# DigiCert Trusted Root G4 root certificate (DigiCert)

> DigiCert Trusted Root G4 is a root CA certificate operated by DigiCert (RSA 4096, valid until 2038-01-15, SHA-256 552F7BDC). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Apple, Microsoft.

Source: https://ssl.sh/roots/digicert-trusted-root-g4/
Last updated: 2026-11-10

DigiCert Trusted Root G4 is a root CA certificate operated by DigiCert (RSA 4096, valid until 2038-01-15, SHA-256 552F7BDC). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | DigiCert |
| Subject | CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US |
| SHA-256 | 552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988 |
| SPKI SHA-256 | 59DF317BFA9F4F0AB7CA514D7772296AA2C765B87664D08B96E57399E364729C |
| Valid from | 2013-08-01 |
| Expires | 2038-01-15 |
| Key | RSA 4096 |
| Signature algorithm | sha384WithRSAEncryption |
| Serial number | 59B1B579E8E2132E23907BDA777755C |
| SHA-1 (Windows thumbprint) | DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2026-09-14 | - |
| Mozilla | Included | No | - | Trust bits: Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.16.3 / Firefox 32; Inclusion bug: #908827 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email, Time Stamping |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2026-09-14 (sct_not_after). The CCADB lists EV policy OID 2.23.140.1.1, 2.16.840.1.114412.2.1, 2.23.140.1.3 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 32 intermediate CA certificates signed directly by DigiCert Trusted Root G4: 32 currently valid, 0 expired and 0 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| DigiCert Trusted G4 Multi Doc Signing RSA4096 SHA384 2026 CA1 | DigiCert | 2036-08-18 | Valid | F5A6D948C97A39FF1DD2D5BECC3E9E80C1A9E9FC9689C566C8C6C97FC45AC239 |
| DigiCert Trusted G4 TLS RSA4096 SHA384 2025 CA1 | DigiCert | 2035-10-14 | Valid | D1796BB8579505BE91AD24D97D98A39DE486D5BB5040583F40FDB4A61A14F092 |
| DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1 | DigiCert | 2038-01-14 | Valid | CA0B1554ECD901EA19DCAD8749E9F2648C8D6DFCEA1ADD9D2C2109415BB82CCD |
| DigiCert Trusted G4 TLS RSA4096 SHA256 2025 CA1 | DigiCert | 2035-04-28 | Valid | 01573D7ABE1FE69D73DF11E2469A0849FE75EF4F33D95DD0512AB1DC2C70C0F6 |
| Apple Public Client RSA CA 3 - G1 | Apple Inc. | 2029-08-13 | Valid | F74553757F2C6397D154296A86230C17B25DA8C7C426CD198A5107AD49047C30 |
| Verokey Secure Web G3 | DigiCert | 2034-07-23 | Valid | CB01BEAC6315F30EB675B19CA08DC249E73867B0DAFAB5A5C30631A2372B2E65 |
| Henkel Secure E-mail CA G3 | DigiCert | 2034-05-22 | Valid | CA365E4C288118297CDC78B4DC01734E2B7A3CAB2CDFED6A2DB7788D3AA39A7C |
| Uniper SMIME CA G2 | DigiCert | 2034-05-14 | Valid | 5828E5B8E043088CC15F16753F90D143212A875D1662757A7858D510228F0F3F |
| Uniper SE SMIME CA | DigiCert | 2033-06-28 | Valid | 43067D5EF78F7276DF9B23855BF54E8DDB7DEF0D8B79A365573D05627F0A6638 |
| Henkel Secure E-mail CA G2 | DigiCert | 2033-05-09 | Valid | 0872E14A4E2B7B1BA0DE0B785493E0F4B25E2E584A3F3462F0A1901CB7BBE5F0 |
| DigiCert Trusted G4 Code Signing Europe RSA4096 SHA256 2023 CA1 | DigiCert | 2033-02-13 | Valid | E2612327EAF98AF9423EFEA184368E19BF9798D7DCEE0C5CF8E792C8893ED9F0 |
| DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1 | DigiCert | 2033-02-13 | Valid | 086528D3B9FDB2577D82790E48A003DE74D74E4D8CBC44765F6F924A9D3FFB82 |
| DigiCert Trusted G4 AATL RSA4096 SHA384 2022 CA1 | DigiCert | 2032-07-20 | Valid | D149AF9F74029C8DBD957022BE03707F110DB1E1D0E55DDA11376A8F766D367E |
| GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1 | DigiCert | 2032-06-22 | Valid | D5B54EBE9373F451FF0AE7CD6BC6A1FB2BD03EE9C54AB4CA019ACFC14B6E50D6 |
| DigiCert CS RSA4096 Root G5 | DigiCert | 2037-05-18 | Valid | 63A9756FF8A0DB5CBF94C97CD894DBAEED4BB1BD2ECFB890A9E55336FECDF060 |
| DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA | DigiCert | 2037-03-22 | Valid | 281734D4592D1291D27190709CB510B07E22C405D5E0D6119B70E73589F98ACF |
| Verokey High Assurance Secure Code EV | DigiCert | 2037-03-16 | Valid | E03E9D15D653BCA7181522B98CBA4311E509FB81BF4FA646DDFA569B001C8E63 |
| Verokey High Assurance Verified Business G2 | DigiCert | 2032-03-16 | Valid | BE89264A58313012B749603C9BEBC3CD7914DB716A49E5E0EA97E43A3883A5DF |
| Verokey Secure Code | DigiCert | 2037-03-16 | Valid | 3877D964C1983E41940D849D3ABB5EF0C8CA07D430B0DA779067E29FB700797E |
| RVBD ENG Certificate Issuer - G2 | DigiCert | 2036-12-06 | Valid | AB422C705556BB41DB8663FFBF288B91E16B06EBCEBF5BAD1095B4FACB38FE39 |

