Root certificate · Docaposte Certinomis

Certinomis - Root CA

Certinomis - Root CA is a root CA certificate operated by Docaposte Certinomis (RSA 4096, valid until 2033-10-21, SHA-256 2A99F5BC). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

Data updated Nov 10, 2026

Root store status

Root store	Status	Trusted for TLS	Distrust for TLS after	Constrained
Chrome	Not included Not included	No	—	No
Mozilla	Removed Removed	No	—	No
Apple	Removed Removed	No	—	No
Microsoft	Included Included	Yes	—	No

The CCADB lists no EV policy OID for Certinomis - Root CA.

Not included Chrome

Status: Not included

Removed Mozilla

Status: Removed

Removed Apple

Status: Removed

Included Microsoft

Status: Included
Trusted EKUs: Server Authentication, Client Authentication, Secure Email, Time Stamping

"Trusted for TLS" means the store includes the root with the server-authentication trust bit (Mozilla "Websites", Apple serverAuth, Microsoft Server Authentication EKU). Microsoft "NotBefore" means only certificates issued before a cutoff date are still trusted. "Constrained" means the store applies extra restrictions.

Details

CA owner: Docaposte Certinomis SAS
Subject: CN=Certinomis - Root CA,OU=0002 433998903,O=Certinomis,C=FR
SHA-256: 2A99F5BC1174B73CBB1D620884E01C34E51CCB3978DA125F0E33268883BF4158
SHA-1 (Windows thumbprint): 9D70BB01A5A4A018112EF71C01B932C534E788A8
SPKI SHA-256: 6B1A505E0246F2F60C490FF0C097A7BE27210CBB7500237F88B0CD48298BC9B8
Valid from: 2013-10-21
Expires: 2033-10-21
Key: RSA 4096
Signature algorithm: sha256WithRSAEncryption
Serial number: 1
Country: FR
Trust bits (CCADB): Server Authentication, Client Authentication, Secure Email, Time Stamping
EV policy OIDs (CCADB): not EV-enabled · TLS EV capable: No
Test websites: valid: https://ccadb-valid.certinomis.com · expired: https://ccadb-expired.certinomis.com · revoked: https://ccadb-revoked.certinomis.com
CCADB record: A000323
PEM: certinomis-root-ca.pem

Look up this certificate on crt.sh

Intermediate CAs issued by this root

The CCADB lists 14 intermediate CA certificates signed directly by Certinomis - Root CA: 6 currently valid, 5 expired and 3 revoked (revoked includes those whose parent was revoked).

Showing 14 of 14: valid certificates first, newest first. Each name links to its crt.sh entry by SHA-256; an arrow marks a cross-certificate for another root on this site.

Intermediate	Operated by	Expires	Status
Certinomis - Timestamp CA	Docaposte Certinomis SAS	2033-10-18	Valid
Certinomis - Easy CA G2	Docaposte Certinomis SAS	2033-10-18	Valid
Certinomis - Standard CA G2	Docaposte Certinomis SAS	2033-10-18	Valid
Certinomis - Web CA	Docaposte Certinomis SAS	2033-10-18	Valid
Certinomis - Prime CA G2	Docaposte Certinomis SAS	2033-10-18	Valid
Certinomis - Safe CA	Docaposte Certinomis SAS	2033-10-18	Valid
Certinomis - Onetime CA 2016	Docaposte Certinomis SAS	2026-10-13	Expired
Certinomis - Prime CA	Docaposte Certinomis SAS	2023-10-21	Expired
Certinomis - AA et Agents	Docaposte Certinomis SAS	2023-10-21	Expired
Certinomis - Standard CA	Docaposte Certinomis SAS	2023-10-21	Expired
Certinomis - Easy CA	Docaposte Certinomis SAS	2023-10-21	Expired
StartCom EV SSL ICA	Docaposte Certinomis SAS	2027-04-13	Revoked
StartCom BR SSL ICA	Docaposte Certinomis SAS	2027-04-13	Revoked
Certinomis - Onetime CA	Docaposte Certinomis SAS	2025-04-30	Revoked

Cross-signed versions

No certificate in the CCADB has the same subject and public key as Certinomis - Root CA with a different issuer, so a client has to carry Certinomis - Root CA itself in its root store to trust it.

CRL and OCSP addresses

In the root certificate

Certinomis - Root CA itself contains no CRL Distribution Points and no OCSP (Authority Information Access) extension. That is normal for a root: clients trust it directly and do not check its own revocation status.

