# Certum TLS ECC Root CA root certificate (Certum)

> Certum TLS ECC Root CA is a root CA certificate operated by Certum (ECDSA P-384, valid until 2048-01-26, SHA-256 630CCB83). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

Source: https://ssl.sh/roots/certum-tls-ecc-root-ca/
Last updated: 2026-11-10

Certum TLS ECC Root CA is a root CA certificate operated by Certum (ECDSA P-384, valid until 2048-01-26, SHA-256 630CCB83). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

| Field | Value |
|---|---|
| CA owner | Certum |
| Subject | CN=Certum TLS ECC Root CA,O=Asseco Data Systems S.A.,C=PL |
| SHA-256 | 630CCB83B0180A992495E039D2613C3287A8102F8A8D703DB1330A3E86D4E653 |
| SPKI SHA-256 | DDF469B7A279BB252D97EE2D3B0ABF60F60D0FA54918AA95D30235800F9CDA1A |
| Valid from | 2023-01-27 |
| Expires | 2048-01-26 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | B07EC0CB2E05E63C71DA0D7F997971F3 |
| SHA-1 (Windows thumbprint) | B57B6C6566C12BB2390DE27FE45194765E8B7FC7 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Not included | No | - | - |
| Mozilla | Not included | No | - | - |
| Apple | Not included | No | - | - |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication |

The CCADB lists no EV policy OID for Certum TLS ECC Root CA.

## Intermediate CAs issued by this root

The CCADB lists 3 intermediate CA certificates signed directly by Certum TLS ECC Root CA: 3 currently valid, 0 expired and 0 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Certum EV TLS G3 E39 CA | Asseco Data Systems S.A. | 2039-03-20 | Valid | EE2E652AF16790B709041EB9B1430B4A93AA18EC2A2983E6E67137FDE25CD511 |
| Certum DV TLS G3 E39 CA | Asseco Data Systems S.A. | 2039-03-20 | Valid | DF823B3B53109E142D1C8BA5574D5DEC7F1A14AC23168D97CDC6C83081AD2BAB |
| Certum OV TLS G3 E39 CA | Asseco Data Systems S.A. | 2039-03-20 | Valid | DD9FA363315EAD6D110C94BAFD2AA61929E41B63A5877FFE84F50FBC36422A65 |

## Cross-signed versions

2 certificate(s) in the CCADB have the same subject and public key as Certum TLS ECC Root CA but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Certum TLS ECC Root CA, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Certum Trusted Network CA | Asseco Data Systems S.A. | 2029-12-30 | Valid | BC6C7755697594592C22CE1F8C7085D3C49BF41B126A6671FE5EF10F9DE8EFD6 |
| Certum EC-384 CA | Asseco Data Systems S.A. | 2036-04-15 | Valid | 83C18AF3F7BCE7DC7C5A3A51D001A5AB74C359F7476D5BEED8A30730FC9A6C26 |

## What happens when it expires

Certum TLS ECC Root CA is valid until 2048-01-26, about 21.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Certum TLS ECC Root CA trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Microsoft trust it for TLS server authentication; Chrome, Mozilla, Apple do not.

**When does Certum TLS ECC Root CA expire?**

On 2048-01-26, about 21.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Certum TLS ECC Root CA issued?**

The CCADB lists 3: 3 valid, 0 expired and 0 revoked. The newest valid one is Certum EV TLS G3 E39 CA, valid until 2039-03-20.

**Is Certum TLS ECC Root CA cross-signed?**

Yes. The CCADB has 2 cross-certificate(s) with its subject and key, signed by Certum Trusted Network CA, Certum EC-384 CA; 2 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).