# DigiCert TLS RSA4096 Root G5 root certificate (DigiCert)

> DigiCert TLS RSA4096 Root G5 is a root CA certificate operated by DigiCert (RSA 4096, valid until 2046-01-14, SHA-256 371A00DC). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/digicert-tls-rsa4096-root-g5/
Last updated: 2026-11-10

DigiCert TLS RSA4096 Root G5 is a root CA certificate operated by DigiCert (RSA 4096, valid until 2046-01-14, SHA-256 371A00DC). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | DigiCert |
| Subject | CN=DigiCert TLS RSA4096 Root G5,O=DigiCert\, Inc.,C=US |
| SHA-256 | 371A00DC0533B3721A7EEB40E8419E70799D2B0A0F2C1D80693165F7CEC4AD75 |
| SPKI SHA-256 | 6A97B51C8219E93E5DEC64BAD5806CDEB0F8355BE47E757010B702456E01AAFD |
| Valid from | 2021-01-15 |
| Expires | 2046-01-14 |
| Key | RSA 4096 |
| Signature algorithm | sha384WithRSAEncryption |
| Serial number | 8F9B478A8FA7EDA6A333789DE7CCF8A |
| SHA-1 (Windows thumbprint) | A78849DC5D7C758C8CDE399856B3AAD0B2A57135 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: NSS 3.80 / Firefox 103; Inclusion bug: #1706228 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication |

Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 21 intermediate CA certificates signed directly by DigiCert TLS RSA4096 Root G5: 20 currently valid, 0 expired and 1 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| CrowdStrike TLS RSA CA G5 | DigiCert | 2034-04-30 | Valid | E5BFCED9D216EBA7DA3634819FB534FB9CEBA1ECF9E6379ED83583D2EB177C1B |
| Tesla China Public RSA TLS Issuing CA 2024 | DigiCert | 2034-03-12 | Valid | 7754CAB7C25AD2605A681E3A04187C1E3B3A46F188A8247DC86E02A0FC336F91 |
| Tesla Public RSA TLS Issuing CA 2024 | DigiCert | 2034-03-12 | Valid | 32952030B947D80858A87425788518BDF6D94A631D55E20117585C89EBB29197 |
| DigiCert Basic OV G5 TLS CN RSA4096 SHA384 2022 CA1 | DigiCert | 2033-01-11 | Valid | AFED062E87DF98182AD9BEF7EB13C0E2F2B6698AB4E3F33932A10E286E024E9D |
| DigiCert Secure Site Pro G5 TLS CN RSA4096 SHA384 2022 CA1 | DigiCert | 2033-01-11 | Valid | AAA627EEDAC466DBC4C7750C87D999588AB4B03E74B9BFDCDA2902DD36DAE0F8 |
| DigiCert Basic EV G5 TLS CN RSA4096 SHA384 2022 CA1 | DigiCert | 2033-01-11 | Valid | 7BAD1EBDE38C5226B5CE118E386775FAFBC4C8A545598D965CD01E97491DEF8F |
| DigiCert Secure Site Pro EV G5 TLS CN RSA4096 SHA384 2022 CA1 | DigiCert | 2033-01-11 | Valid | 7A3839D4B8790B197440C94DA687DCEB1A5AC07D936F81ACF40B163364B0A951 |
| DigiCert Secure Site EV G5 TLS CN RSA4096 SHA384 2022 CA1 | DigiCert | 2033-01-11 | Valid | 65248FA866C854908D0DB045F88CDABC9452553B982AECE6B0D845866B426B7F |
| DigiCert Secure Site OV G5 TLS CN RSA4096 SHA384 2022 CA1 | DigiCert | 2033-01-11 | Valid | 5534127F056498B4CF1C967365B1DC2D44F33109ABCFA6454F25BEE4F2B65481 |
| GeoTrust EV G5 TLS CN RSA4096 SHA384 2022 CA1 | DigiCert | 2033-01-11 | Valid | 25026FEBE5324EEACA89376B13EDB96991594112C311120D579364E3CC0442F4 |
| Encryption Everywhere G5 TLS RSA4096 SHA384 2022 CA1 | DigiCert | 2032-11-02 | Valid | 654BF73B2639091FA18F296755B704959F52F67FDF7A65AAF1C315441201A09D |
| DigiCert G5 TLS EU RSA4096 SHA384 2022 CA1 | DigiCert | 2032-09-14 | Valid | 4D27EF6357BC929783575C0C8C9340B67FBEFC045FDC263B8C88362E6D3ADB6F |
| DigiCert G5 TLS CN RSA4096 SHA384 2022 CA1 | DigiCert | 2032-07-11 | Valid | AB7EF705B0B8DB2291C2BC8DC9F69AD8345A3CC543DB8CDC49A8B419282DEA22 |
| GeoTrust G5 TLS CN RSA4096 SHA384 2022 CA1 | DigiCert | 2032-07-11 | Valid | 2B6D199F7E35C8C67E0BBA829F92991CF31466265E11FA30BD19FC5B6C36151C |
| Thawte G5 TLS CN RSA4096 SHA384 2022 CA1 | DigiCert | 2032-07-11 | Valid | 1E89E3D2702D3F1735DCE7DA99561600534A06454A94874D0780D0443CAF4151 |
| RapidSSL G5 TLS RSA4096 SHA384 2022 CA1 | DigiCert | 2032-06-01 | Valid | BB320985266F61C5D182724F15CEC428A698ED71262B4E097CB11AED8A41AAE6 |
| Thawte G5 TLS RSA4096 SHA384 2022 CA1 | DigiCert | 2032-05-25 | Valid | 48569C4FABFF4E3AA22E0E19613E90DA89AA2EE2469B0718695437F5384EDC4C |
| GeoTrust G5 TLS RSA4096 SHA384 2022 CA1 | DigiCert | 2032-05-25 | Valid | 0030C68C53FC05237FCC7AB6017D81FEBBA06315526C57F7E72907C87B982B61 |
| DigiCert G5 TLS RSA4096 SHA384 2021 CA1 | DigiCert | 2031-04-13 | Valid | C6270A150691FBE190D831F5139BDFEECF7B298B4FA0CA17306A69D7E91E7BA2 |
| DigiCert G5 TLS RSA4096 SHA384 2021 CA1 | DigiCert | 2031-02-10 | Valid | EF9296036A6D7C986C8D59DB936093E78E85C70AEDB4FE7A54DDCAA821031C72 |

