# CFCA EV ROOT root certificate (CFCA)

> CFCA EV ROOT is a root CA certificate operated by CFCA (RSA 4096, valid until 2029-12-31, SHA-256 5CC3D78E). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/cfca-ev-root/
Last updated: 2026-11-10

CFCA EV ROOT is a root CA certificate operated by CFCA (RSA 4096, valid until 2029-12-31, SHA-256 5CC3D78E). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | CFCA |
| Subject | CN=CFCA EV ROOT,O=China Financial Certification Authority,C=CN |
| SHA-256 | 5CC3D78E4E1D5E45547A04E6873E64F90CF9536D1CCC2EF800F355C4C5FD70FD |
| SPKI SHA-256 | DD5ED1C090F9F448061BAA94A6BB11017544E9EEFAA20CC714CE6C633F5DC629 |
| Valid from | 2012-08-08 |
| Expires | 2029-12-31 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 184ACCD6 |
| SHA-1 (Windows thumbprint) | E2B8294B5584AB6B58C290466CAC3FB8398F8483 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.16.156.112554.3; First included in: NSS 3.18 / Firefox 38; Inclusion bug: #926029 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth; Allowed policies: Server Authentication, Client Authentication, Code Signing, Timestamp Signing |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, OCSP Signing, Secure Email, Time Stamping; Not-before cutoff: 2026-05-19 (Code Signing, Encrypting File System, IP Security End System, IP Security Tunnel Termination, IP Security User, Secure Email); Disallowed EKUs: OCSP Signing |

Mozilla treats it as an EV root for policy OID 2.16.156.112554.3.

## Intermediate CAs issued by this root

The CCADB lists 11 intermediate CA certificates signed directly by CFCA EV ROOT: 6 currently valid, 0 expired and 5 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| CFCA Global RSA ROOT G2 | China Financial Certification Authority (CFCA) | 2029-10-12 | Valid | D9ACE97D41443D6765B61D55187A279D86F5293318C1CB8365449C574D9CF4EF |
| CFCA Global RSA ROOT G2 | China Financial Certification Authority (CFCA) | 2029-08-25 | Valid | 34CC7ACD483543572DC504ACA328326037B59C106AB1ACDBE30679B95CD1C21E |
| CFCA TLS EV OCA | China Financial Certification Authority (CFCA) | 2029-12-30 | Valid | C4B156E93B55879D2B3BF90583245570B4070BF6725BDC65532F70209A93F0C3 |
| CFCA TLS OV OCA | China Financial Certification Authority (CFCA) | 2029-12-30 | Valid | 068794F5A084F6D2D504A6FF2EF07BBC4D132D66253280D8ED88D5BD04535A0A |
| CFCA OV OCA | China Financial Certification Authority (CFCA) | 2029-12-25 | Valid | F07BBBDE076F9B40C57CC4BEFEDE97CA1F53B9AE147F035D284CBF53F3432FB8 |
| CFCA EV OCA | China Financial Certification Authority (CFCA) | 2029-12-29 | Valid | CC7253EBDE9F7E92CBA297B5BADED1B22E5CEACA525E201B4DC410F4F3504B5E |
| CFCA Global RSA ROOT G2 | China Financial Certification Authority (CFCA) | 2029-12-30 | Revoked | FAA4FA0EF7056D6953BBDFB36461E3F7CDF33352AF724FD8254B184D3E2C941F |
| CFCA DV OCA | China Financial Certification Authority (CFCA) | 2029-12-26 | Revoked | DA738A474EE7473C9699ECBA8EB5F483ADA967988185A05975C4BA0C01B39559 |
| CFCA DV OCA | China Financial Certification Authority (CFCA) | 2029-12-25 | Revoked | B8BE2649AA518E943BF0FD1E34A240443E46E79EA7B562E09FCC830AC7D2F3FC |
| CFCA EV CodeSign OCA | China Financial Certification Authority (CFCA) | 2029-12-24 | Revoked | 4AB4BF7E6015D08645612D67A71C658AE9A6338A1B7D706989BBF998DA472494 |
| CFCA OV CodeSign OCA | China Financial Certification Authority (CFCA) | 2029-12-25 | Revoked | 454DE65FEE4F03F4725D2287F71B94B6F12A3D3BBFB25F9E9C4E5625A07E3BCF |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as CFCA EV ROOT with a different issuer, so a client has to carry CFCA EV ROOT itself in its root store to trust it.


## What happens when it expires

CFCA EV ROOT is valid until 2029-12-31, about 3.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is CFCA EV ROOT trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does CFCA EV ROOT expire?**

On 2029-12-31, about 3.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has CFCA EV ROOT issued?**

The CCADB lists 11: 6 valid, 0 expired and 5 revoked. The newest valid one is CFCA Global RSA ROOT G2, valid until 2029-10-12.

**Is CFCA EV ROOT cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).