Used by the intermediates it issued

Addresses found in the CRL Distribution Points and OCSP fields of the 6 valid intermediates signed by Certinomis - Root CA; the number in brackets is how many of them use each address.

CRL: http://crl.igc-g3.certinomis.com/RACINE_G3/crl/AC_Racine_G3-crl-1.crl (6)

None of the valid intermediates under this root lists an OCSP responder.

What happens when it expires

Certinomis - Root CA is valid until 2033-10-21, about 6.9 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

Check whether your device trusts it

Each platform keeps its own root store. The commands below look up Certinomis - Root CA by common name (Certinomis - Root CA) or fingerprint. The store status in each heading comes from the CCADB snapshot; your device can differ if it is out of date or managed by an administrator.

macOS (Apple store: Removed)

Search the system roots keychain by common name. -Z prints the SHA-256 hash, which must match the fingerprint on the last line.

security find-certificate -a -c "Certinomis - Root CA" -Z \
  /System/Library/Keychains/SystemRootCertificates.keychain | grep "SHA-256"
# SHA-256 hash: 2A99F5BC1174B73CBB1D620884E01C34E51CCB3978DA125F0E33268883BF4158

Windows (Microsoft store: Included · Trusted for TLS)

Windows identifies roots by SHA-1 thumbprint. It installs third-party roots on demand through Automatic Root Certificates Update, so "not found" can also mean the root has not been needed yet; certutil -generateSSTFromWU roots.sst downloads Microsoft's full list.

certutil -verifystore Root 9D70BB01A5A4A018112EF71C01B932C534E788A8

Linux (ca-certificates follows Mozilla: Removed)

Debian, Ubuntu, Fedora and RHEL build their ca-certificates package from Mozilla's root store. Use trust list on p11-kit systems, or search the PEM bundle on Debian and Ubuntu.

# Fedora / RHEL / Arch (p11-kit)
trust list --filter=ca-anchors | grep -iF -A2 "Certinomis - Root CA"
# Debian / Ubuntu (ca-certificates)
openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt \
  | openssl pkcs7 -print_certs -noout | grep -iF "Certinomis - Root CA"

Java

Java ships its own cacerts keystore; JDK 9 and later accept -cacerts and the default store password is changeit. Search for the SHA-256 fingerprint in colon form.

keytool -list -cacerts -storepass changeit | grep -i "2A:99:F5:BC:11:74:B7:3C:BB:1D:62:08:84:E0:1C:34:E5:1C:CB:39:78:DA:12:5F:0E:33:26:88:83:BF:41:58"

Android

Android's system store is maintained by Google separately from the four CCADB stores above. Open Settings → Security & privacy → More security settings → Encryption & credentials → Trusted credentials → System (menu names vary by vendor and version) and look for Certinomis → Certinomis - Root CA.

Which root does my site chain to?

List the chain your server sends and compare the last issuer with this root; the fingerprint check confirms a local copy.

Download PEM

# show subject (s:) and issuer (i:) of every certificate the server sends
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null \
  | grep -E '^ *[0-9]+ s:|^ *i:'
# subject and SHA-256 fingerprint of the downloaded PEM file
openssl x509 -in certinomis-root-ca.pem -noout -subject -fingerprint -sha256
# sha256 Fingerprint=2A:99:F5:BC:11:74:B7:3C:BB:1D:62:08:84:E0:1C:34:E5:1C:CB:39:78:DA:12:5F:0E:33:26:88:83:BF:41:58

FAQ

Is Certinomis - Root CA trusted by Chrome, Firefox, Safari and Windows?

As of 2026-11-10, Microsoft trust it for TLS server authentication; Chrome, Mozilla, Apple do not.

When does Certinomis - Root CA expire?

On 2033-10-21, about 6.9 years after the 2026-11-10 data snapshot.

How many intermediate certificates has Certinomis - Root CA issued?

The CCADB lists 14: 6 valid, 5 expired and 3 revoked. The newest valid one is Certinomis - Timestamp CA, valid until 2033-10-18.

Is Certinomis - Root CA cross-signed?

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources

CCADB — Resources (TLS Server Authentication report, All Included Root Certificate Trust Bit Settings)
CCADB — All Certificate Information (root and intermediate), CSV V5
CCADB — Mozilla Included CA Certificate Report
CCADB — Chrome / Mozilla / Apple / Microsoft TLS Server Authentication CSV