# certSIGN ROOT CA root certificate (certSIGN)

> certSIGN ROOT CA is a root CA certificate operated by certSIGN (RSA 2048, valid until 2031-07-04, SHA-256 EAA962C4). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/certsign-root-ca/
Last updated: 2026-11-10

certSIGN ROOT CA is a root CA certificate operated by certSIGN (RSA 2048, valid until 2031-07-04, SHA-256 EAA962C4). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | certSIGN |
| Subject | OU=certSIGN ROOT CA,O=certSIGN,C=RO |
| SHA-256 | EAA962C4FA4A6BAFEBE415196D351CCD888D4F53F3FA8AE6D7C466A94E6042BB |
| SPKI SHA-256 | DBC1E3A15238A0483BCDB8FDEC616E03E705A48E2A501157CADF3B9C7311C5E5 |
| Valid from | 2006-07-04 |
| Expires | 2031-07-04 |
| Key | RSA 2048 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 200605167002 |
| SHA-1 (Windows thumbprint) | FAB7EE36972662FB2DB02AF6BF03FDE87C4B2F9B |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Removed | No | - | - |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included (NotBefore cutoff) | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping |

The CCADB lists no EV policy OID for certSIGN ROOT CA.

## Intermediate CAs issued by this root

The CCADB lists 16 intermediate CA certificates signed directly by certSIGN ROOT CA: 0 currently valid, 13 expired and 3 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| certSIGN Web CA | certSIGN | 2026-04-18 | Expired | 5D4494B65D1C14EF9959C539EABE21959F1A4A6880F13FDDB190B8B2E185CCDC |
| CERTSIGN FOR BANKING SIMPLE SSL PRODUCTION CA V3 | certSIGN | 2025-09-10 | Expired | CAE72F66D61AFB9A697338E8F5358D8071BAFA4AE4D2717C7E635FB5EA43D365 |
| CERTSIGN FOR BANKING QUALIFIED DS PRODUCTION CA V3 | certSIGN | 2025-09-10 | Expired | AA53452D589069EBD91423834FEC288A78ACC6A7B9D4D0F143D8C92E0B83D8E9 |
| certSIGN Qualified CA Class 3 G2 | certSIGN | 2025-06-10 | Expired | C89C24B415A72C9409667E88FB5E6E92A38D5609C3C99E55D99B4B1D458990F9 |
| certSIGN CA Class 2 G2 | certSIGN | 2025-06-10 | Expired | 35C0B8A577D11C94BA665E242DE45D6687522A531E391BB4D995D261F3829AB7 |
| certSIGN Non-Repudiation CA Class 4 G2 | certSIGN | 2025-06-10 | Expired | 3003BF8853427C7B91023F7539853D987C58DC4E11BBE047D2A9305C01A6152C |
| certSIGN Enterprise CA Class 3 G2 | certSIGN | 2025-04-29 | Expired | 3B27DF9DD93C112AA08B062A6AE3973F7E79A5191D7E9B95D7081780E0D6ACEA |
| CERTSIGN FOR BANKING SIMPLE SSL TEST CA V3 | certSIGN | 2025-04-29 | Expired | 0AC2B6086EB10DB5576A3A1B8EB0E4344082C1B7D832504FCBF95A4804D51834 |
| CERTSIGN FOR BANKING QUALIFIED DS TEST CA V3 | certSIGN | 2025-04-29 | Expired | 01379EB7B85F68EDC2465B42438097687EBE1EAE49319639BFB342EFC3CEFA1D |
| CERTSIGN FOR BANKING SIMPLE SSL PRODUCTION CA | certSIGN | 2017-07-10 | Expired | A0435C11BA9485B06EFCBF307BC4E731B8518DE19751E3F7CA2F9A570D00B728 |
| CERTSIGN FOR BANKING QUALIFIED DS PRODUCTION CA | certSIGN | 2017-07-10 | Expired | 1390E32B3144EDA4C18AC6BEB19FC34F9D13E8094DD63CE9FFFDFA578FF418D7 |
| CERTSIGN FOR BANKING QUALIFIED DS TEST CA | certSIGN | 2017-06-01 | Expired | E0EF87094DD46BAA320C4635B792439399B7CBBC01A26AE2D49EAA53AB403C9E |
| CERTSIGN FOR BANKING SIMPLE SSL TEST CA | certSIGN | 2017-06-01 | Expired | 5ABF28BDA102D57DE6D8CDDC77AB3F0BF32489E5D685C995E7A26AA058ABEFF0 |
| certSIGN SSL DV CA Class 3 G2 | certSIGN | 2028-01-30 | Revoked | EA9A43515E138FF7782FCACDB9C7E8E1A61CFD1D17096ED5DDD1F400D02B03F5 |
| certSIGN SSL EV CA Class 3 G2 | certSIGN | 2028-01-30 | Revoked | 7826DE1BE414E454CFCAE0D17B17FF0CAD12EE68CF487F357B38499E274B0171 |
| certSIGN Code Signing CA Class 3 G2 | certSIGN | 2026-01-26 | Revoked | 785854130B14F6F1EE9F984257ABABB6255B05A8DBEFB7680D33400AC28FE909 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as certSIGN ROOT CA with a different issuer, so a client has to carry certSIGN ROOT CA itself in its root store to trust it.


## What happens when it expires

certSIGN ROOT CA is valid until 2031-07-04, about 4.6 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is certSIGN ROOT CA trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does certSIGN ROOT CA expire?**

On 2031-07-04, about 4.6 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has certSIGN ROOT CA issued?**

The CCADB lists 16: 0 valid, 13 expired and 3 revoked.

**Is certSIGN ROOT CA cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).