# Amazon Root CA 2 root certificate (Amazon Trust Services)

> Amazon Root CA 2 is a root CA certificate operated by Amazon Trust Services (RSA 4096, valid until 2040-05-26, SHA-256 1BA5B2AA). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/amazon-root-ca-2/
Last updated: 2026-11-10

Amazon Root CA 2 is a root CA certificate operated by Amazon Trust Services (RSA 4096, valid until 2040-05-26, SHA-256 1BA5B2AA). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Amazon Trust Services |
| Subject | CN=Amazon Root CA 2,O=Amazon,C=US |
| SHA-256 | 1BA5B2AA8C65401A82960118F80BEC4F62304D83CEC4713A19C39C011EA46DB4 |
| SPKI SHA-256 | 7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461 |
| Valid from | 2015-05-26 |
| Expires | 2040-05-26 |
| Key | RSA 4096 |
| Signature algorithm | sha384WithRSAEncryption |
| Serial number | 66C9FD29635869F0A0FE58678F85B26BB8A37 |
| SHA-1 (Windows thumbprint) | 5A8CEF45D7A69859767A8C8B4496B578CF474B1A |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2027-09-14 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.28.1 / Firefox 51; Inclusion bug: #1172401 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Document Signing, Encrypting File System, Secure Email, Time Stamping; Not-before cutoff: 2021-08-01 (Code Signing) |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2027-09-14 (sct_not_after). The CCADB lists EV policy OID 2.23.140.1.1 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 5 intermediate CA certificates signed directly by Amazon Root CA 2: 5 currently valid, 0 expired and 0 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Amazon RSA 4096 M05 | Amazon Trust Services | 2033-01-13 | Valid | 8714CD260F39B865E4B0ADF16ECBAA748AB0ABE494980E80E196A6DB1B170B5B |
| Amazon RSA 4096 M03 | DigiCert | 2030-08-23 | Valid | 41BDC074EB9531EC81FEF08D9FFA16536F61FC59789265E95E89A4982AEF3F91 |
| Amazon RSA 4096 M01 | DigiCert | 2030-08-23 | Valid | 40FE28DC925D1A8A6B8F861863EB57CD30C6776416AB8A99920BAC7C925A4174 |
| Amazon RSA 4096 M04 | DigiCert | 2030-08-23 | Valid | 3B6FAB0AB11C14EEF9031969E0ADB037C8FCC3366728A6567623D3C26B3632CB |
| Amazon RSA 4096 M02 | DigiCert | 2030-08-23 | Valid | 2CC39F6789B967B0282AEACA4548F602A1B274E90D260773E9E7B0F7C0F13432 |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as Amazon Root CA 2 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Amazon Root CA 2, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Starfield Services Root Certificate Authority - G2 | Amazon Trust Services | 2037-12-31 | Valid | 8B358466D66126312120645A5875A6A57E3C81D98476A967604244254EAC00F0 |

## What happens when it expires

Amazon Root CA 2 is valid until 2040-05-26, about 13.5 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2027-09-14.

## FAQ

**Is Amazon Root CA 2 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2027-09-14.

**When does Amazon Root CA 2 expire?**

On 2040-05-26, about 13.5 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Amazon Root CA 2 issued?**

The CCADB lists 5: 5 valid, 0 expired and 0 revoked. The newest valid one is Amazon RSA 4096 M05, valid until 2033-01-13.

**Is Amazon Root CA 2 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by Starfield Services Root Certificate Authority - G2; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).