# Certum TLS RSA Root CA root certificate (Certum)

> Certum TLS RSA Root CA is a root CA certificate operated by Certum (RSA 4096, valid until 2048-01-26, SHA-256 ED12A6E9). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

Source: https://ssl.sh/roots/certum-tls-rsa-root-ca/
Last updated: 2026-11-10

Certum TLS RSA Root CA is a root CA certificate operated by Certum (RSA 4096, valid until 2048-01-26, SHA-256 ED12A6E9). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

| Field | Value |
|---|---|
| CA owner | Certum |
| Subject | CN=Certum TLS RSA Root CA,O=Asseco Data Systems S.A.,C=PL |
| SHA-256 | ED12A6E9289239D66CA1D244CE90C623AC305AD05602DA352BCFC5FEF2C4458D |
| SPKI SHA-256 | 8C8474414760A2F5986F6AC802A66F37EB6B360DD8EE7747A8B6C92F08B34D9E |
| Valid from | 2023-01-27 |
| Expires | 2048-01-26 |
| Key | RSA 4096 |
| Signature algorithm | sha384WithRSAEncryption |
| Serial number | E7DD2138A2C94146FF5F121789950553 |
| SHA-1 (Windows thumbprint) | 81D05159A4ECD8C85E26781AC20A1609A6278D9D |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Not included | No | - | - |
| Mozilla | Not included | No | - | - |
| Apple | Not included | No | - | - |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication |

The CCADB lists no EV policy OID for Certum TLS RSA Root CA.

## Intermediate CAs issued by this root

The CCADB lists 21 intermediate CA certificates signed directly by Certum TLS RSA Root CA: 21 currently valid, 0 expired and 0 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| LH.pl DV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-09-10 | Valid | D19AB0EFA21CAD4645C349C9DDD5211753FD07ABD72F1D4EB64DFEF0BC1D978B |
| SZCA DV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-09-10 | Valid | A4680FD0B9753BE86B30E4F0706135F57C6B497FAA31B229E04693830782941B |
| Nya Labs DV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-09-10 | Valid | 6D3F5C18C164DF8AE7DCA7E8E79E454433C3CB8A462604F4571D632197CC1666 |
| cyber_Folks DV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-09-10 | Valid | 5C23835F84ACFE2F36F0EB2CE15C464CCA1964BEB8BF667375AA783660B15840 |
| Secure Site DV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-09-10 | Valid | 50473FF96AEFDA41767B9FA9A11CCF43092B734A5BEC072AFB7A8CE2D067346C |
| SZCA OV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-09-10 | Valid | 44361E343BC4D4B208396904CEB1A8236DCB35A81778BA8F4543E11040D739DA |
| Sooma DV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-09-10 | Valid | 28F5535C929B7869966EE92E5AAF90D086C53F3F05674C8A3599A3B69567786A |
| vTrus OV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-09-03 | Valid | B4A5FE8C9DCD4CF20CC615DF148B07F685A84DB035220E4B0298E0658C1E86D4 |
| vTrus DV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-09-03 | Valid | 9373149093135D610DDC0E8A9B4888E7100D9B2C032E9DE95C658116314F9AA5 |
| GDCA TrustAUTH DV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-09-03 | Valid | 7BB13810EB17BFEAE2B6AB1384E4A9075EDAE5498FAE7D9481150DEF617E0D01 |
| GDCA TrustAUTH OV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-09-03 | Valid | 327CD43A2A2F1B742FF35657C81139916A5F9AEA5602489608324FC4CD7AD447 |
| GDCA TrustAUTH EV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-09-03 | Valid | 0AD6331BFF9FFF93F3F3985DEA5DF4AC351F2FD9E61D2ADE774CD1291E776626 |
| ZYCA Trust EV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-08-20 | Valid | B7508FEF2888397D3D56159627FDF7BA2BCD563A459475FA0B164F972F743D72 |
| ZYCA Trust DV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-08-20 | Valid | B735F413BC6C5338726A0426114081CE2C7056B477656C8DF862A362C13DF26D |
| Xcc Trust OV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-08-20 | Valid | B034FD11612D348DA37AE8BBC606C7924C8ECF7832E5B5D44E438CD913DE6FF0 |
| Xcc Trust DV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-08-20 | Valid | 7D41AA9E768AE70FEB2224E3E949EC106803FA1D7537340187B6EB709DCB0242 |
| Xcc Trust EV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-08-20 | Valid | 49C379BC4C7F4872BD722D9E1589C39F88DC37FE9017B36E9A049C392076741D |
| ZYCA Trust OV TLS G3 R31 CA | Asseco Data Systems S.A. | 2031-08-20 | Valid | 08FBA557B0A16DB0B88C5AF5DCC49D6778AC16BB67016A1C47F872C5007B7F8C |
| Certum OV TLS G3 R39 CA | Asseco Data Systems S.A. | 2039-03-20 | Valid | F447B8DBA8F73A5A2236B73DB6173BBDB3A17626F4F1CC7087092427B5C0F67F |
| Certum EV TLS G3 R39 CA | Asseco Data Systems S.A. | 2039-03-20 | Valid | 5C1D0DA0785C1D09E02BFD53C3D3D84D141DE00C01AE2BBF93C539CA87A5FF03 |

## Cross-signed versions

2 certificate(s) in the CCADB have the same subject and public key as Certum TLS RSA Root CA but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Certum TLS RSA Root CA, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Certum Trusted Network CA | Asseco Data Systems S.A. | 2029-12-30 | Valid | 5806D9DEDA84AE858E6F3D1371E2BD65D0978FD24A1A978CA3510F47217355D9 |
| Certum Trusted Root CA | Asseco Data Systems S.A. | 2036-04-15 | Valid | 98D88F84159587EFC830BA17AC8E0C807B7A59D560DE49C8592912251C3EC127 |

## What happens when it expires

Certum TLS RSA Root CA is valid until 2048-01-26, about 21.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Certum TLS RSA Root CA trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Microsoft trust it for TLS server authentication; Chrome, Mozilla, Apple do not.

**When does Certum TLS RSA Root CA expire?**

On 2048-01-26, about 21.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Certum TLS RSA Root CA issued?**

The CCADB lists 21: 21 valid, 0 expired and 0 revoked. The newest valid one is LH.pl DV TLS G3 R31 CA, valid until 2031-09-10.

**Is Certum TLS RSA Root CA cross-signed?**

Yes. The CCADB has 2 cross-certificate(s) with its subject and key, signed by Certum Trusted Network CA, Certum Trusted Root CA; 2 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).