# certSIGN ROOT CA G2 root certificate (certSIGN)

> certSIGN ROOT CA G2 is a root CA certificate operated by certSIGN (RSA 4096, valid until 2042-02-06, SHA-256 657CFE2F). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/certsign-root-ca-g2/
Last updated: 2026-11-10

certSIGN ROOT CA G2 is a root CA certificate operated by certSIGN (RSA 4096, valid until 2042-02-06, SHA-256 657CFE2F). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | certSIGN |
| Subject | OU=certSIGN ROOT CA G2,O=CERTSIGN SA,C=RO |
| SHA-256 | 657CFE2FA73FAA38462571F332A2363A46FCE7020951710702CDFBB6EEDA3305 |
| SPKI SHA-256 | CBAD7B1D384849DF0946B7EE8E7F5F7CE3AED876FDA7BC9D30D8B16F29FF2C53 |
| Valid from | 2017-02-06 |
| Expires | 2042-02-06 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 110034B64EC6362D36 |
| SHA-1 (Windows thumbprint) | 26F993B4ED3D2827B0B94BA7E9151DA38D92E532 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: NSS 3.54 / Firefox 79; Inclusion bug: #1403453 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Document Signing, Secure Email; Not-before cutoff: 2025-09-15 (Secure Email) |

Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 8 intermediate CA certificates signed directly by certSIGN ROOT CA G2: 5 currently valid, 0 expired and 3 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| certSIGN Web CA G4 EV | certSIGN | 2032-09-08 | Valid | F74DB322F987A9705C522AA8A3F646DD28EDF505E340C58626BAC0596BA4DE9D |
| certSIGN Web CA G4 DV | certSIGN | 2032-09-08 | Valid | 640A4C1279C7BD0A1EF3A230BB03976ECD48F6E9FF31FF4084300D26C3BA0CEC |
| certSIGN Web CA G4 OV | certSIGN | 2032-09-08 | Valid | 4B3BF92C22283B526F7B526C068CE8F3331C12AFEAD3207834C8C94C181D7034 |
| certSIGN Web CA | certSIGN | 2027-02-06 | Valid | F21BEF91DDDBB3544D445AB7FF448149545823AC627EFBDCAC2BC6F823AC38C4 |
| certSIGN Web CA G2 | certSIGN | 2033-01-21 | Valid | 0E49BEDBD09341D646EB65CEE9F2F1EE6C8F88BEAA906979A49D1616FC9C03EA |
| certSIGN Web CA | certSIGN | 2027-02-06 | Revoked | F114469FB80778133A1F70E4D8338EDAB97DD42CEB8ECC01CAFB70D6B87DF11E |
| certSIGN Qualified CA | certSIGN | 2027-02-06 | Revoked | C670C79BF277AF7E7B34A6AA4FA304441833C6BD01A70A7E9B7A2D94C1C1F926 |
| certSIGN Public CA | certSIGN | 2027-02-06 | Revoked | 9917BFD853738985E46C920419410E966C316982769E71817E27D0384BBE3679 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as certSIGN ROOT CA G2 with a different issuer, so a client has to carry certSIGN ROOT CA G2 itself in its root store to trust it.


## What happens when it expires

certSIGN ROOT CA G2 is valid until 2042-02-06, about 15.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is certSIGN ROOT CA G2 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does certSIGN ROOT CA G2 expire?**

On 2042-02-06, about 15.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has certSIGN ROOT CA G2 issued?**

The CCADB lists 8: 5 valid, 0 expired and 3 revoked. The newest valid one is certSIGN Web CA G4 EV, valid until 2032-09-08.

**Is certSIGN ROOT CA G2 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).