# DigiCert Global Root G2 root certificate (DigiCert)

> DigiCert Global Root G2 is a root CA certificate operated by DigiCert (RSA 2048, valid until 2038-01-15, SHA-256 CB3CCBB7). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/digicert-global-root-g2/
Last updated: 2026-11-10

DigiCert Global Root G2 is a root CA certificate operated by DigiCert (RSA 2048, valid until 2038-01-15, SHA-256 CB3CCBB7). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | DigiCert |
| Subject | CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US |
| SHA-256 | CB3CCBB76031E5E0138F8DD39A23F9DE47FFC35E43C1144CEA27D46A5AB1CB5F |
| SPKI SHA-256 | 8BB593A93BE1D0E8A822BB887C547890C3E706AAD2DAB76254F97FB36B82FC26 |
| Valid from | 2013-08-01 |
| Expires | 2038-01-15 |
| Key | RSA 2048 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 33AF1E6A711A9A0BB2864B11D09FAE5 |
| SHA-1 (Windows thumbprint) | DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2027-09-14 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.16.840.1.114412.2.1; First included in: NSS 3.16.3 / Firefox 32; Inclusion bug: #908827 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email, Time Stamping; Not-before cutoff: 2021-08-01 (Code Signing) |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2027-09-14 (sct_not_after). Mozilla treats it as an EV root for policy OID 2.16.840.1.114412.2.1.

## Intermediate CAs issued by this root

The CCADB lists 100 intermediate CA certificates signed directly by DigiCert Global Root G2: 57 currently valid, 12 expired and 31 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Aliyun RSA TLS OV G1 | DigiCert | 2030-12-02 | Valid | A1CA51340099B594DAC34BF3DFE0C27216885A5EC27ECBC3A090BEFEF1CBA63D |
| Aliyun RSA TLS DV G1 | DigiCert | 2030-12-02 | Valid | 5195F9E283EA8DC20D6B94648259176796D4AD354382A38190587D68F48D7D59 |
| Microsoft TLS RSA Root G2 | Microsoft Corporation | 2029-06-19 | Valid | DDCD1E8A20638D4AAFF7201BB1D56452ACD2C759F1686BDC38F73DD15732BDC2 |
| Apple Public EV Server RSA CA 4 - G1 | Apple Inc. | 2030-04-10 | Valid | 4A7F104F057D52F1AB912D41C1200744019E0E38A56FF27F4FA7ADB4E9A3AB9C |
| Abion Intermediate CA | DigiCert | 2035-02-18 | Valid | 7728F1821E509C76152C22223E7679033344FDC36879C8DDD6ADBC2EF95277B8 |
| DNSPod DV TLS RSA CA 2025 | DigiCert | 2035-01-07 | Valid | A4B61180AB9684BBC0548C6E276FAF65F1BFD13984310D8BE81DE56182B52916 |
| TrustAsia DV TLS RSA CA 2025 | DigiCert | 2035-01-07 | Valid | A2BDAA59BF9E8C3FC1FD4A94A85159B5618BE132B162C594944CAD4377ECA78C |
| TrustAsia TLS Pro RSA CA 2025 | DigiCert | 2035-01-07 | Valid | 416A2C89515B8BC14E13677024E2A82E8B1B2F4117A88FD11B8BBD25D1A5C517 |
| DNSPod TLS RSA CA 2025 | DigiCert | 2035-01-07 | Valid | 14F1F7429378AADA4E7AC360A6C4B481DC245E00A74CDE85E923BD2DDCED2F05 |
| Verokey Verified Business SHA256 | DigiCert | 2034-07-23 | Valid | B10ED8C2C76C7C99FC175B23B8E78F3F0C15D197DF3AA2C87FF29E92414711E9 |
| Verokey High Assurance Verified Business SHA256 | DigiCert | 2034-07-23 | Valid | A542DE4E6ECD35ABEB009EB5D5EC3887EC4371794BCF25CEEAE0E1881C51D5DD |
| Cloudflare Inc RSA CA-3 | DigiCert | 2029-07-09 | Valid | 9FB0385317FAB1C00541B274A6C82B7644DE7C7FD4BB5E335DE445FA0A96BFD9 |
| PerfectSSL | DigiCert | 2034-04-16 | Valid | 6B40D3DBAAD68BE6E804E32085F7837CEE08B7C4FA6A990B36227A6DCFF0873B |
| GandiCert | DigiCert | 2034-04-16 | Valid | 3337D4E4B4EF6A94F04915D2E86B1F8F47A3C83667DA2519D9B95AE7270AFFE1 |
| CrowdStrike Federal EV RSA CA G1 | DigiCert | 2033-08-14 | Valid | EDEDD0053CB844592E673EF2A081C15B38EE3ECBEB5856C9A4FE9B7169FAFFE7 |
| GeoTrust Global G2 TLS EUR RSA4096 SHA384 2023 CA1 | DigiCert | 2033-06-13 | Valid | 9E7E310303EDA686FCC5F55F7506895B15FF05C780EEEADEAB9D016DB672F3BA |
| Vitalwerks Internet Solutions, No-IP TLS ICA | DigiCert | 2033-02-22 | Valid | 2AE0626F9A43EDB2B0A22D410EB06C482EF982563A717A247287C504D79BF980 |
| DigiCert Basic OV G2 TLS CN RSA4096 SHA256 2022 CA1 | DigiCert | 2032-12-14 | Valid | F16C99CDE19ED1ACE8B4FBC700E05E7EFF2116FD6A22427766B251C6E8BB3CE7 |
| DigiCert Secure Site Pro EV G2 TLS CN RSA4096 SHA256 2022 CA1 | DigiCert | 2032-12-14 | Valid | B480E11A6BD0C2BC538B1C7DB1C63B40694E5DEDD93752D082D9FD422FCB3FBD |
| DigiCert Secure Site EV G2 TLS CN RSA4096 SHA256 2022 CA1 | DigiCert | 2032-12-14 | Valid | 8FC89B7368A29129735677440476908711DA8F3F04C0AB6A61D6DE9D4EB4D1C2 |

