# DigiCert High Assurance EV Root CA root certificate (DigiCert)

> DigiCert High Assurance EV Root CA is a root CA certificate operated by DigiCert (RSA 2048, valid until 2031-11-10, SHA-256 7431E5F4). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/digicert-high-assurance-ev-root-ca/
Last updated: 2026-11-10

DigiCert High Assurance EV Root CA is a root CA certificate operated by DigiCert (RSA 2048, valid until 2031-11-10, SHA-256 7431E5F4). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | DigiCert |
| Subject | CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US |
| SHA-256 | 7431E5F4C3C1CE4690774F0B61E05440883BA9A01ED00BA6ABD7806ED3B118CF |
| SPKI SHA-256 | 5A889647220E54D6BD8A16817224520BB5C78E58984BD570506388B9DE0F075F |
| Valid from | 2006-11-10 |
| Expires | 2031-11-10 |
| Key | RSA 2048 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 2AC5C266A0B409B8F0B79F2AE462577 |
| SHA-1 (Windows thumbprint) | 5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | No | - | Trust bits: Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.11.8 / Firefox 2; Inclusion bug: #364568 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email, Time Stamping |

The CCADB lists EV policy OID 2.23.140.1.1, 2.16.840.1.114412.1.3.0.2, 2.16.840.1.114412.2.1, 2.23.140.1.3 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 94 intermediate CA certificates signed directly by DigiCert High Assurance EV Root CA: 65 currently valid, 23 expired and 6 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| DigiCert Assured ID Root G2 | DigiCert | 2031-11-09 | Valid | D9AE5ED27C9C6485296C89A29D222F4AB2BC7EECA51ECC8D2D7A23FE9C1151DA |
| DigiCert Global Root G2 | DigiCert | 2031-11-08 | Valid | A0D609A7E3C434E878A9A1C1BD065B8DCF33AA7EFEE1B11BC75CCE5E5A042080 |
| DigiCert Global Root G2 | DigiCert | 2031-11-08 | Valid | CAF8AD697F7BDA712AB127A8AD8B83F74A91A0DE1784A1B483FEF9AC79B67513 |
| DigiCert TLS RSA4096 Root G5 | DigiCert | 2031-11-09 | Valid | B9D53F235C5FA8C92EB31DCFCADF4959B34A32AF36ACA1EA10F07D6551C398A5 |
| DigiCert Trusted Root G4 | DigiCert | 2031-11-09 | Valid | E9158C6AF5688CFCF9890206C43061C81FA7FC07D08E28A27C068C58073A699A |
| Apple Public EV Server RSA CA 3 - G1 | Apple Inc. | 2030-04-10 | Valid | E881D3B83C3BC694D7D99F92DE83B2BFF5C6EE2D9871A446DEA107D6397565FC |
| HydrantID EV SSL CA D1 | DigiCert | 2031-03-29 | Valid | F9D4A6C011E9C6A8F5A4CF7ED0416869C7238EF93A56161EA6CA3D8B41716097 |
| CrowdStrike Global EV CA G2 | DigiCert | 2031-03-29 | Valid | 9ED1EDEA95AA5B72B513A3E41A1BA0D2EFB14CEC88891E34D00495C95556605C |
| CrowdStrike Global EV CA | DigiCert | 2031-03-29 | Valid | 86B109232C19EC514F8CB26788E65090293F96DD8D2942017A33035AB225D5FB |
| DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1 | DigiCert | 2031-03-29 | Valid | 5D270CB4EFF587AD6CD17CB2B60D9084A153D77D2AA79A2CB3DB1DDB904684F5 |
| DigiCert High Assurance TLS RSA SHA256 2020 CA1 | DigiCert | 2031-03-29 | Valid | 495E6624A15340C4C74AB86037748AD62D1EF4F14E7C81AB7CDB629BE1404757 |
| DigiCert High Assurance CA-3b | DigiCert | 2031-03-29 | Valid | 28506E33F55A6072115F3E04C9BDBF5AF5312CA8FC132508B97AC99FEE0516E8 |
| HydrantID EV SSL CA D1 | DigiCert | 2031-03-03 | Valid | 863472EC79DB54077114DADE720CE1F7B41A233748FC6773FA86520F0B9AAA21 |
| CrowdStrike Global EV CA G2 | DigiCert | 2031-03-03 | Valid | 5EBD9874E6B88DA38F4A7B9566CE5D4DF05E0C224D94986AD8CC5EBA004A0C04 |
| DigiCert High Assurance TLS RSA SHA256 2020 CA1 | DigiCert | 2030-12-16 | Valid | 9BFED3D9DC95236BCFFCB35D4B120DB0E3867F62B1FD015A928DA0B303966683 |
| DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1 | DigiCert | 2030-12-16 | Valid | 74EAB573DA7DB195097BE0E90F334934C7A4C89E8083759DB4333A00EDD243D9 |
| DigiCert High Assurance CA-3b | DigiCert | 2031-11-09 | Valid | 4E30F8004C18D3D798EC5A7734346B5A5EBE8D54423CE98257FC57735A6F738D |
| Apple Public EV Server RSA CA 2 - G1 | Apple Inc. | 2030-04-10 | Valid | D6EF3E09EBE0D9370E51F5C09A532B3AC70D3CE822253F9FC84C28E9BFA550D5 |
| Thawte EV ECC CN CA G2 | DigiCert | 2030-03-13 | Valid | EA1F3BFB4D3296B467D4B582559D6518D676D5AFC7D1C24BE80252F79191046F |
| DigiCert Secure Site Pro EV ECC CN CA G3 | DigiCert | 2030-03-13 | Valid | BC91379A21E7BDE11B455BF1D51186331682805A4A353A8EE258F7A03706C664 |

