# QuoVadis Root CA 3 root certificate (DigiCert)

> QuoVadis Root CA 3 is a root CA certificate operated by DigiCert (RSA 4096, valid until 2031-11-24, SHA-256 18F1FC7F). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/digicert-quovadis-root-ca-3/
Last updated: 2026-11-10

QuoVadis Root CA 3 is a root CA certificate operated by DigiCert (RSA 4096, valid until 2031-11-24, SHA-256 18F1FC7F). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | DigiCert |
| Subject | CN=QuoVadis Root CA 3,O=QuoVadis Limited,C=BM |
| SHA-256 | 18F1FC7F205DF8ADDDEB7FE007DD57E3AF375A9C4D8D73546BF4F1FED1E18D35 |
| SPKI SHA-256 | 0C7ACAA710226720BBC940349EE2E6148652A89DBF406A232C895F6DC78EBB9A |
| Valid from | 2006-11-24 |
| Expires | 2031-11-24 |
| Key | RSA 4096 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 5C6 |
| SHA-1 (Windows thumbprint) | 1F4914F7D874951DDDAE02C0BEFD3A2D82755185 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | No | - | Trust bits: Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.11.8 / Firefox 2; Inclusion bug: #365281 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, OCSP Signing, Secure Email, Time Stamping; Not-before cutoff: 2021-08-01 (Code Signing, OCSP Signing) |

The CCADB lists no EV policy OID for QuoVadis Root CA 3.

## Intermediate CAs issued by this root

The CCADB lists 35 intermediate CA certificates signed directly by QuoVadis Root CA 3: 2 currently valid, 1 expired and 32 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| BEKB - BCBE Issuing CA G2 | DigiCert | 2031-11-24 | Valid | 474D298059F15BC5319B4A94D38AAFADBF627CC09513FCD9362CD89C2F9B6221 |
| DigiCert QuoVadis TLS ICA QV Root CA 3 | DigiCert | 2031-01-04 | Valid | D8CC89C6AA6B7452881907927C81E66DA01A7598CF7674E4E2E133F16546D5F0 |
| BEKB - BCBE Issuing CA G2 | DigiCert | 2023-10-10 | Expired | B399EFE42C01A05BDC38978447A78E950467793FB11C1B6B426C419A0FC73911 |
| QuoVadis RCA3G1 TLS CA | DigiCert | 2030-10-19 | Revoked | B8D9BAF805CEBC66C7D6ED2AEC9675D5C9387BA4931563C01DDCBEB1E5646E26 |
| QuoVadis RCA3G1 TLS CA | DigiCert | 2030-10-19 | Revoked | 3A66E648212E6321F94D9EABCC92C052E679D992C99AD4596A4E7B85ADCEE5DE |
| QuoVadis QVRCA3G1 SSL ICA | DigiCert | 2027-04-19 | Revoked | 8D99217FF82D60E4DF59BE8A1121625CDFFC4F22F21E1263A1DF06D2DC0B540E |
| Bayerische SSL-CA-2016-02 | DigiCert | 2026-12-02 | Revoked | FF1DD21F1A5D0B452CD969CF4AA553835CABE0293C6C7B009F145AA202C02C8B |
| Bayerische SSL-CA-2016-02 | DigiCert | 2026-12-02 | Revoked | 806A2AA77EDBD3C76D8FD066DFB5CC3310F359B0102CE92C0FAEC16AA43FFF0A |
| Bayerische SSL-CA-2016-02 | DigiCert | 2026-12-02 | Revoked | 33CD537E009DB9C758A568435C06706F9F01138054E20B9DDC93E0397138AA6B |
| FMH CA G2 | DigiCert | 2026-11-30 | Revoked | B968FBFC3ECA285AADC38D2367727241FF7D3733F1278F8A4F50ECC8C0EF1E80 |
| Bayerische SSL-CA-2016-01 | DigiCert | 2026-06-06 | Revoked | E8CA72ECB9885C24EA29DE0EAC97704278D2A1E59B66666D327FB0CC6BDD912F |
| Bayerische SSL-CA-2016-01 | DigiCert | 2026-06-06 | Revoked | D852DE5D098086DFE9A6F3D728D5261865587C489DE675753D272374A5D6E9FC |
| Bayerische SSL-CA-2016-01 | DigiCert | 2026-06-06 | Revoked | 4874758D6563E0433B1EDCEE7CCC5D9C2AAD8EBA12BCB0704454BB4EF8EAF799 |
| Bayerische SSL-CA-2015-02 | DigiCert | 2025-11-09 | Revoked | 8E6930D78A139F3827146A5946EF9FE3A77399B2FD0CEBB0B2ED08EE18A1D758 |
| Suva Root CA 1 | DigiCert | 2025-08-28 | Revoked | C1E45348D714CB47DBB2C0B9BAF9BA1F27E420047CDA7A8B6935643004CAAB97 |
| FMH CA G1 | DigiCert | 2025-06-25 | Revoked | A0AF1418CD14F6B2415EC6316C7D588BB25D430A3D6D026F57DE20F965EABDDC |
| Bayerische SSL-CA-2015-01 | DigiCert | 2025-05-12 | Revoked | 43DB658DD4E4020F8B5C6BD7107E15E233459A226CD0D77EF8F72B2B1CC29AFE |
| Intec Client ICA | DigiCert | 2024-12-29 | Revoked | B40D68389FD041C56E293FA3D57D7DB792DD00B62EBDFF190B0E2644072C934A |
| Bayerische SSL-CA-2014-02 | DigiCert | 2024-11-17 | Revoked | F878B3DF213B0817BFF1E5EF4E8CD7C9B57C80FFC9F8A7309EA46AAF540BAE18 |
| Suva Root CA 1 | DigiCert | 2024-11-12 | Revoked | 8C01721F6FA9D21DFC28366F52434EA8B44BF8843F1C433B965BF6593344EB36 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as QuoVadis Root CA 3 with a different issuer, so a client has to carry QuoVadis Root CA 3 itself in its root store to trust it.


## What happens when it expires

QuoVadis Root CA 3 is valid until 2031-11-24, about 5.0 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is QuoVadis Root CA 3 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does QuoVadis Root CA 3 expire?**

On 2031-11-24, about 5.0 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has QuoVadis Root CA 3 issued?**

The CCADB lists 35: 2 valid, 1 expired and 32 revoked. The newest valid one is BEKB - BCBE Issuing CA G2, valid until 2031-11-24.

**Is QuoVadis Root CA 3 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).