# Actalis Authentication Root CA root certificate (Actalis)

> Actalis Authentication Root CA is a root CA certificate operated by Actalis (RSA 4096, valid until 2030-09-22, SHA-256 55926084). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/actalis-authentication-root-ca/
Last updated: 2026-11-10

Actalis Authentication Root CA is a root CA certificate operated by Actalis (RSA 4096, valid until 2030-09-22, SHA-256 55926084). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Actalis |
| Subject | CN=Actalis Authentication Root CA,O=Actalis S.p.A./03358520967,L=Milan,C=IT |
| SHA-256 | 55926084EC963A64B96E2ABE01CE0BA86A64FBFEBCC7AAB5AFC155B37FD76066 |
| SPKI SHA-256 | 25D4913CF587097414D29D26F6C1B1942CD6D64EAF45D0FCF81526ADBA96D324 |
| Valid from | 2011-09-22 |
| Expires | 2030-09-22 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 570A119742C4E3CC |
| SHA-1 (Windows thumbprint) | F373B387065A28848AF2F34ACE192BDDC78E9CAC |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: 1.3.159.1.17.1; First included in: NSS 3.13.6 / Firefox 16; Inclusion bug: #1176188 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email, Time Stamping |

Mozilla treats it as an EV root for policy OID 1.3.159.1.17.1.

## Intermediate CAs issued by this root

The CCADB lists 41 intermediate CA certificates signed directly by Actalis Authentication Root CA: 12 currently valid, 1 expired and 28 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Actalis TLS Server RSA Root CA 2025 | Actalis | 2030-09-22 | Valid | 944D87943C5B47F4DBCE29F55CF92CDA8F27556BE6237D1C51D1B7E574F189D0 |
| Actalis TLS Server ECC Root CA 2025 | Actalis | 2030-09-22 | Valid | 471F644699FD038E07D73D6E980586AA232FA7DCAD57380B0C89EDD1DCFDB61E |
| Actalis SMIME RSA Root CA 2025 | Actalis | 2030-09-22 | Valid | 180FE239D04EE0300095205970D2BD4928A257319A46EB6D2FC42C5564F6CB68 |
| AgID CA1 | Actalis | 2030-09-22 | Valid | 790EC428504A61F273E4FCF7FFD4D56991EDC02D4402FBBD8914E149FA278C1D |
| Actalis DV Server ACME CA G1 | Actalis | 2030-09-22 | Valid | C0A9FB425D0EDEBC72BC6C47AD3D3A2B68245ED1D59A5883BF19CE9F8C4DED1F |
| Actalis Time Stamping CA G1 | Actalis | 2030-09-22 | Valid | AA0CA7B6C6A4DD5335761A7213801B3D2D1829CDD0A72F4587F8830804A03B7E |
| AgID CA SSL SERVER | Actalis | 2030-09-22 | Valid | 8B7ED5358484781F4C08376B183B018C957908CAAC32AA72ACD02E51707A58A7 |
| Actalis Client Authentication CA G3 | Actalis | 2030-09-22 | Valid | BB4D3EE661E5029409DB6740B9951494A7F22A7BC0FDC1A1900C07A4781F1419 |
| Actalis Organization Validated Server CA G3 | Actalis | 2030-09-22 | Valid | 931AAA1EC9B2BA0FA59A82302F4F830628C86D9B2D2A50A4D1B2CE895C4CC648 |
| Actalis Code Signing CA G2 | Actalis | 2030-09-22 | Valid | 8CC827CEA1CD8DB79AEB7CD4BEEAE36658AF7B4C0606C257B7538AB1E710BC6A |
| Actalis Domain Validation Server CA G3 | Actalis | 2030-09-22 | Valid | 3450B6D38290C3CA5D7BB38B71495BBF72C6D0C44DBA292245F9BCA9843A9FFF |
| Actalis Extended Validation Server CA G3 | Actalis | 2030-09-22 | Valid | 124EAAF26F570C4FB4D89F5D61078F15B885345FCAF0C57F3477D8C63B5AB26F |
| Actalis Authentication CA G3 | Actalis | 2024-02-13 | Expired | A1D25D28941FAFC0C2A6EB9E596A54786E731D0A4A8E321DB9F1CF2C24FDD609 |
| Actalis TLS Server ECC Root CA 2025 | Actalis | 2030-09-22 | Revoked | E3C737BC523C046F08F38F89410E7D07B41584E31B7341FF9D4B3BF18F2D7795 |
| Actalis TLS Server RSA Root CA 2025 | Actalis | 2030-09-22 | Revoked | B9F12DE9F1B76B86A6B2875D6D83D65EF32A74459EE89A6E1A1540A7468C8BBF |
| AgID CA1 | Actalis | 2030-09-22 | Revoked | 0E19FD9967322133BD7A173B4851A90F3FC575A98507113D86C4D5EFE361B06E |
| AgID CA1 | Actalis | 2030-09-22 | Revoked | 68868C3326EDB4865284EE123AACBA98EE634BDC28B443DBB234884A7BB7DBA5 |
| AgID CA1 | Actalis | 2030-09-22 | Revoked | 32322AE2E31A7430BE1D6C04BD8CABFBD240C74D2C9DBE82780DB1F3F73660A6 |
| AgID CA1 | Actalis | 2030-09-22 | Revoked | 404A2B23B25200446CA7213E1AF56635CB93DDF7BEF0D87664BA411B7F4C8E56 |
| AgID CA1 | Actalis | 2030-02-18 | Revoked | F7B09EEA79096A4498F6A2B8D6F1183228A3769EA988050D1B32A380EABC4F9E |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as Actalis Authentication Root CA with a different issuer, so a client has to carry Actalis Authentication Root CA itself in its root store to trust it.


## What happens when it expires

Actalis Authentication Root CA is valid until 2030-09-22, about 3.9 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Actalis Authentication Root CA trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does Actalis Authentication Root CA expire?**

On 2030-09-22, about 3.9 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Actalis Authentication Root CA issued?**

The CCADB lists 41: 12 valid, 1 expired and 28 revoked. The newest valid one is Actalis TLS Server RSA Root CA 2025, valid until 2030-09-22.

**Is Actalis Authentication Root CA cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).