## Cross-signed versions

5 certificate(s) in the CCADB have the same subject and public key as DigiCert High Assurance EV Root CA but a different issuer. A server can send one of them so that clients which trust the issuing root, but not DigiCert High Assurance EV Root CA, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Entrust.net Certification Authority (2048) | Sectigo | 2016-11-04 | Expired | 704B659F2E7A06EAD38DBF397BC4432B899FB88413E085EA572BA9C96CE60AE0 |
| Baltimore CyberTrust Root | DigiCert | 2019-07-25 | Expired | BF0ADF6F1FD218CFA27F3884CE2AA6AF2AF5481C6878BFE3A6CA62515898B115 |
| Baltimore CyberTrust Root | DigiCert | 2021-06-18 | Expired | 89DAADB41BA698BB378AEE84EAC96121D20F8C2FCA63EC686D9307229AD3EB2E |
| DigiCert Transition RSA Root | DigiCert | 2022-11-04 | Expired | 071B8B4B13AD7B2BE09FDD7FBDF3482460838098C21519B83B3150F8E919832D |
| Baltimore CyberTrust Root | DigiCert | 2025-05-10 | Expired | CBF8FB77660167E6BAACD0DF77CDA397D0117EE2BEEA23B935317F8BB5B5E3B0 |

## What happens when it expires

DigiCert High Assurance EV Root CA is valid until 2031-11-10, about 5.0 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is DigiCert High Assurance EV Root CA trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does DigiCert High Assurance EV Root CA expire?**

On 2031-11-10, about 5.0 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has DigiCert High Assurance EV Root CA issued?**

The CCADB lists 94: 65 valid, 23 expired and 6 revoked. The newest valid one is DigiCert Assured ID Root G2, valid until 2031-11-09.

**Is DigiCert High Assurance EV Root CA cross-signed?**

Yes. The CCADB has 5 cross-certificate(s) with its subject and key, signed by Entrust.net Certification Authority (2048), Baltimore CyberTrust Root, DigiCert Transition RSA Root; 0 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).