# QuoVadis Root CA 3 G3 root certificate (DigiCert)

> QuoVadis Root CA 3 G3 is a root CA certificate operated by DigiCert (RSA 4096, valid until 2042-01-12, SHA-256 88EF81DE). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Apple, Microsoft.

Source: https://ssl.sh/roots/digicert-quovadis-root-ca-3-g3/
Last updated: 2026-11-10

QuoVadis Root CA 3 G3 is a root CA certificate operated by DigiCert (RSA 4096, valid until 2042-01-12, SHA-256 88EF81DE). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | DigiCert |
| Subject | CN=QuoVadis Root CA 3 G3,O=QuoVadis Limited,C=BM |
| SHA-256 | 88EF81DE202EB018452E43F864725CEA5FBD1FC2D9D205730709C5D8B8690F46 |
| SPKI SHA-256 | F3438E23B3CE532522FACF307923F58FD18608E9BA7ADDC30E952B43C49616C3 |
| Valid from | 2012-01-12 |
| Expires | 2042-01-12 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 2EF59B0228A7DB7AFFD5A3A9EEBD03A0CF126A1D |
| SHA-1 (Windows thumbprint) | 4812BD923CA8C43906E7306D2796E6A4CF222E7D |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2027-09-14 | - |
| Mozilla | Included | No | - | Trust bits: Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.16.3 / Firefox 32; Inclusion bug: #926541 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, OCSP Signing, Secure Email, Time Stamping; Not-before cutoff: 2021-08-01 (Code Signing, OCSP Signing) |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2027-09-14 (sct_not_after). The CCADB lists no EV policy OID for QuoVadis Root CA 3 G3.

## Intermediate CAs issued by this root

The CCADB lists 11 intermediate CA certificates signed directly by QuoVadis Root CA 3 G3: 1 currently valid, 0 expired and 10 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| DigiCert QuoVadis TLS ICA QV Root CA 3 G3 | DigiCert | 2031-01-04 | Valid | 728E4BD2B399840E9D437AF975B0198910B4129B7AB708CB5C0B445D3B04D999 |
| QuoVadis RCA3G3 TLS CA | DigiCert | 2030-10-19 | Revoked | ECC0D17AC3263AC6A164DCDB08F82D07E93FCEA723F66B88B06EEBA9678DF2BB |
| QuoVadis Enterprise Trust CA 3 G4 | DigiCert | 2035-07-20 | Revoked | 31EFF7DF4DDEB71CBDFB08B5C7FC9604A93600251E8917D6960C32BF4C0B5A77 |
| HydrantID Client ICA G2 | DigiCert | 2029-10-04 | Revoked | 5286AE1C558A81537CD9870F749D96EFABC2D2BA393DF818DFE95EA7CE6450A7 |
| Allscripts Public Issuing CA 1 | DigiCert | 2028-06-02 | Revoked | 5BD0C0D579801567F3388FE644EF790AB31E2DB2246EAF4C881E5A57D9A0A582 |
| Allscripts Public Issuing CA 1 | DigiCert | 2028-05-07 | Revoked | 2A8DBEBD3AFDB972BC1F77CFE7BE8506888CFED35EDFC54CBAA638E3A5AB3EFF |
| DarkMatter Assured CA | DarkMatter | 2025-04-19 | Revoked | D8888F4A84F74C974DFFB573A1BF5BBBACD1713B905096F8EB015062BF396C4D |
| QuoVadis QVRCA3G3 SSL ICA | DigiCert | 2027-04-19 | Revoked | 764A0D84D5552CD5872C73464F37F02175CDA70588102B13ADA2A0199FC403E9 |
| QuoVadis Enterprise Trust CA 3 G3 | DigiCert | 2031-06-06 | Revoked | DA5462526A0C2E9852A86186B025390158759CDCA6AE21F09F713CA6ACCDD1F1 |
| DarkMatter Assured CA | DigiCert | 2024-04-29 | Revoked | 60F066DC78A4E2E929A1C8ED102EDB707DF03181F82FDF50D53A52DAC355C65B |
| QuoVadis Issuing CA 3 G3 | DigiCert | 2022-11-06 | Revoked | C12DD0347C0D4AA25D3986E0499740C5363A6B7EC32A49C5D18B9D56B075E368 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as QuoVadis Root CA 3 G3 with a different issuer, so a client has to carry QuoVadis Root CA 3 G3 itself in its root store to trust it.


## What happens when it expires

QuoVadis Root CA 3 G3 is valid until 2042-01-12, about 15.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2027-09-14.

## FAQ

**Is QuoVadis Root CA 3 G3 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Chrome, Apple, Microsoft trust it for TLS server authentication; Mozilla do not. Distrust-after dates already set: Chrome 2027-09-14.

**When does QuoVadis Root CA 3 G3 expire?**

On 2042-01-12, about 15.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has QuoVadis Root CA 3 G3 issued?**

The CCADB lists 11: 1 valid, 0 expired and 10 revoked. The newest valid one is DigiCert QuoVadis TLS ICA QV Root CA 3 G3, valid until 2031-01-04.

**Is QuoVadis Root CA 3 G3 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).