# Certigna root certificate (Certigna)

> Certigna is a root CA certificate operated by Certigna (RSA 2048, valid until 2027-06-29, SHA-256 E3B6A2DB). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/certigna/
Last updated: 2026-11-10

Certigna is a root CA certificate operated by Certigna (RSA 2048, valid until 2027-06-29, SHA-256 E3B6A2DB). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Certigna |
| Subject | CN=Certigna,O=Dhimyotis,C=FR |
| SHA-256 | E3B6A2DB2ED7CE48842F7AC53241C7B71D54144BFB40C11F3F1D0B42F5EEA12D |
| SPKI SHA-256 | 510D20E5C47F63CF666B20F61AF62BC099A42AC824FFA443A2DA7C90B1808A91 |
| Valid from | 2007-06-29 |
| Expires | 2027-06-29 |
| Key | RSA 2048 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | FEDCE3010FC948FF |
| SHA-1 (Windows thumbprint) | B12E13634586A46F1AB2606837582DC4ACFD9497 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | No | - | Trust bits: Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.12.4 / Firefox 3.5; Inclusion bug: #393166 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, IP Security IKE Intermediate, IP Security Tunnel Termination, IP Security User, OCSP Signing, Secure Email, Time Stamping; Not-before cutoff: 2019-10-01 (OCSP Signing); Disallowed EKUs: OCSP Signing |

The CCADB lists EV policy OID 2.23.140.1.1, 1.2.250.1.177.1.18.2.2 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 34 intermediate CA certificates signed directly by Certigna: 2 currently valid, 11 expired and 21 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Certigna Server Authentication OVCP EU CA G1 | Certigna | 2027-06-28 | Valid | 1A209DB499625B4EA29F597BE7744BA1E240B8C7629F75B41A3373339FD7EDDF |
| Certigna Server Authentication OVCP CA G1 | Certigna | 2027-06-28 | Valid | 0A67E28F7167457C8F14D2C95F8A280ABF42FA433910679891E47BAF9CE756C6 |
| Certigna Entity Code Signing CA | Dhimyotis / Certigna | 2025-12-13 | Expired | 935061BE52C8EA88C034B39ADFD522BB314CBF5304E5A7064735DDBDA3242AAF |
| Certigna Identity CA | Certigna | 2025-12-28 | Expired | 23BCD5D7A96A513A981EAD27936E59A8028A807BD72860418F68B555A2911670 |
| Certigna Entity CA | Certigna | 2025-11-22 | Expired | EBBF4DC600C17DA04381DEFDCFC119C3F34EFB4A04D0860910B813C7792D7585 |
| Certigna Services CA | Certigna | 2025-11-22 | Expired | 71E653BFBF5E72515B4099BBD5EC8872812B47C6EC1FA9ADD327E1C92C9EA16D |
| Certigna Wild CA | Certigna | 2025-11-22 | Expired | 211F3083B9E77A01D0828565897A1CE945EEAAE04942CCC369087D8080C9E4A6 |
| Certigna Identity Plus CA | Certigna | 2025-11-22 | Expired | 02C4A300A09C1B893B11F9567659AF95BBB9BBE7953893E36C5BAF17B555CEE3 |
| Certigna ID PRIS Pro | Certigna | 2018-11-17 | Expired | C5B4766CA0236BA7FB224B44B32564D336718FD9D1A0F1664B776397FE18402D |
| Certigna SSL PRIS | Certigna | 2018-11-17 | Expired | 35A90DEB8BF4BD7C23BDE61E065B6EBED236172F342D8F29C65D97F3EC0E10E4 |
| Certigna ID PRIS*** Pro | Certigna | 2018-11-17 | Expired | 341F7CF430E333544BDF438C0C8F058AF3510C59F7F3E1BEA8F8A633F6EACE02 |
| Certigna Interne | Certigna | 2018-09-23 | Expired | D3ABF34BF1E192763CA54F3F638AB6FB3EF502CE821CB8E6DE037EE1747EC225 |
| Certigna Chiffrement | Certigna | 2017-07-03 | Expired | 38D5866EF8ECD60B874EFA7C3592CB0F91221212FD78C3C7EC41016AF985C650 |
| Certigna Root CA | Certigna | 2027-06-28 | Revoked | 99977BF1CA323FA96047E7DA5F93BD6CBF17010D6D8FBCE03091ECE79C857EFA |
| Certigna Server Authentication ACME FR CA G1 | Certigna | 2027-06-28 | Revoked | CA1FF54E031186F9006BB148F8CE6A53F05742A4B6CE8FFE79DFD2AE471EBAA5 |
| Certigna Server Authentication ACME CA G1 | Certigna | 2027-06-28 | Revoked | B1C8E470CA1F4885DDDEE0FE80B805F2CA823770EC6071C1CCEB77F70A0FB6C2 |
| Certigna Server Authentication ACME CA 2024 | Certigna | 2039-03-12 | Revoked | A9A63E03F0D498EC7243026A7A8F2BE705D04F2845D49F63D889C9DD0B4A3944 |
| Certigna Server Authentication ACME FR CA 2024 | Certigna | 2039-03-12 | Revoked | 58C2942C41B908F009E900FE62D1130BBEA7A5A8836F20899089A7A951C64327 |
| Certigna Interne | Certigna | 2026-05-06 | Revoked | 41E9CDBD6470F1853FC304B8F2465D4BAA8836965833D52E983E2AB757973627 |
| Certigna Extended Validation SSL | Certigna | 2021-05-24 | Revoked | EEC818746A31C45D3D8E60F7E2BEF9160441C496544208B3E464079AFCAD700E |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as Certigna with a different issuer, so a client has to carry Certigna itself in its root store to trust it.


## What happens when it expires

Certigna is valid until 2027-06-29, about 0.6 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Certigna trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does Certigna expire?**

On 2027-06-29, about 0.6 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Certigna issued?**

The CCADB lists 34: 2 valid, 11 expired and 21 revoked. The newest valid one is Certigna Server Authentication OVCP EU CA G1, valid until 2027-06-28.

**Is Certigna cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).