# SecureSign Root CA14 root certificate (Cybertrust Japan)

> SecureSign Root CA14 is a root CA certificate operated by Cybertrust Japan (RSA 4096, valid until 2045-04-08, SHA-256 4B009C10). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Mozilla, Microsoft.

Source: https://ssl.sh/roots/cybertrust-japan-securesign-root-ca14/
Last updated: 2026-11-10

SecureSign Root CA14 is a root CA certificate operated by Cybertrust Japan (RSA 4096, valid until 2045-04-08, SHA-256 4B009C10). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Mozilla, Microsoft.

| Field | Value |
|---|---|
| CA owner | Cybertrust Japan |
| Subject | CN=SecureSign Root CA14,O=Cybertrust Japan Co.\, Ltd.,C=JP |
| SHA-256 | 4B009C1034494F9AB56BBA3BA1D62731FC4D20D8955ADCEC10A925607261E338 |
| SPKI SHA-256 | 581CC15821169694C39C2991B53E93AB945A42B076661774C2ECF38A3323ACEA |
| Valid from | 2020-04-08 |
| Expires | 2045-04-08 |
| Key | RSA 4096 |
| Signature algorithm | sha384WithRSAEncryption |
| Serial number | 64DB5A0C204EE8D72977C85027A25A27DD2DF2CB |
| SHA-1 (Windows thumbprint) | DD50C0F779B3642E74A2B89D9FD340DDBBF0F24F |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Not included | No | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: NSS 3.104 / Firefox 131 |
| Apple | Not included | No | - | - |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Secure Email; Not-before cutoff: 2026-05-19 (Secure Email) |

Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 9 intermediate CA certificates signed directly by SecureSign Root CA14: 1 currently valid, 0 expired and 8 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Cybertrust Japan SureServer EV CA G9 | Cybertrust Japan / JCSI | 2030-06-22 | Valid | 93397E182492A7E7C582BADFE04348E6FA985CBA19AFDE16FD740FF03857367C |
| Cybertrust Japan SureTime CA G3 | Cybertrust Japan / JCSI | 2037-09-09 | Revoked | F8D976C1190F85B54EBD88B45986FCF475D1A58F8CFD1D70B0E40A6346BBA4A6 |
| Cybertrust Japan SureTime CA G3 | Cybertrust Japan / JCSI | 2036-06-22 | Revoked | CC0A0DF79B94888CB630FE07C43CF43E592813AE26D9141D410BAC0A16D7478C |
| Cybertrust Japan SureCode CA G3 | Cybertrust Japan / JCSI | 2036-06-22 | Revoked | A2383AF3FDE129CCFB7865D057D40A1A4BDA70E1E45C53E8BB58681AF62E1B4B |
| Cybertrust Japan SureCode EV CA G3 | Cybertrust Japan / JCSI | 2036-06-22 | Revoked | 87CC9D3EDF3F8517D922944AA114A5576AB4FD8DF09E35D10FF314C8EA172619 |
| Cybertrust Japan SureServer EV CA G6 | Cybertrust Japan / JCSI | 2030-06-03 | Revoked | E8DC1CB6EAEC23B16BDF7E1BD57D25AB91975829953B3873483D54A6A465AA34 |
| Cybertrust Japan SureCode CA G1 | Cybertrust Japan / JCSI | 2036-04-09 | Revoked | C0BE67133B36BBEE3A05DC34FCFB866C0EE8EBC3D862B248A7EEC7E035B4A57A |
| Cybertrust Japan SureTime CA G1 | Cybertrust Japan / JCSI | 2036-04-09 | Revoked | AE5ECCCAD770233E9AC5A2CE773CE752EB8DF51D7EA6FFC70BFF687613BD84CE |
| Cybertrust Japan SureCode EV CA G1 | Cybertrust Japan / JCSI | 2036-04-09 | Revoked | 0C6F6C6F6AC9508DBE69D4BDDC0C6C4CB52E3A0B54975B3BE483449799E0F3D6 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as SecureSign Root CA14 with a different issuer, so a client has to carry SecureSign Root CA14 itself in its root store to trust it.


## What happens when it expires

SecureSign Root CA14 is valid until 2045-04-08, about 18.4 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is SecureSign Root CA14 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Mozilla, Microsoft trust it for TLS server authentication; Chrome, Apple do not.

**When does SecureSign Root CA14 expire?**

On 2045-04-08, about 18.4 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has SecureSign Root CA14 issued?**

The CCADB lists 9: 1 valid, 0 expired and 8 revoked. The newest valid one is Cybertrust Japan SureServer EV CA G9, valid until 2030-06-22.

**Is SecureSign Root CA14 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).