026-12-31 | Revoked | 3BC51856040AD7FF6683AA85A0D34F9EA680CD23C37CB8A0423B0F89A24405B9 |
| ACCVCA-110 | Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) | 2026-12-31 | Revoked | 1345C2D39AE4B65CCA71E88E9A2B29C71DC913F952E935A812B004DBA7AE7957 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as ACCVRAIZ1 with a different issuer, so a client has to carry ACCVRAIZ1 itself in its root store to trust it.


## What happens when it expires

ACCVRAIZ1 is valid until 2030-12-31, about 4.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is ACCVRAIZ1 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does ACCVRAIZ1 expire?**

On 2030-12-31, about 4.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has ACCVRAIZ1 issued?**

The CCADB lists 8: 3 valid, 0 expired and 5 revoked. The newest valid one is ACCV ROOT RSA TLS 2024, valid until 2030-11-30.

**Is ACCVRAIZ1 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).