# QuoVadis Root CA 2 root certificate (DigiCert)

> QuoVadis Root CA 2 is a root CA certificate operated by DigiCert (RSA 4096, valid until 2031-11-24, SHA-256 85A0DD7D). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/digicert-quovadis-root-ca-2/
Last updated: 2026-11-10

QuoVadis Root CA 2 is a root CA certificate operated by DigiCert (RSA 4096, valid until 2031-11-24, SHA-256 85A0DD7D). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | DigiCert |
| Subject | CN=QuoVadis Root CA 2,O=QuoVadis Limited,C=BM |
| SHA-256 | 85A0DD7DD720ADB7FF05F83D542B209DC7FF4528F7D677B18389FEA5E5C49E86 |
| SPKI SHA-256 | 8FD112C3C8370F147D5CCD3A7D865EB8DD540783BAC69FC60088E3743FF33378 |
| Valid from | 2006-11-24 |
| Expires | 2031-11-24 |
| Key | RSA 4096 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 509 |
| SHA-1 (Windows thumbprint) | CA3AFBCF1240364B44B216208880483919937CF7 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | No | - | Trust bits: Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.11.8 / Firefox 2; Inclusion bug: #365281 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, OCSP Signing, Secure Email, Time Stamping; Not-before cutoff: 2020-06-01 (OCSP Signing) |

The CCADB lists EV policy OID 2.23.140.1.1, 1.3.6.1.4.1.8024.0.2.100.1.2 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 32 intermediate CA certificates signed directly by QuoVadis Root CA 2: 2 currently valid, 5 expired and 25 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| QuoVadis Global SSL ICA G2 | DigiCert | 2027-05-24 | Valid | E5CD0DD44E1120C79415C84F5369D79AE04F047E80DC0856351AABC232056CA5 |
| DigiCert QuoVadis TLS ICA QuoVadis Root CA 2 | DigiCert | 2031-01-04 | Valid | 673E8FEEB1168277D0153111D20ED38E9DA51F440BE7FD50B218540937741A48 |
| HydrantID SSL ICA G2 | DigiCert | 2023-12-17 | Expired | 01453F645CD91E233B7484827F23F8A573FD641029EA8A6BFE549EF4ED8B323D |
| QuoVadis Global SSL ICA G2 | DigiCert | 2023-06-01 | Expired | F67C23EF7BF7412809DB6B1DD3D44A08D3754D99CABA6A13F7A05C7249089C89 |
| QuoVadis Code Signing CA G1 | DigiCert | 2024-05-30 | Expired | DA0AFAF15CD300E34B520FB78A4FA68EB42C4601E939B903E0B1D71DF5965BFF |
| HydrantID SSL ICA G2 | DigiCert | 2023-12-17 | Expired | 9C6D08933201407FBF2B12540B67CC0E4C9666F132E1504762A717CBAE8F3FD6 |
| QuoVadis Global SSL ICA | DigiCert | 2017-01-12 | Expired | D48006AC4AE56D8467B01EEFB0C7C58F3BC9697B8A1C1CB45F5E3717A02DFC4D |
| HydrantID SSL CA G3 | DigiCert | 2030-09-27 | Revoked | AA57F482CBC516B4D10CA4097DD90D99F5AA727D207090D07DA9C36998ABB9AD |
| QuoVadis Grid ICA G2 | DigiCert | 2026-05-23 | Revoked | 278ECF211E2518E9DD9913AFC583EEB3127C8184BCBEEDAAD7BD64E89E8C4310 |
| VR IDENT EV SSL CA 2020 | DigiCert | 2030-07-20 | Revoked | D33A847F640377BE0AE1A429153A07E87C8827FA4840B5158BCDCB85E10A453A |
| VR IDENT SSL CA 2020 | DigiCert | 2030-07-20 | Revoked | 347D18DCCC2EFC51A920E7A7FBB07BFBDA35613681F82DCA5C4C72BB0C83C035 |
| HydrantID EV SSL CA G2 | DigiCert | 2030-07-19 | Revoked | 60388B773D33E9141648613F36B9149F015A114378BACF3E3694864FFDA426EC |
| QuoVadis EV SSL ICA G1 | DigiCert | 2025-01-13 | Revoked | DA209F83D706CC8D7DF6D763AABC476967909581F038B5FAD63906F76B97AED6 |
| QuoVadis EV SSL ICA G1 | DigiCert | 2025-01-13 | Revoked | 9CE274FFDA0CC48762CB71B12C742049C728E61DFBC0708E3F9C871E9EBDEA22 |
| QuoVadis EV SSL ICA G1 | DigiCert | 2025-01-13 | Revoked | 9C8D374FD0774341D61B5E8DCBB65E5B1061097C16D2735B2499250052F14D7E |
| QuoVadis Europe SSL CA G1 | DigiCert | 2025-06-01 | Revoked | 89994B6D9D9DDFFF687FABD3E7342CDD8522D661F5EFCE8E6ABDEB25A04F1023 |
| HydrantID EV SSL ICA G1 | DigiCert | 2025-01-13 | Revoked | 6B43B4C243AA2D99440C0F14BDEC5231EEC63E86AAF2376CA7002028458DC726 |
| VR IDENT SSL CA 2018 | DigiCert | 2028-09-04 | Revoked | E22160364E56F7C27234F5435D8477B1A5BBBA01103298F3954909180DF02778 |
| VR IDENT EV SSL CA 2018 | DigiCert | 2028-09-04 | Revoked | 8C97A008F7CE21F746EAFB2E3AE06095E557D289A310C82C6F3C02D9F721E5F8 |
| VR IDENT EV SSL CA 2018 | DigiCert | 2028-09-04 | Revoked | BF39A4241F42D522368944B3DC53ED9EAA5AC7735E242E0627C0DD5BBA714484 |

## Cross-signed versions

2 certificate(s) in the CCADB have the same subject and public key as QuoVadis Root CA 2 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not QuoVadis Root CA 2, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| QuoVadis Root Certification Authority | DigiCert | 2017-01-25 | Expired | BDBC65142445F39EB72ABDEE425D93A770E8CD7A4FC7133B2835F99F5849D50B |
| QuoVadis Root Certification Authority | DigiCert | 2017-07-10 | Expired | A1E1B239F6FC6C26E05DA4AE4E363841E7698536E38DB167D24E62147188D690 |

## What happens when it expires

QuoVadis Root CA 2 is valid until 2031-11-24, about 5.0 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is QuoVadis Root CA 2 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does QuoVadis Root CA 2 expire?**

On 2031-11-24, about 5.0 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has QuoVadis Root CA 2 issued?**

The CCADB lists 32: 2 valid, 5 expired and 25 revoked. The newest valid one is QuoVadis Global SSL ICA G2, valid until 2027-05-24.

**Is QuoVadis Root CA 2 cross-signed?**

Yes. The CCADB has 2 cross-certificate(s) with its subject and key, signed by QuoVadis Root Certification Authority; 0 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).