# TunTrust Root CA root certificate (ANCE (Tunisia))

> TunTrust Root CA is a root CA certificate operated by ANCE (Tunisia) (RSA 4096, valid until 2044-04-26, SHA-256 2E44102A). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Mozilla, Microsoft.

Source: https://ssl.sh/roots/ance-tunisia-tuntrust-root-ca/
Last updated: 2026-11-10

TunTrust Root CA is a root CA certificate operated by ANCE (Tunisia) (RSA 4096, valid until 2044-04-26, SHA-256 2E44102A). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Mozilla, Microsoft.

| Field | Value |
|---|---|
| CA owner | ANCE (Tunisia) |
| Subject | CN=TunTrust Root CA,O=Agence Nationale de Certification Electronique,C=TN |
| SHA-256 | 2E44102AB58CB85419451C8E19D9ACF3662CAFBC614B6A53960A30F7D0E2EB41 |
| SPKI SHA-256 | C942262C0C7C0A95BB152B71C42556DDBE9A04FA8378373550D2B7CE27D952A3 |
| Valid from | 2019-04-26 |
| Expires | 2044-04-26 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 1302D5E2404C92468616675DB4BBBBB26B3EFC13 |
| SHA-1 (Windows thumbprint) | CFE970840FE0730F9DF60C7F2C4BEE2046349CBB |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.71 / Firefox 94; Inclusion bug: #1587779 |
| Apple | Not included | No | - | - |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication |

The CCADB lists no EV policy OID for TunTrust Root CA.

## Intermediate CAs issued by this root

The CCADB lists 3 intermediate CA certificates signed directly by TunTrust Root CA: 2 currently valid, 0 expired and 1 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| TunTrust Services CA | Agence Nationale de Certification Electronique | 2039-04-26 | Valid | 063627355C941A1C93FC515CBAEF2F173D4A646DDEB139CB8C75C1022222994F |
| TunTrust Root CA | Agence Nationale de Certification Electronique | 2044-04-18 | Valid | BABBCA986946352CF9BF382E880652F4E94DBC4FEDD0F1CC21FA9973C96D65AB |
| TunTrust Qualified CA | Agence Nationale de Certification Electronique | 2039-04-26 | Revoked | 21C266BC3D023249F9F73ECFF03BF15234270D425FE36C8180F623C712DFE28E |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as TunTrust Root CA with a different issuer, so a client has to carry TunTrust Root CA itself in its root store to trust it.


## What happens when it expires

TunTrust Root CA is valid until 2044-04-26, about 17.5 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is TunTrust Root CA trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Chrome, Mozilla, Microsoft trust it for TLS server authentication; Apple do not.

**When does TunTrust Root CA expire?**

On 2044-04-26, about 17.5 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has TunTrust Root CA issued?**

The CCADB lists 3: 2 valid, 0 expired and 1 revoked. The newest valid one is TunTrust Services CA, valid until 2039-04-26.

**Is TunTrust Root CA cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).