# Actalis TLS Server ECC Root CA 2025 root certificate (Actalis)

> Actalis TLS Server ECC Root CA 2025 is a root CA certificate operated by Actalis (ECDSA P-384, valid until 2050-02-22, SHA-256 4EFAADA2). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

Source: https://ssl.sh/roots/actalis-tls-server-ecc-root-ca-2025/
Last updated: 2026-11-10

Actalis TLS Server ECC Root CA 2025 is a root CA certificate operated by Actalis (ECDSA P-384, valid until 2050-02-22, SHA-256 4EFAADA2). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

| Field | Value |
|---|---|
| CA owner | Actalis |
| Subject | CN=Actalis TLS Server ECC Root CA 2025,O=Actalis S.p.A.,C=IT |
| SHA-256 | 4EFAADA2543E1E02666998574B3BAD96AE264088FA5917F75D32E7A609D1869C |
| SPKI SHA-256 | CCA4EB68C98622E2264879B61562EAD139559C91FE6B6AB3081EB19631426855 |
| Valid from | 2025-02-28 |
| Expires | 2050-02-22 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | 3B1F6D5F9D28D851CA41F36F98EA56D1 |
| SHA-1 (Windows thumbprint) | FC2E01CE1F63A4A43F542BF2C1D8E612E1826FEB |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Not included | No | - | - |
| Mozilla | Not included | No | - | - |
| Apple | Not included | No | - | - |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication |

The CCADB lists no EV policy OID for Actalis TLS Server ECC Root CA 2025.

## Intermediate CAs issued by this root

The CCADB lists no intermediate CA certificate signed directly by Actalis TLS Server ECC Root CA 2025.


## Cross-signed versions

2 certificate(s) in the CCADB have the same subject and public key as Actalis TLS Server ECC Root CA 2025 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Actalis TLS Server ECC Root CA 2025, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Actalis Authentication Root CA | Actalis | 2030-09-22 | Valid | 471F644699FD038E07D73D6E980586AA232FA7DCAD57380B0C89EDD1DCFDB61E |
| Actalis Authentication Root CA | Actalis | 2030-09-22 | Revoked | E3C737BC523C046F08F38F89410E7D07B41584E31B7341FF9D4B3BF18F2D7795 |

## What happens when it expires

Actalis TLS Server ECC Root CA 2025 is valid until 2050-02-22, about 23.3 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Actalis TLS Server ECC Root CA 2025 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Microsoft trust it for TLS server authentication; Chrome, Mozilla, Apple do not.

**When does Actalis TLS Server ECC Root CA 2025 expire?**

On 2050-02-22, about 23.3 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Actalis TLS Server ECC Root CA 2025 issued?**

The CCADB lists no intermediate certificate signed directly by Actalis TLS Server ECC Root CA 2025.

**Is Actalis TLS Server ECC Root CA 2025 cross-signed?**

Yes. The CCADB has 2 cross-certificate(s) with its subject and key, signed by Actalis Authentication Root CA; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).