# DigiCert Assured ID Root G3 root certificate (DigiCert)

> DigiCert Assured ID Root G3 is a root CA certificate operated by DigiCert (ECDSA P-384, valid until 2038-01-15, SHA-256 7E37CB8B). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/digicert-assured-id-root-g3/
Last updated: 2026-11-10

DigiCert Assured ID Root G3 is a root CA certificate operated by DigiCert (ECDSA P-384, valid until 2038-01-15, SHA-256 7E37CB8B). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | DigiCert |
| Subject | CN=DigiCert Assured ID Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US |
| SHA-256 | 7E37CB8B4C47090CAB36551BA6F45DB840680FBA166A952DB100717F43053FC2 |
| SPKI SHA-256 | 15EED339594B304F8CF847B477371D8D6FEC61F4DB2B01AF589E7C53B35CAE4C |
| Valid from | 2013-08-01 |
| Expires | 2038-01-15 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | BA15AFA1DDFA0B54944AFCD24A06CEC |
| SHA-1 (Windows thumbprint) | F517A24F9A48C6C9F8A200269FDC0F482CAB3089 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2026-09-14 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: 2.16.840.1.114412.2.1; First included in: NSS 3.16.3 / Firefox 32; Inclusion bug: #908827 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email, Time Stamping; Not-before cutoff: 2021-08-01 (Code Signing) |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2026-09-14 (sct_not_after). Mozilla treats it as an EV root for policy OID 2.16.840.1.114412.2.1.

## Intermediate CAs issued by this root

The CCADB lists 6 intermediate CA certificates signed directly by DigiCert Assured ID Root G3: 6 currently valid, 0 expired and 0 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| DigiCert CS ECC P384 Root G5 | DigiCert | 2036-03-30 | Valid | D6962312BBB47AF2EFE71CD961B9727D63E49F2478714C06913876FDDF3F7B68 |
| DigiCert Assured ID G3 EUR CS ECC384 SHA384 2025 CA 1 | DigiCert | 2035-09-09 | Valid | 70649F8FA3924A250F5CA8307E8A9CEA48B1A943D04FA7BA0156A341E4D512C1 |
| DigiCert Assured ID G3 CS ECC384 SHA384 2025 CA1 | DigiCert | 2035-08-26 | Valid | 98FB0DED5C4EDC344FFB4360E141D3726F8ADBF301B8BC3D661649A2A6659BC3 |
| DigiCert Assured ID G3 TLS ECC384 SHA384 2022 CA1 | DigiCert | 2032-03-02 | Valid | 1C8846C406AC6294FAF0D32A5A14E79C841385A57F1159B61E9014605E37E5E9 |
| DigiCert Assured ID Client CA G3 | DigiCert | 2034-09-23 | Valid | 14FAFCA84BDB8B0EC32719272BE730FE18D6FC29301C5CF789400596EC429AFE |
| DigiCert Assured ID CA G3 | DigiCert | 2028-08-01 | Valid | 634FDF26C994E76A2918D9EFC4CAB9C6FCB344EF642A79C89192BCDA0ED52F4C |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as DigiCert Assured ID Root G3 with a different issuer, so a client has to carry DigiCert Assured ID Root G3 itself in its root store to trust it.


## What happens when it expires

DigiCert Assured ID Root G3 is valid until 2038-01-15, about 11.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2026-09-14.

## FAQ

**Is DigiCert Assured ID Root G3 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2026-09-14.

**When does DigiCert Assured ID Root G3 expire?**

On 2038-01-15, about 11.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has DigiCert Assured ID Root G3 issued?**

The CCADB lists 6: 6 valid, 0 expired and 0 revoked. The newest valid one is DigiCert CS ECC P384 Root G5, valid until 2036-03-30.

**Is DigiCert Assured ID Root G3 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).