# CA Disig TLS Root R3 root certificate (Disig, a.s.)

> CA Disig TLS Root R3 is a root CA certificate operated by Disig, a.s. (RSA 4096, valid until 2040-09-14, SHA-256 6248199F). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

Source: https://ssl.sh/roots/disig-ca-disig-tls-root-r3/
Last updated: 2026-11-10

CA Disig TLS Root R3 is a root CA certificate operated by Disig, a.s. (RSA 4096, valid until 2040-09-14, SHA-256 6248199F). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

| Field | Value |
|---|---|
| CA owner | Disig, a.s. |
| Subject | CN=CA Disig TLS Root R3,O=Disig a.s.,L=Bratislava,C=SK |
| SHA-256 | 6248199FEA4811FD34AA96EF0A26DE52134B73A9A2A99678F0C2EBADF8663EF8 |
| SPKI SHA-256 | 6C40941018EEC3846B13FAFE074704894EDF95A64C393150FD2F703F4C43D3FD |
| Valid from | 2025-09-18 |
| Expires | 2040-09-14 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 5B99ABC2B008CF8441D62E523909B41B |
| SHA-1 (Windows thumbprint) | AF250F267724C554652607D70985DE93DD33AFC0 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Not included | No | - | - |
| Mozilla | Not included | No | - | - |
| Apple | Not included | No | - | - |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication |

The CCADB lists no EV policy OID for CA Disig TLS Root R3.

## Intermediate CAs issued by this root

The CCADB lists 1 intermediate CA certificates signed directly by CA Disig TLS Root R3: 1 currently valid, 0 expired and 0 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| CA Disig R3I1 TLS Certification Service | Disig, a.s. | 2029-04-12 | Valid | 285C50885D41DF6BB1632B78E979750D89F5DBB995D8EA3496CEF40A446397E7 |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as CA Disig TLS Root R3 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not CA Disig TLS Root R3, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| CA Disig Root R2 | Disig, a.s. | 2029-04-12 | Valid | 1E4CF8FA6ADA4DB81C33BB8E4BF73B8D29E99C119FF0B7A42D58032366F56509 |

## What happens when it expires

CA Disig TLS Root R3 is valid until 2040-09-14, about 13.8 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is CA Disig TLS Root R3 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Microsoft trust it for TLS server authentication; Chrome, Mozilla, Apple do not.

**When does CA Disig TLS Root R3 expire?**

On 2040-09-14, about 13.8 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has CA Disig TLS Root R3 issued?**

The CCADB lists 1: 1 valid, 0 expired and 0 revoked. The newest valid one is CA Disig R3I1 TLS Certification Service, valid until 2029-04-12.

**Is CA Disig TLS Root R3 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by CA Disig Root R2; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).