# Amazon Root CA 3 root certificate (Amazon Trust Services)

> Amazon Root CA 3 is a root CA certificate operated by Amazon Trust Services (ECDSA P-256, valid until 2040-05-26, SHA-256 18CE6CFE). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/amazon-root-ca-3/
Last updated: 2026-11-10

Amazon Root CA 3 is a root CA certificate operated by Amazon Trust Services (ECDSA P-256, valid until 2040-05-26, SHA-256 18CE6CFE). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Amazon Trust Services |
| Subject | CN=Amazon Root CA 3,O=Amazon,C=US |
| SHA-256 | 18CE6CFE7BF14E60B2E347B8DFE868CB31D02EBB3ADA271569F50343B46DB3A4 |
| SPKI SHA-256 | 36ABC32656ACFC645C61B71613C4BF21C787F5CABBEE48348D58597803D7ABC9 |
| Valid from | 2015-05-26 |
| Expires | 2040-05-26 |
| Key | ECDSA P-256 |
| Signature algorithm | ecdsa-with-SHA256 |
| Serial number | 66C9FD5749736663F3B0B9AD9E89E7603F24A |
| SHA-1 (Windows thumbprint) | 0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2027-09-14 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.28.1 / Firefox 51; Inclusion bug: #1172401 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Document Signing, Encrypting File System, Secure Email, Time Stamping |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2027-09-14 (sct_not_after). The CCADB lists EV policy OID 2.23.140.1.1 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 21 intermediate CA certificates signed directly by Amazon Root CA 3: 15 currently valid, 0 expired and 6 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Amazon ECDSA 256 S16 | Amazon Trust Services | 2029-07-07 | Valid | CB57ABC4A4469CC60165E64FBD3D1F74EC92DC7A8B9F105245365526E8092C41 |
| Amazon ECDSA 256 S15 | Amazon Trust Services | 2029-07-07 | Valid | C7D3A628187E718D9701BD318C19F8C7374FDC48BF57B1B3AB269CA5330EDF92 |
| Amazon ECDSA 256 S19 | Amazon Trust Services | 2029-07-07 | Valid | 5CDC5408C7283FEA8501B0735817639531F96B5628D04411B9F72A8D8DA4D958 |
| Amazon ECDSA 256 S14 | Amazon Trust Services | 2029-07-07 | Valid | 4EBE3A5E0561F4F8FBC0B05E99032E7DBC9C18CA1FC07DC323DC9001E18CEB30 |
| Amazon ECDSA 256 S18 | Amazon Trust Services | 2029-07-07 | Valid | 447DB7FB3268D755C43AFEB355D57043083D61AB36ED42780AB014D9B375FBD3 |
| Amazon ECDSA 256 S20 | Amazon Trust Services | 2029-07-07 | Valid | 418EFF55D11EBBC7FAD3ED9CFEC572E3142EBB648477AB296624462171294BF6 |
| Amazon ECDSA 256 S17 | Amazon Trust Services | 2029-07-07 | Valid | 18823FD4F48887972FFE884DFF4EF25742572C64761515E59E21F3F173385835 |
| Amazon ECDSA 256 S21 | Amazon Trust Services | 2029-07-07 | Valid | 050C63D41EBBF16621C8CFACE982A1FAC6F25F11B40AAD23B29098348AECE08C |
| Amazon ECDSA 256 Root EU M1 | Amazon Trust Services | 2033-09-15 | Valid | F35A8A529EE51C24078D36A00B918C5080AEDCA0611E5BE55831B4CB66F2C2F5 |
| Amazon ECDSA 256 M06 | Amazon Trust Services | 2033-01-13 | Valid | 4FF1CF3F6920EEC8D5078ABBA246F198588987DC543B73CD12ABC781125CA0FE |
| Amazon ECDSA 256 M05 | Amazon Trust Services | 2033-01-13 | Valid | 36A77659CA91702BC800B527D12A6B4FD0237D506EDBE4670FD3A56CD0AE4243 |
| Amazon ECDSA 256 M02 | DigiCert | 2030-08-23 | Valid | F9693255933B68159D168AA9A247DA1DC66E23C0620338EF7149E48F83B1AE79 |
| Amazon ECDSA 256 M04 | DigiCert | 2030-08-23 | Valid | D241192CCE57D438986723972DD6F18B5A3A3456A708E8F273D147223AB6FA5D |
| Amazon ECDSA 256 M03 | DigiCert | 2030-08-23 | Valid | 493E78EEE8CCA1F26E6494ED924985AF3FA9E6110EAA61C3214E8D73B4047316 |
| Amazon ECDSA 256 M01 | DigiCert | 2030-08-23 | Valid | 332B101539FA89CA4E228719FE5287AB6869AF31AB21CBF110F5DD3C5994C1C7 |
| Amazon ECDSA 256 S02 | Amazon Trust Services | 2033-05-28 | Revoked | F8D07375A319FF5FB7F7EB9F2B1DEF77D10BF33EFA29A9A64563958A51A11687 |
| Amazon ECDSA 256 S04 | Amazon Trust Services | 2033-05-28 | Revoked | AF381D37CC376F46EAC13FF7CEDF1BB890F87E5A07754B1B0617B9D8C3BF6D79 |
| Amazon ECDSA 256 S01 | Amazon Trust Services | 2033-05-28 | Revoked | 912D7ED2F86EAF8196C85298FE67673352B047B7394AE51C3FED20D2EEB612F4 |
| Amazon ECDSA 256 S05 | Amazon Trust Services | 2033-05-28 | Revoked | 8BB5B3DED8B69610A54149B238A168FC6D77A2BCDB7CEF14E3158D787B039D6A |
| Amazon ECDSA 256 S00 | Amazon Trust Services | 2033-05-28 | Revoked | 6E80F9F44C2A983F16DD6A8F0AEFCA46F95586A7210DD3B77ED859FC9DB160CC |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as Amazon Root CA 3 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Amazon Root CA 3, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Starfield Services Root Certificate Authority - G2 | Amazon Trust Services | 2037-12-31 | Valid | 40C826FDB22BA32A2F9DB4F94770F72B8B1DA9C8FFDA7B11E6F27AF245C89B5E |

## What happens when it expires

Amazon Root CA 3 is valid until 2040-05-26, about 13.5 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2027-09-14.

## FAQ

**Is Amazon Root CA 3 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2027-09-14.

**When does Amazon Root CA 3 expire?**

On 2040-05-26, about 13.5 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Amazon Root CA 3 issued?**

The CCADB lists 21: 15 valid, 0 expired and 6 revoked. The newest valid one is Amazon ECDSA 256 S16, valid until 2029-07-07.

**Is Amazon Root CA 3 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by Starfield Services Root Certificate Authority - G2; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).