中文

Root certificate · D-Trust

D-TRUST Root Class 3 CA 2 EV 2009

D-TRUST Root Class 3 CA 2 EV 2009 is a root CA certificate operated by D-Trust (RSA 2048, valid until 2029-11-05, SHA-256 EEC5496B). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Data updated

Root store status

Root storeStatusTrusted for TLSDistrust for TLS afterConstrained
ChromeIncluded IncludedYes2026-05-28Yes
MozillaIncluded IncludedYes—No
AppleIncluded IncludedYes—No
MicrosoftIncluded IncludedYes—Yes

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2026-05-28 (sct_not_after). Mozilla treats it as an EV root for policy OID 1.3.6.1.4.1.4788.2.202.1.

Included Chrome

Status
Included
Distrust for TLS after
2026-05-28

Included Mozilla

Status
Included
Trust bits
Websites
EV policy OIDs
1.3.6.1.4.1.4788.2.202.1
First included in
NSS 3.15 / Firefox 23
Inclusion bug
#467891

Included Apple

Status
Included
Trust bits
serverAuth, clientAuth

Included Microsoft

Status
Included
Trusted EKUs
Server Authentication, Client Authentication, Code Signing, Secure Email, Time Stamping
Not-before cutoff
2025-09-15 (Code Signing, Secure Email, Time Stamping)

"Trusted for TLS" means the store includes the root with the server-authentication trust bit (Mozilla "Websites", Apple serverAuth, Microsoft Server Authentication EKU). Microsoft "NotBefore" means only certificates issued before a cutoff date are still trusted. "Constrained" means the store applies extra restrictions.

Details

CA owner
D-Trust
Subject
CN=D-TRUST Root Class 3 CA 2 EV 2009,O=D-Trust GmbH,C=DE
SHA-256
EEC5496B988CE98625B934092EEC2908BED0B0F316C2D4730C84EAF1F3D34881
SHA-1 (Windows thumbprint)
96C91B0B95B4109842FAD0D82279FE60FAB91683
SPKI SHA-256
FF342FB6C4C8BD30A4706F73489539F19E6E48CC05F46254654F6610DBC540E9
Valid from
2009-11-05
Expires
2029-11-05
Key
RSA 2048
Signature algorithm
sha256WithRSAEncryption
Serial number
983F4
Country
DE
Trust bits (CCADB)
Server Authentication, Client Authentication
EV policy OIDs (CCADB)
1.3.6.1.4.1.4788.2.202.1, 2.23.140.1.1 · TLS EV capable: Yes
Test websites
valid: https://certdemo-ev-valid.ssl.d-trust.net/ · expired: https://certdemo-ev-expired.ssl.d-trust.net/ · revoked: https://certdemo-ev-revoked.ssl.d-trust.net/
CCADB record
A000127
PEM
d-trust-root-class-3-ca-2-ev-2009.pem

Look up this certificate on crt.sh

Intermediate CAs issued by this root

The CCADB lists 5 intermediate CA certificates signed directly by D-TRUST Root Class 3 CA 2 EV 2009: 4 currently valid, 0 expired and 1 revoked (revoked includes those whose parent was revoked).

Showing 5 of 5: valid certificates first, newest first. Each name links to its crt.sh entry by SHA-256; an arrow marks a cross-certificate for another root on this site.

IntermediateOperated byExpiresStatus
D-TRUST EV Root CA 1 2020 → D-TRUST EV Root CA 1 2020 D-Trust2029-11-05Valid
D-TRUST EV Root CA 2 2023 → D-TRUST EV Root CA 2 2023 D-Trust2029-11-05Valid
D-TRUST CA 2-2 EV 2016 D-TRUST2029-11-05Valid
D-TRUST SSL Class 3 CA 1 EV 2009 D-TRUST2029-11-05Valid
VR IDENT EV SSL CA 2020 D-TRUST2029-11-05Revoked

Cross-signed versions

No certificate in the CCADB has the same subject and public key as D-TRUST Root Class 3 CA 2 EV 2009 with a different issuer, so a client has to carry D-TRUST Root Class 3 CA 2 EV 2009 itself in its root store to trust it.

CRL and OCSP addresses

In the root certificate

  • CRL: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
  • CRL: http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl

Full CRL this CA publishes (CCADB)

  • http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
  • http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl

Used by the intermediates it issued

Addresses found in the CRL Distribution Points and OCSP fields of the 4 valid intermediates signed by D-TRUST Root Class 3 CA 2 EV 2009; the number in brackets is how many of them use each address.

