# Amazon Root CA 4 root certificate (Amazon Trust Services) > Amazon Root CA 4 is a root CA certificate operated by Amazon Trust Services (ECDSA P-384, valid until 2040-05-26, SHA-256 E35D2841). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft. Source: https://ssl.sh/roots/amazon-root-ca-4/ Last updated: 2026-11-10 Amazon Root CA 4 is a root CA certificate operated by Amazon Trust Services (ECDSA P-384, valid until 2040-05-26, SHA-256 E35D2841). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft. | Field | Value | |---|---| | CA owner | Amazon Trust Services | | Subject | CN=Amazon Root CA 4,O=Amazon,C=US | | SHA-256 | E35D28419ED02025CFA69038CD623962458DA5C695FBDEA3C22B0BFB25897092 | | SPKI SHA-256 | F7ECDED5C66047D28ED6466B543C40E0743ABE81D109254DCF845D4C2C7853C5 | | Valid from | 2015-05-26 | | Expires | 2040-05-26 | | Key | ECDSA P-384 | | Signature algorithm | ecdsa-with-SHA384 | | Serial number | 66C9FD7C1BB104C2943E5717B7B2CC81AC10E | | SHA-1 (Windows thumbprint) | F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE | ## Root store status | Root store | Status | Trusted for TLS | Distrust for TLS after | Details | |---|---|---|---|---| | Chrome | Included | Yes | - | - | | Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.28.1 / Firefox 51; Inclusion bug: #1172401 | | Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection | | Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Document Signing, Encrypting File System, Secure Email, Time Stamping; Not-before cutoff: 2021-08-01 (Code Signing) | The CCADB lists EV policy OID 2.23.140.1.1, 2.23.140.1.3 for this root, but Mozilla does not mark it as EV-enabled. ## Intermediate CAs issued by this root The CCADB lists 45 intermediate CA certificates signed directly by Amazon Root CA 4: 39 currently valid, 0 expired and 6 revoked (revoked includes those whose parent was revoked). | Intermediate | Operated by | Expires | Status | SHA-256 | |---|---|---|---|---| | Amazon ECDSA 256 S13 | Amazon Trust Services | 2029-07-07 | Valid | F277D650C63B443D53800C3EAAFE5FB82D2AB7227EEEF46D800F808CAE501031 | | Amazon ECDSA 384 S25 | Amazon Trust Services | 2029-07-07 | Valid | ECCF61E6146D84039AE0763F49B2D7C15022B1426256F92401EE10BF326EA6CB | | Amazon ECDSA 384 S26 | Amazon Trust Services | 2029-07-07 | Valid | EB08D293792D3960AF4EE1449571EF064B6ECFB5033A932C4F4F634927A86A5C | | Amazon ECDSA 256 S12 | Amazon Trust Services | 2029-07-07 | Valid | E71CE592A218FB4FF3EFE3CCF0BA9FA70C663F064B79D1CC631AF2D530C04E36 | | Amazon ECDSA 384 S16 | Amazon Trust Services | 2029-07-07 | Valid | B34E17C32AFC8957FEFF7D0EF5F9FB389D450C32A238E0869642DD21DFC58855 | | Amazon ECDSA 384 S18 | Amazon Trust Services | 2029-07-07 | Valid | 86048C1D12E93D6950D1553485C90EBFA39E0BAD02A435D9724B0A95E5A4241F | | Amazon ECDSA 384 S22 | Amazon Trust Services | 2029-07-07 | Valid | 73F471734E0EAC3D4F5BFFF00E2754AD9ED999F6A1CFEA599945573B55C3ABD4 | | Amazon ECDSA 384 S28 | Amazon Trust Services | 2029-07-07 | Valid | 6B1AB876C341D7FBD6AB569CCFA86090DFADA1A16078F5D65834FDE3DEE1512F | | Amazon ECDSA 384 S27 | Amazon Trust Services | 2029-07-07 | Valid | 5BAF3D78A35B7A9BD839C7AEEB1A5A92B225C620D824F7E537D7EDBCBA41EFAF | | Amazon ECDSA 256 S11 | Amazon Trust Services | 2029-07-07 | Valid | 5A92CB16F3C70B3F64DE8D1FC8FBC8C2517EACC7438C3E7506CCB1C4A22A722D | | Amazon ECDSA 384 S14 | Amazon Trust Services | 2029-07-07 | Valid | 5097C042BA4628C18628FEF301F5798F3BCA5D3097DA3EDF30AF0C2AB4DC2263 | | Amazon ECDSA 384 S20 | Amazon Trust Services | 2029-07-07 | Valid | 4C66F0EFF04D454B70895E85C6B7D90849D0B61DD8F2F0A7C5BDF3542E91A552 | | Amazon ECDSA 384 S23 | Amazon Trust Services | 2029-07-07 | Valid | 47C8737DBFE93C308E418AB1D3F344880D24062158F079E5011826629830DF9B | | Amazon ECDSA 384 S29 | Amazon Trust Services | 2029-07-07 | Valid | 45F561F7C1AA5A9B97B697237F9408D2DF790522541A610DAA578764282D7CB7 | | Amazon ECDSA 384 S15 | Amazon Trust Services | 2029-07-07 | Valid | 2F2BCDCD54F26CEF3878F6E6694CA13016D6A11A1AE82788209B7B196C5D568D | | Amazon ECDSA 384 S21 | Amazon Trust Services | 2029-07-07 | Valid | 25675DC3724EDA70E715CBCB49F7D8609D174A3DFEA511F3F4C72890FC0CDFF3 | | Amazon ECDSA 384 S19 | Amazon Trust Services | 2029-07-07 | Valid | 2082A3883508038D41ECF5DEA56D870F391DBCEBC9C949056F718E8F0BEEC711 | | Amazon ECDSA 384 S24 | Amazon Trust Services | 2029-07-07 | Valid | 17B5DE715F822FE2C03E0386124FDF5508DAADEB2F096BE8F7B1F6B87F9B25B2 | | Amazon ECDSA 256 S10 | Amazon Trust Services | 2029-07-07 | Valid | 0C8BD43FFC55FA1E704F443A4EF09E1B77425006EF4918BE4714CBCD8DE82EC4 | | Amazon ECDSA 384 S17 | Amazon Trust Services | 2029-07-07 | Valid | 0329A16CA4468E1B47C5CA2A58F5F87824508046F15C35267D6B8D2CC69F3FF3 | ## Cross-signed versions 1 certificate(s) in the CCADB have the same subject and public key as Amazon Root CA 4 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Amazon Root CA 4, can still build a chain. | Signed by | CA owner | Expires | Status | SHA-256 | |---|---|---|---|---| | Starfield Services Root Certificate Authority - G2 | Amazon Trust Services | 2037-12-31 | Valid | 543D9B7FC2A6471CD84FCA52C2CF6159DF83EBFCD88D8B08B5AF3F88737F52E6 | ## What happens when it expires Amazon Root CA 4 is valid until 2040-05-26, about 13.5 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. ## FAQ **Is Amazon Root CA 4 trusted by Chrome, Firefox, Safari and Windows?** Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. **When does Amazon Root CA 4 expire?** On 2040-05-26, about 13.5 years after the 2026-11-10 data snapshot. **How many intermediate certificates has Amazon Root CA 4 issued?** The CCADB lists 45: 39 valid, 0 expired and 6 revoked. The newest valid one is Amazon ECDSA 256 S13, valid until 2029-07-07. **Is Amazon Root CA 4 cross-signed?** Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by Starfield Services Root Certificate Authority - G2; 1 of them are still valid. Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).