## Cross-signed versions

9 certificate(s) in the CCADB have the same subject and public key as DigiCert TLS RSA4096 Root G5 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not DigiCert TLS RSA4096 Root G5, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| DigiCert Global Root CA | DigiCert | 2031-11-09 | Valid | A4BCDA32D49CDF05F0CDD085E73C3A2E67880BD48579FED4DF5940DF76A076D7 |
| DigiCert High Assurance EV Root CA | DigiCert | 2031-11-09 | Valid | B9D53F235C5FA8C92EB31DCFCADF4959B34A32AF36ACA1EA10F07D6551C398A5 |
| DigiCert Global Root CA | DigiCert | 2031-11-09 | Valid | 1BA02FF4A2562BBE6B799563990C88CC50E1182395719A4EAA803976E2F50860 |
| DigiCert Global Root G2 | DigiCert | 2036-03-30 | Valid | 60C2666DA5E2332170E1D3BFCD95BF8C9A6D4E63473F3A8BBB8CF42B3F9F038A |
| DigiCert Global Root G2 | DigiCert | 2036-03-30 | Valid | 720BD4DA21AF8A76B9EF53FD01EAD227601F9513B3338DE06C997CA688492D34 |
| DigiCert Global Root G2 | DigiCert | 2036-06-09 | Valid | DE99AC42F955D36DED9076462FDEF43A4A8E8FB466AA6C22CC592C863AEF65DE |
| DigiCert Global Root G2 | DigiCert | 2036-06-09 | Valid | A464F08ADF91CF49100C6FDAE5D86601AE2917B56F09DC6C2EC79AC2F40B3651 |
| DigiCert Global Root G2 | DigiCert | 2033-07-11 | Revoked | 048E39BBB6B15EF83525F163192CEA0DF21D3FFABAFAB7C63909FB1553EE4966 |
| DigiCert Global Root G2 | DigiCert | 2033-10-02 | Revoked | 1C8C70B263CB13A9E6EE3F097A9673194CC9D686BC14A72C8CDC705F2C0E68A7 |

## What happens when it expires

DigiCert TLS RSA4096 Root G5 is valid until 2046-01-14, about 19.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is DigiCert TLS RSA4096 Root G5 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does DigiCert TLS RSA4096 Root G5 expire?**

On 2046-01-14, about 19.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has DigiCert TLS RSA4096 Root G5 issued?**

The CCADB lists 21: 20 valid, 0 expired and 1 revoked. The newest valid one is CrowdStrike TLS RSA CA G5, valid until 2034-04-30.

**Is DigiCert TLS RSA4096 Root G5 cross-signed?**

Yes. The CCADB has 9 cross-certificate(s) with its subject and key, signed by DigiCert Global Root CA, DigiCert High Assurance EV Root CA, DigiCert Global Root G2; 7 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).