# Certum Trusted Network CA 2 root certificate (Certum)

> Certum Trusted Network CA 2 is a root CA certificate operated by Certum (RSA 4096, valid until 2046-10-06, SHA-256 B676F2ED). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/certum-trusted-network-ca-2/
Last updated: 2026-11-10

Certum Trusted Network CA 2 is a root CA certificate operated by Certum (RSA 4096, valid until 2046-10-06, SHA-256 B676F2ED). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Certum |
| Subject | CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL |
| SHA-256 | B676F2EDDAE8775CD36CB0F63CD1D4603961F49E6265BA013A2F0307B6D0B804 |
| SPKI SHA-256 | 6B3B57E9EC88D1BB3D01637FF33C7698B3C9758255E9F01EA9178F3E7F3B2B52 |
| Valid from | 2011-10-06 |
| Expires | 2046-10-06 |
| Key | RSA 4096 |
| Signature algorithm | sha512WithRSAEncryption |
| Serial number | 21D6D04A4F250FC93237FCAA5E128DE9 |
| SHA-1 (Windows thumbprint) | D3DD483E2BBF4C05E8AF10F5FA7626CFD3DC3092 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: 1.2.616.1.113527.2.5.1.1; First included in: NSS 3.23 / Firefox 46; Inclusion bug: #999378 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email |

Mozilla treats it as an EV root for policy OID 1.2.616.1.113527.2.5.1.1.

## Intermediate CAs issued by this root

The CCADB lists 12 intermediate CA certificates signed directly by Certum Trusted Network CA 2: 11 currently valid, 0 expired and 1 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| IKARUS mail.security SMIME G1 R36 CA | Asseco Data Systems S.A. | 2036-04-23 | Valid | 4CE86EC569454765D871D05E6D8C5B0B2102B4D02B0AA132F348A5F54A73D46B |
| Certum SMIME G1 R36 CA 2 | Asseco Data Systems S.A. | 2036-02-21 | Valid | 11EE35B46FDACBD2EDE0D3543811B400612D029DDEEAB473E25FA3F8B259DD66 |
| Certum SMIME G1 R36 CA | Asseco Data Systems S.A. | 2036-02-06 | Valid | 61797A30208FA51A11951A7787456E32D7838B9749A00E63971B23D714CD48DF |
| Onmime SMIME G1 R36 CA | Asseco Data Systems S.A. | 2036-01-30 | Valid | 1FF248F20CBDC78546D8B3B59533E7D1647A5CBF3C217A357C3D8FF4566EE7B7 |
| WoTrus Code Signing 2021 CA | Asseco Data Systems S.A. | 2027-05-18 | Valid | 2D687BA569A21640D62F424A999FF36FCAC2203815FCAF5EB0FB77C98C9EC45F |
| Certum Timestamping 2021 CA | Asseco Data Systems S.A. | 2036-05-18 | Valid | F882EFFC16DE28D508C092E35825B00242CF963071C279EF09310D9D95784B35 |
| Certum Extended Validation Code Signing 2021 CA | Asseco Data Systems S.A. | 2036-05-18 | Valid | D6D9BFA813BFCBAB204C1AE503D2DE4093D2FC0041E365485AD02139F66AA76A |
| Certum Code Signing 2021 CA | Asseco Data Systems S.A. | 2036-05-18 | Valid | 5AC82CBE9F28351E85D5262293BCFC8BACABEAD1294F248C1DF17F81CE5AC3CE |
| Certum Extended Validation CA | Asseco Data Systems S.A. | 2028-01-24 | Valid | 7816C7B0566B46783B1C15D8A28D8B0D20CFEB20B3D13F79446E15C4A51C91DF |
| Certum Class I CA | Asseco Data Systems S.A. | 2028-01-24 | Valid | 337AC56F39FB8877B9F0524554B755D1835A807FFC9058DFC6DE1B707F696123 |
| Certum Code Signing CA | Asseco Data Systems S.A. | 2028-01-24 | Valid | 1B82F666CEDC5D302B0A8F1CCE498CEECD730208A2337DC7664FEAC3DD2D0F92 |
| Certum Trusted Network CA 2 | Asseco Data Systems S.A. | 2046-10-06 | Revoked | 9F8B05137F20ACDE9B996410F4D0BF7971A1006DC99E094C346D279B93CFF7AE |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as Certum Trusted Network CA 2 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Certum Trusted Network CA 2, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Certum Trusted Network CA | Asseco Data Systems S.A. | 2029-09-17 | Valid | 08E7EAC998A62C4155CC4CBC5EDA32F5B41A12C012F29AB3433BD366348149F0 |

## What happens when it expires

Certum Trusted Network CA 2 is valid until 2046-10-06, about 19.9 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Certum Trusted Network CA 2 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does Certum Trusted Network CA 2 expire?**

On 2046-10-06, about 19.9 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Certum Trusted Network CA 2 issued?**

The CCADB lists 12: 11 valid, 0 expired and 1 revoked. The newest valid one is IKARUS mail.security SMIME G1 R36 CA, valid until 2036-04-23.

**Is Certum Trusted Network CA 2 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by Certum Trusted Network CA; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).