# Actalis TLS Server RSA Root CA 2025 root certificate (Actalis)

> Actalis TLS Server RSA Root CA 2025 is a root CA certificate operated by Actalis (RSA 4096, valid until 2050-02-22, SHA-256 6D0E47DF). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

Source: https://ssl.sh/roots/actalis-tls-server-rsa-root-ca-2025/
Last updated: 2026-11-10

Actalis TLS Server RSA Root CA 2025 is a root CA certificate operated by Actalis (RSA 4096, valid until 2050-02-22, SHA-256 6D0E47DF). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

| Field | Value |
|---|---|
| CA owner | Actalis |
| Subject | CN=Actalis TLS Server RSA Root CA 2025,O=Actalis S.p.A.,C=IT |
| SHA-256 | 6D0E47DFDE7CF48308CD4C6C1517DD1AF033DCC72BB0501C04268B03B58A9085 |
| SPKI SHA-256 | 8F94CEDD9A5C168BE13D0511F67E92664E89876224CEF12F7FCEB91A67F8E6F0 |
| Valid from | 2025-02-28 |
| Expires | 2050-02-22 |
| Key | RSA 4096 |
| Signature algorithm | sha512WithRSAEncryption |
| Serial number | 4FD71E2003B285BC62A5111F929D1708 |
| SHA-1 (Windows thumbprint) | F7796B0DD0729B93FFD979E65FDF9C2C1CD9E8A1 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Not included | No | - | - |
| Mozilla | Not included | No | - | - |
| Apple | Not included | No | - | - |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication |

The CCADB lists no EV policy OID for Actalis TLS Server RSA Root CA 2025.

## Intermediate CAs issued by this root

The CCADB lists 1 intermediate CA certificates signed directly by Actalis TLS Server RSA Root CA 2025: 1 currently valid, 0 expired and 0 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| AgID CA TLS SERVER OV RSA 2026 | Actalis | 2029-08-03 | Valid | D9BA1E04F6B4D862077C205368EAAE255350E6F44DA74578AFC1C2A424C8A2A5 |

## Cross-signed versions

2 certificate(s) in the CCADB have the same subject and public key as Actalis TLS Server RSA Root CA 2025 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Actalis TLS Server RSA Root CA 2025, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Actalis Authentication Root CA | Actalis | 2030-09-22 | Valid | 944D87943C5B47F4DBCE29F55CF92CDA8F27556BE6237D1C51D1B7E574F189D0 |
| Actalis Authentication Root CA | Actalis | 2030-09-22 | Revoked | B9F12DE9F1B76B86A6B2875D6D83D65EF32A74459EE89A6E1A1540A7468C8BBF |

## What happens when it expires

Actalis TLS Server RSA Root CA 2025 is valid until 2050-02-22, about 23.3 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Actalis TLS Server RSA Root CA 2025 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Microsoft trust it for TLS server authentication; Chrome, Mozilla, Apple do not.

**When does Actalis TLS Server RSA Root CA 2025 expire?**

On 2050-02-22, about 23.3 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Actalis TLS Server RSA Root CA 2025 issued?**

The CCADB lists 1: 1 valid, 0 expired and 0 revoked. The newest valid one is AgID CA TLS SERVER OV RSA 2026, valid until 2029-08-03.

**Is Actalis TLS Server RSA Root CA 2025 cross-signed?**

Yes. The CCADB has 2 cross-certificate(s) with its subject and key, signed by Actalis Authentication Root CA; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).