# DigiCert Assured ID Root G2 root certificate (DigiCert)

> DigiCert Assured ID Root G2 is a root CA certificate operated by DigiCert (RSA 2048, valid until 2038-01-15, SHA-256 7D05EBB6). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/digicert-assured-id-root-g2/
Last updated: 2026-11-10

DigiCert Assured ID Root G2 is a root CA certificate operated by DigiCert (RSA 2048, valid until 2038-01-15, SHA-256 7D05EBB6). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | DigiCert |
| Subject | CN=DigiCert Assured ID Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US |
| SHA-256 | 7D05EBB682339F8C9451EE094EEBFEFA7953A114EDB2F44949452FAB7D2FC185 |
| SPKI SHA-256 | F1C6BA670CFC88E4DF52973CAE420F0A089DD474144FE5806C420064E1591229 |
| Valid from | 2013-08-01 |
| Expires | 2038-01-15 |
| Key | RSA 2048 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | B931C3AD63967EA6723BFC3AF9AF44B |
| SHA-1 (Windows thumbprint) | A14B48D943EE0A0E40904F3CE0A4C09193515D3F |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2026-09-14 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: 2.16.840.1.114412.2.1; First included in: NSS 3.16.3 / Firefox 32; Inclusion bug: #908827 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email, Time Stamping |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2026-09-14 (sct_not_after). Mozilla treats it as an EV root for policy OID 2.16.840.1.114412.2.1.

## Intermediate CAs issued by this root

The CCADB lists 163 intermediate CA certificates signed directly by DigiCert Assured ID Root G2: 139 currently valid, 9 expired and 15 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| DigiCert Assured ID G2 TLS RSA4096 SHA256 2026 CA2 | DigiCert | 2036-08-20 | Valid | B2F24C4F1F9E3C778B72DFA9F521C67C64BB358A2981D3B197BF6C78173D804E |
| DigiCert KMS Solutions GCC-H Email CA - G2 | DigiCert | 2036-01-27 | Valid | 390EAAA8C02D67E6FDE363618018086F2990A9382680D665B856F8A0A0ABE855 |
| Noblis Co-branded Issuing CA | DigiCert | 2035-10-14 | Valid | 1A6B8C723B46FAAA576E21023D4027F4578EE4E5470DFEF4F2A0EE592912B31D |
| Department for Work & Pensions Client CA | DigiCert | 2035-09-16 | Valid | 688A522A69C50EF873E83372AA50D6952CA3E220857A4124B0D85CE5EABEC09D |
| SGN FISGLOBAL PUBLIC CA 3 | DigiCert | 2035-09-03 | Valid | 2D052222D1C121BDE5B9D8EF864BFA20C45D03ADABF00CD9BC851AC03622B1A1 |
| Telenor Norge AS T G2 CA | DigiCert | 2035-08-26 | Valid | E868FF45CE7D742C3B61194D43E51FA1CC3C617B87F6882A019EDF2BA0B2356F |
| Telenor Norge AS P G2 CA | DigiCert | 2035-08-26 | Valid | 9FC0B0B399FFC555941851E9A1328E76897459AF362052F62E42F832116A0F7C |
| NGA CA G5 | DigiCert | 2035-04-15 | Valid | 9D065A048E5E2E06B636D587D9BF0846D19CAF3CA72B8FB4A2C4031CB5BE090D |
| Absa Group Limited Public CA2 | DigiCert | 2035-04-01 | Valid | 0252D56D189AE39C34CD97F7EB7985E8A32F1FBB7F66765DB18FD302A82F172E |
| Freistaat Bayern ICA | DigiCert | 2035-03-11 | Valid | FBEBB9D2767421F17BCFBF343340D4278DE08D033D46555613FB1F9D395B29BA |
| WIPO CA - G6 | DigiCert | 2035-03-11 | Valid | CD773D75F221155821A53052CC6593BF85845D652E1E2E38A4740A4C3DFB1F60 |
| ULA CA - G7 | DigiCert | 2035-02-25 | Valid | 10FC8BECBC62C04EADDCA5D0200C632166C1A2CBDC9510CB8BA18A5307200C4F |
| Shell Corporate Email CA G2 | DigiCert | 2035-02-11 | Valid | 27C7DA4ED84B7246D25CD91C485AB6E977B6CB6236E7D71BAC4A799DD68CB7D4 |
| Avaya Client Services Users CA 3 | DigiCert | 2035-02-04 | Valid | 14D36E7B5408AA087DEC27F9E0E76CBBCA7C9A4A048DFB94ADAB6C013A54D1AA |
| Saudi Telecom Company Email CA - G2 | DigiCert | 2035-01-28 | Valid | C2EC478A71391480CDC9E8147A18B2C4DF449D15AECC3D068C51BF654086D9C5 |
| Adacom S.A. Class 1 - Public Trust CA G4 | DigiCert | 2035-01-14 | Valid | 5C0658F78140CF3B64C53F2006E8FFC7D4AE17ADCCF371AA4756447E29C55640 |
| Adacom S.A. Class 2 - Public Trust CA G4 | DigiCert | 2035-01-14 | Valid | 39AB1C31D07C934BF3DF554BDCB9BD91850DF622FBE26B2BFE9B96493E79E30A |
| Giesecke and Devrient CA G2 | DigiCert | 2034-12-11 | Valid | 6E989B7B1BC0EAA07B6BC6FBB5D41C9DAFF7041F5205E98082EC691DFEB8D83E |
| SRI International CA - G5 | DigiCert | 2034-11-19 | Valid | 900512B946FB1C3552EDE6A93F22A12B5031C79C6FE0837D85E1EEA0AD493C70 |
| Johns Hopkins Aramco Healthcare Issuing CA - G3 | DigiCert | 2034-11-19 | Valid | 0B5A6C1F3DE21CC2D04389D91807A62A03D2DBCFC2A84CDD227DAA2A66792DB5 |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as DigiCert Assured ID Root G2 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not DigiCert Assured ID Root G2, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| DigiCert High Assurance EV Root CA | DigiCert | 2031-11-09 | Valid | D9AE5ED27C9C6485296C89A29D222F4AB2BC7EECA51ECC8D2D7A23FE9C1151DA |

## What happens when it expires

DigiCert Assured ID Root G2 is valid until 2038-01-15, about 11.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2026-09-14.

## FAQ

**Is DigiCert Assured ID Root G2 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2026-09-14.

**When does DigiCert Assured ID Root G2 expire?**

On 2038-01-15, about 11.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has DigiCert Assured ID Root G2 issued?**

The CCADB lists 163: 139 valid, 9 expired and 15 revoked. The newest valid one is DigiCert Assured ID G2 TLS RSA4096 SHA256 2026 CA2, valid until 2036-08-20.

**Is DigiCert Assured ID Root G2 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by DigiCert High Assurance EV Root CA; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).