  • CRL: http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl (3)
  • CRL: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009,O=D-Trust%20GmbH,C=DE?certificaterevocationlist (2)
  • CRL: http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl (1)
  • OCSP: http://d-trust-root-class-3-ca-2-ev-2009.ocsp.d-trust.net (2)
  • OCSP: http://root-c3-ca2-ev-2009.ocsp.d-trust.net (2)

What happens when it expires

D-TRUST Root Class 3 CA 2 EV 2009 is valid until 2029-11-05, about 3.0 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2026-05-28.

Check whether your device trusts it

Each platform keeps its own root store. The commands below look up D-TRUST Root Class 3 CA 2 EV 2009 by common name (D-TRUST Root Class 3 CA 2 EV 2009) or fingerprint. The store status in each heading comes from the CCADB snapshot; your device can differ if it is out of date or managed by an administrator.

macOS (Apple store: Included · Trusted for TLS)

Search the system roots keychain by common name. -Z prints the SHA-256 hash, which must match the fingerprint on the last line.

security find-certificate -a -c "D-TRUST Root Class 3 CA 2 EV 2009" -Z \
  /System/Library/Keychains/SystemRootCertificates.keychain | grep "SHA-256"
# SHA-256 hash: EEC5496B988CE98625B934092EEC2908BED0B0F316C2D4730C84EAF1F3D34881

Windows (Microsoft store: Included · Trusted for TLS)

Windows identifies roots by SHA-1 thumbprint. It installs third-party roots on demand through Automatic Root Certificates Update, so "not found" can also mean the root has not been needed yet; certutil -generateSSTFromWU roots.sst downloads Microsoft's full list.

certutil -verifystore Root 96C91B0B95B4109842FAD0D82279FE60FAB91683

Linux (ca-certificates follows Mozilla: Included · Trusted for TLS)

Debian, Ubuntu, Fedora and RHEL build their ca-certificates package from Mozilla's root store. Use trust list on p11-kit systems, or search the PEM bundle on Debian and Ubuntu.

# Fedora / RHEL / Arch (p11-kit)
trust list --filter=ca-anchors | grep -iF -A2 "D-TRUST Root Class 3 CA 2 EV 2009"
# Debian / Ubuntu (ca-certificates)
openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt \
  | openssl pkcs7 -print_certs -noout | grep -iF "D-TRUST Root Class 3 CA 2 EV 2009"

Java

Java ships its own cacerts keystore; JDK 9 and later accept -cacerts and the default store password is changeit. Search for the SHA-256 fingerprint in colon form.

keytool -list -cacerts -storepass changeit | grep -i "EE:C5:49:6B:98:8C:E9:86:25:B9:34:09:2E:EC:29:08:BE:D0:B0:F3:16:C2:D4:73:0C:84:EA:F1:F3:D3:48:81"

Android

Android's system store is maintained by Google separately from the four CCADB stores above. Open Settings → Security & privacy → More security settings → Encryption & credentials → Trusted credentials → System (menu names vary by vendor and version) and look for D-Trust GmbH → D-TRUST Root Class 3 CA 2 EV 2009.

Which root does my site chain to?

List the chain your server sends and compare the last issuer with this root; the fingerprint check confirms a local copy.

Download PEM

# show subject (s:) and issuer (i:) of every certificate the server sends
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null \
  | grep -E '^ *[0-9]+ s:|^ *i:'
# subject and SHA-256 fingerprint of the downloaded PEM file
openssl x509 -in d-trust-root-class-3-ca-2-ev-2009.pem -noout -subject -fingerprint -sha256
# sha256 Fingerprint=EE:C5:49:6B:98:8C:E9:86:25:B9:34:09:2E:EC:29:08:BE:D0:B0:F3:16:C2:D4:73:0C:84:EA:F1:F3:D3:48:81

FAQ

Is D-TRUST Root Class 3 CA 2 EV 2009 trusted by Chrome, Firefox, Safari and Windows?

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2026-05-28.

When does D-TRUST Root Class 3 CA 2 EV 2009 expire?

On 2029-11-05, about 3.0 years after the 2026-11-10 data snapshot.

How many intermediate certificates has D-TRUST Root Class 3 CA 2 EV 2009 issued?

The CCADB lists 5: 4 valid, 0 expired and 1 revoked. The newest valid one is D-TRUST EV Root CA 1 2020, valid until 2029-11-05.

Is D-TRUST Root Class 3 CA 2 EV 2009 cross-signed?

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Other roots from D-Trust

Sources

  1. CCADB — Resources (TLS Server Authentication report, All Included Root Certificate Trust Bit Settings)
  2. CCADB — All Certificate Information (root and intermediate), CSV V5
  3. CCADB — Mozilla Included CA Certificate Report
  4. CCADB — Chrome / Mozilla / Apple / Microsoft TLS Server Authentication CSV