## Cross-signed versions

5 certificate(s) in the CCADB have the same subject and public key as DigiCert Trusted Root G4 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not DigiCert Trusted Root G4, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| VeriSign Class 3 Public Primary Certification Authority - G5 | DigiCert | 2031-09-21 | Valid | 41D976CE7EB221138ADC0D6CC97125D02F6ADA39A84DCD4D4DEE4811FB32E57D |
| DigiCert High Assurance EV Root CA | DigiCert | 2031-11-09 | Valid | E9158C6AF5688CFCF9890206C43061C81FA7FC07D08E28A27C068C58073A699A |
| DigiCert Assured ID Root CA | DigiCert | 2031-11-09 | Valid | 4C913D04FB495DC36119552D6068F7B9891EFE40344E9E5C1E9132F65BAEFF7F |
| DigiCert Assured ID Root CA | DigiCert | 2031-11-09 | Valid | 33846B545A49C9BE4903C60E01713C1BD4E4EF31EA65CD95D69E62794F30B941 |
| DigiCert Global Root CA | DigiCert | 2023-10-22 | Expired | AD8EB32C9DA91DDC855F382745990147DC6F23D9FBB04FC9D476B1EE20FC71D8 |

## What happens when it expires

DigiCert Trusted Root G4 is valid until 2038-01-15, about 11.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2026-09-14.

## FAQ

**Is DigiCert Trusted Root G4 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Chrome, Apple, Microsoft trust it for TLS server authentication; Mozilla do not. Distrust-after dates already set: Chrome 2026-09-14.

**When does DigiCert Trusted Root G4 expire?**

On 2038-01-15, about 11.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has DigiCert Trusted Root G4 issued?**

The CCADB lists 32: 32 valid, 0 expired and 0 revoked. The newest valid one is DigiCert Trusted G4 Multi Doc Signing RSA4096 SHA384 2026 CA1, valid until 2036-08-18.

**Is DigiCert Trusted Root G4 cross-signed?**

Yes. The CCADB has 5 cross-certificate(s) with its subject and key, signed by VeriSign Class 3 Public Primary Certification Authority - G5, DigiCert High Assurance EV Root CA, DigiCert Assured ID Root CA, DigiCert Global Root CA; 4 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).