# DigiCert Global Root G3 root certificate (DigiCert)

> DigiCert Global Root G3 is a root CA certificate operated by DigiCert (ECDSA P-384, valid until 2038-01-15, SHA-256 31AD6648). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/digicert-global-root-g3/
Last updated: 2026-11-10

DigiCert Global Root G3 is a root CA certificate operated by DigiCert (ECDSA P-384, valid until 2038-01-15, SHA-256 31AD6648). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | DigiCert |
| Subject | CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US |
| SHA-256 | 31AD6648F8104138C738F39EA4320133393E3A18CC02296EF97C2AC9EF6731D0 |
| SPKI SHA-256 | B94C198300CEC5C057AD0727B70BBE91816992256439A7B32F4598119DDA9C97 |
| Valid from | 2013-08-01 |
| Expires | 2038-01-15 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | 55556BCF25EA43535C3A40FD5AB4572 |
| SHA-1 (Windows thumbprint) | 7E04DE896A3E666D00E687D33FFAD93BE83D349E |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2027-09-14 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.16.840.1.114412.2.1; First included in: NSS 3.16.3 / Firefox 32; Inclusion bug: #908827 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email, Time Stamping |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2027-09-14 (sct_not_after). Mozilla treats it as an EV root for policy OID 2.16.840.1.114412.2.1.

## Intermediate CAs issued by this root

The CCADB lists 79 intermediate CA certificates signed directly by DigiCert Global Root G3: 41 currently valid, 10 expired and 28 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| DigiCert TLS ECC P384 Root G5 | DigiCert | 2036-06-09 | Valid | 0AB3D50EF9CB924D65F77BA13E597C7C5B00E73AC165AA17D26B7F613BBACD91 |
| DigiCert TLS ECC P384 Root G5 | DigiCert | 2036-03-30 | Valid | 3142F99D358D9B500E5CDD2DFF8F719A8CCECF589652334848522CCA807D0807 |
| Aliyun ECC TLS OV G1 | DigiCert | 2030-12-02 | Valid | 9445476D398974A0C67A6D1024A0ABFF2D4E04A08DB455B7CE4E0FA58D16A5A9 |
| Aliyun ECC TLS DV G1 | DigiCert | 2030-12-02 | Valid | 055408343CB3D4823072C1DFE99AE099ED4F203C6AE93FBA27E3B666349E9840 |
| Microsoft TLS ECC Root G2 | Microsoft Corporation | 2029-06-19 | Valid | 61799E3594F6FA6C9F619031E4A3C9F643FDA38C083704A5075E5709A21B1AB7 |
| DNSPod DV TLS ECC CA 2025 | DigiCert | 2035-01-07 | Valid | F9A12708BF2D2D3C2C5A48549131230641A91C700EE7EA4092C69C1A7995AD6E |
| TrustAsia TLS Pro ECC CA 2025 | DigiCert | 2035-01-07 | Valid | CCB2B1567BE8FCB35BC39FEEDB95312D82ADFE21C98956F4FA3AC72E26AED359 |
| DNSPod TLS ECC CA 2025 | DigiCert | 2035-01-07 | Valid | 6AB3235DC28CF3B44EC0620CFD7C5656FE601883B6ACEDF9931CDC220B8A38B5 |
| TrustAsia DV TLS ECC CA 2025 | DigiCert | 2035-01-07 | Valid | 332F96D9C2105900ED4EC2929CF786677DD6B0DF2210D646CCA89B84321B1327 |
| Cloudflare Inc ECC CA-4 | DigiCert | 2029-07-09 | Valid | 7EB5F4AAAC39B3A7835D76F722A473F9B4911E4A3691DE78B3C2973595764EA2 |
| GeoTrust Global G3 TLS EUR ECC P384 SHA384 2023 CA1 | DigiCert | 2033-06-13 | Valid | 57E0B33504DBAF6F29A095CB8A297A4ABEC121CE11640EFAFC17594098F6CAA9 |
| Encryption Everywhere G3 TLS ECC P384 SHA384 2023 CA1 | DigiCert | 2033-02-01 | Valid | DA1F7CBF322E55CC082276F8519147DFA1E80CBAF7D5799FF771358832ED1712 |
| DigiCert Basic OV G3 TLS CN ECC P-384 SHA384 2022 CA1 | DigiCert | 2032-12-19 | Valid | B5528F4A43957E1ABBE08C4EBF2D8ACF4C2C1914D6354117492C8C3FE033FD97 |
| DigiCert Secure Site Pro EV G3 TLS CN ECC P-384 SHA384 2022 CA1 | DigiCert | 2032-12-19 | Valid | 95F6B9230F27FB5FC0CB29443DBE7300168B5992C7558F3F63D4352F32B8C9CB |
| DigiCert Secure Site EV G3 TLS CN ECC P-384 SHA384 2022 CA1 | DigiCert | 2032-12-19 | Valid | 943BC406B0B45ACF88413045227265703F1AC8B21D6FBC2B8CBDE59D7CE51B81 |
| GeoTrust G3 TLS CN ECC P-384 SHA384 2022 CA1 | DigiCert | 2032-12-19 | Valid | 662871C80F4E0FD219EA69AAFC4D28AD7B41E9381560BEE787848D4EEF1CBF24 |
| DigiCert Secure Site OV G3 TLS CN ECC P-384 SHA384 2022 CA1 | DigiCert | 2032-12-19 | Valid | 38D530FB170053617E47AA6CEFF21C2DB43C9D96741AF1584566072091474BB3 |
| DigiCert Secure Site Pro G3 TLS CN ECC P-384 SHA384 2022 CA1 | DigiCert | 2032-12-19 | Valid | 34CDC67D88D25217ADC8A25348E114CBEC63148391CFA475D382874695202D2C |
| DigiCert Basic EV G3 TLS CN ECC P-384 SHA384 2022 CA1 | DigiCert | 2032-12-19 | Valid | 1CA57EF159812BFBE2D8106F6152E51DDD0A5A4C9489CD097595B797CB37843E |
| GeoTrust EV G3 TLS CN ECC P-384 SHA384 2022 CA1 | DigiCert | 2032-12-19 | Valid | 02F40238BA372E9DF51D7540E04EDFEDAB5439323F9A02DF5B38C074CA7D406E |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as DigiCert Global Root G3 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not DigiCert Global Root G3, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| VeriSign Class 3 Public Primary Certification Authority - G4 | DigiCert | 2022-11-05 | Expired | 53A5E32ACC5714ED20C7778C655D1EE97EC07156074C8B016E2CFC73E9D2712B |

## What happens when it expires

DigiCert Global Root G3 is valid until 2038-01-15, about 11.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2027-09-14.

## FAQ

**Is DigiCert Global Root G3 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2027-09-14.

**When does DigiCert Global Root G3 expire?**

On 2038-01-15, about 11.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has DigiCert Global Root G3 issued?**

The CCADB lists 79: 41 valid, 10 expired and 28 revoked. The newest valid one is DigiCert TLS ECC P384 Root G5, valid until 2036-06-09.

**Is DigiCert Global Root G3 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by VeriSign Class 3 Public Primary Certification Authority - G4; 0 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).