# Certum Trusted Network CA root certificate (Certum)

> Certum Trusted Network CA is a root CA certificate operated by Certum (RSA 2048, valid until 2029-12-31, SHA-256 5C58468D). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/certum-trusted-network-ca/
Last updated: 2026-11-10

Certum Trusted Network CA is a root CA certificate operated by Certum (RSA 2048, valid until 2029-12-31, SHA-256 5C58468D). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Certum |
| Subject | CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL |
| SHA-256 | 5C58468D55F58E497E743982D2B50010B6D165374ACF83A7D4A32DB768C4408E |
| SPKI SHA-256 | AA2630A7B617B04D0A294BAB7A8CAAA5016E6DBE604837A83A85719FAB667EB5 |
| Valid from | 2008-10-22 |
| Expires | 2029-12-31 |
| Key | RSA 2048 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 444C0 |
| SHA-1 (Windows thumbprint) | 07E032E020B72C3F192F0628A2593A19A70F069E |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2026-09-30 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: 1.2.616.1.113527.2.5.1.1; First included in: NSS 3.12.10 / Firefox 6.0; Inclusion bug: #532377 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2026-09-30 (sct_not_after). Mozilla treats it as an EV root for policy OID 1.2.616.1.113527.2.5.1.1.

## Intermediate CAs issued by this root

The CCADB lists 46 intermediate CA certificates signed directly by Certum Trusted Network CA: 28 currently valid, 9 expired and 9 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Certum TLS ECC Root CA | Asseco Data Systems S.A. | 2029-12-30 | Valid | BC6C7755697594592C22CE1F8C7085D3C49BF41B126A6671FE5EF10F9DE8EFD6 |
| Certum TLS RSA Root CA | Asseco Data Systems S.A. | 2029-12-30 | Valid | 5806D9DEDA84AE858E6F3D1371E2BD65D0978FD24A1A978CA3510F47217355D9 |
| Certum KWT G1 R29 CA | Asseco Data Systems S.A. | 2029-12-20 | Valid | 4B3827B06C626CD2DFCE51CAA831D07B02417DFDB995F194FBACB6767C1EE681 |
| TrustAsia TLS ECC Root CA | TrustAsia Technologies, Inc. | 2029-01-14 | Valid | FBE52F7D83E613D166F592A9227B08A9235E3DAA875FBA2ACD10A8C0D220DA2F |
| TrustAsia TLS RSA Root CA | TrustAsia Technologies, Inc. | 2029-01-14 | Valid | CE0DF856EA6CC0EBE068F55C4CC4DE77DEF45CACB2D4E946D8ADE706666F5887 |
| UCA Global G2 Root | Shanghai Electronic Certification Authority Co., Ltd. | 2029-01-06 | Valid | BFA95C5DF164B659FA32F6D10564D7170DDE661A853A782E6AB63639433BCB41 |
| UCA Global G2 Root | Shanghai Electronic Certification Authority Co., Ltd. | 2029-01-06 | Valid | BB61408AED9F530B2EC0545E53BA2C8EBEAA57D9976447DB1663CED4600CD6B7 |
| Certum Trusted Root CA | Asseco Data Systems S.A. | 2028-09-19 | Valid | FB13890C7AB14FF7B94B2714503E31123BFDD340FC4D979743166E0469B47A88 |
| Certum EC-384 CA | Asseco Data Systems S.A. | 2028-09-19 | Valid | B72450ABF5047A8AF63EC9D87E331484850B1849A2550A82A86DB6B41ED38760 |
| Root Networks CA | Asseco Data Systems S.A. | 2028-09-09 | Valid | BF64C06D1D48D977A0BC2DFC917E8E0D6342BD11590471636D7A0806CC8DF003 |
| SSL Secure Site CA | Asseco Data Systems S.A. | 2027-09-28 | Valid | D859828E4E8C35ECC38E415E1D0CFFD4A9DFC116205401D1298FC13347DC0187 |
| Xcc Trust DV SSL CA | Asseco Data Systems S.A. | 2027-06-30 | Valid | B81D7010D7E495179BB5BB504223EF2EEF3056557EE3924533718169F1A670C8 |
| Xcc Trust OV SSL CA | Asseco Data Systems S.A. | 2027-06-30 | Valid | 2628D65E94D62E57B6344C31B22920EDA316D9BE68EEF5EACC7362206B7DEAFA |
| Certum Trusted Network CA 2 | Asseco Data Systems S.A. | 2029-09-17 | Valid | 08E7EAC998A62C4155CC4CBC5EDA32F5B41A12C012F29AB3433BD366348149F0 |
| WoTrus OV SSL CA | Asseco Data Systems S.A. | 2027-05-18 | Valid | F6BF88B2A8DCD4FEB4015984EC2F1427C8017D140CF41F22EE689E0D6718012F |
| WoTrus EV SSL CA | Asseco Data Systems S.A. | 2027-05-18 | Valid | EA6963696750564A228B3EB88E0FD4304C5DA27A7AF92D1D4199357A50078315 |
| WoTrus DV SSL CA | Asseco Data Systems S.A. | 2027-05-18 | Valid | 6970E396621417DCEE315AAC28BB5EA3161F175020F7F4E9BA17DADE58DBB08D |
| WoTrus Code Signing CA | Asseco Data Systems S.A. | 2027-05-18 | Valid | 0829CAB693AADFAF21C77876DBE76BB9AC7491608FFAEBF7D1D53C289FC88452 |
| WoSign DV SSL CA | Asseco Data Systems S.A. | 2027-05-18 | Valid | 0330286DF3612C0E968DCD518A7A316D5E0790D1CA324B906B0EF017C0BE3EA7 |
| WoSign EV SSL CA | Asseco Data Systems S.A. | 2026-11-10 | Valid | C0AB07D9071A4CC1D34409178F8BCA058310A8B111DDCFA655658760226F50F9 |

## Cross-signed versions

3 certificate(s) in the CCADB have the same subject and public key as Certum Trusted Network CA but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Certum Trusted Network CA, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Certum CA | Asseco Data Systems S.A. | 2027-06-10 | Valid | 949424DC2CCAAB5E9E80D66E0E3F7DEEB3201C607D4315EF4C6F2D93A917279D |
| Certum CA | Asseco Data Systems S.A. | 2025-12-30 | Revoked | 33F959714B8FA7AB272BEA2CA239403A879044D83A8FD008534D7EE65FA0D42B |
| Certum CA | Asseco Data Systems S.A. | 2025-12-30 | Expired | 2D87FF20FE8AD2305DFB6F3992867ED2BF4FE3E1346212C4345991AAC02266E9 |

## What happens when it expires

Certum Trusted Network CA is valid until 2029-12-31, about 3.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2026-09-30.

## FAQ

**Is Certum Trusted Network CA trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2026-09-30.

**When does Certum Trusted Network CA expire?**

On 2029-12-31, about 3.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Certum Trusted Network CA issued?**

The CCADB lists 46: 28 valid, 9 expired and 9 revoked. The newest valid one is Certum TLS ECC Root CA, valid until 2029-12-30.

**Is Certum Trusted Network CA cross-signed?**

Yes. The CCADB has 3 cross-certificate(s) with its subject and key, signed by Certum CA; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).