## Cross-signed versions

7 certificate(s) in the CCADB have the same subject and public key as DigiCert Global Root G2 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not DigiCert Global Root G2, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| VeriSign Class 3 Public Primary Certification Authority - G5 | DigiCert | 2028-04-02 | Valid | AADADD5A879D2EB8C41A89597291292709D42052F5B6399541C694C3B7353CD1 |
| VeriSign Universal Root Certification Authority | DigiCert | 2031-03-03 | Valid | 0BA8C0D459B76ABC0825294F565E24F4F169D4A4819D0692D371522D297724B8 |
| DigiCert High Assurance EV Root CA | DigiCert | 2031-11-08 | Valid | CAF8AD697F7BDA712AB127A8AD8B83F74A91A0DE1784A1B483FEF9AC79B67513 |
| DigiCert High Assurance EV Root CA | DigiCert | 2031-11-08 | Valid | A0D609A7E3C434E878A9A1C1BD065B8DCF33AA7EFEE1B11BC75CCE5E5A042080 |
| DigiCert Global Root CA | DigiCert | 2031-11-09 | Valid | 6523C34F1E879ADD7603CB2048A898A5E2F0C6C4B512C0D22782B85D43AE3371 |
| DigiCert Global Root CA | DigiCert | 2031-11-09 | Valid | 79D57B15DFA65C2870EAFE11B637765909CFE937B49C15CE7F194030CAB395AD |
| VeriSign Class 3 Public Primary Certification Authority - G5 | DigiCert | 2022-11-05 | Expired | 2D4FAD3455AB61397401ABBB518922F84336B67E02FC8D2DB283825C4AB981BB |

## What happens when it expires

DigiCert Global Root G2 is valid until 2038-01-15, about 11.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2027-09-14.

## FAQ

**Is DigiCert Global Root G2 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2027-09-14.

**When does DigiCert Global Root G2 expire?**

On 2038-01-15, about 11.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has DigiCert Global Root G2 issued?**

The CCADB lists 100: 57 valid, 12 expired and 31 revoked. The newest valid one is Aliyun RSA TLS OV G1, valid until 2030-12-02.

**Is DigiCert Global Root G2 cross-signed?**

Yes. The CCADB has 7 cross-certificate(s) with its subject and key, signed by VeriSign Class 3 Public Primary Certification Authority - G5, VeriSign Universal Root Certification Authority, DigiCert High Assurance EV Root CA, DigiCert Global Root CA; 6 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).