# AffirmTrust Commercial root certificate (Entrust)

> AffirmTrust Commercial is a root CA certificate operated by Entrust (RSA 2048, valid until 2030-12-31, SHA-256 0376AB1D). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/entrust-affirmtrust-commercial/
Last updated: 2026-11-10

AffirmTrust Commercial is a root CA certificate operated by Entrust (RSA 2048, valid until 2030-12-31, SHA-256 0376AB1D). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Entrust |
| Subject | CN=AffirmTrust Commercial,O=AffirmTrust,C=US |
| SHA-256 | 0376AB1D54C5F9803CE4B2E201A0EE7EEF7B57B636E8A93C9B8D4860C96F5FA7 |
| SPKI SHA-256 | 6C464B9A5B233A5E874DA765C26F045010D2DDCFF45794F0B4C7E4AAFA501495 |
| Valid from | 2010-01-29 |
| Expires | 2030-12-31 |
| Key | RSA 2048 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 7777062726A9B17C |
| SHA-1 (Windows thumbprint) | F9B5B632455F9CBEEC575F80DCE96E2CC7B278B7 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Removed | No | - | - |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth; Allowed policies: Server Authentication, Client Authentication, Code Signing, Timestamp Signing |
| Microsoft | Included (NotBefore cutoff) | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping |

The CCADB lists EV policy OID 2.23.140.1.1, 1.3.6.1.4.1.34697.2.1 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 10 intermediate CA certificates signed directly by AffirmTrust Commercial: 0 currently valid, 0 expired and 10 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| AffirmTrust Extended Validation CA - EV1 | Entrust | 2030-12-02 | Revoked | ED3C991466CBC45B5FD1DA281028F9587B8219523647E0CA1B47F2C527D2920F |
| AffirmTrust Certificate Authority - OV1 | Entrust | 2030-12-02 | Revoked | B5FD6F800334F565036B0999F8310B5B0BD7268395D8B267005697AF7301C5E8 |
| AffirmTrust Certificate Authority - DV1 | Entrust | 2030-12-02 | Revoked | 4563B936E35AB97576F5AEF1935D9BC7E9977841F0573BD2E16BCAC9534A6AF9 |
| AffirmTrust Certificate Authority - DV1 | Entrust | 2030-12-02 | Revoked | CA4389C89DDFC31BEC26C74B44A8498C58B2D838516FA01B14F1393629E58A40 |
| AffirmTrust Certificate Authority - DV1 | Entrust | 2030-12-02 | Revoked | ED8BE0E7F03BB876B42E4AAF437BF03A759885F9CC5BAE36DED8A8BD8E14E47F |
| AffirmTrust Certificate Authority - OV1 | Entrust | 2030-12-02 | Revoked | EA4EE2FAA57AE4B539B63977FE5BB205B6AFB32F7A73B2B363E4BE02CD8A91E9 |
| AffirmTrust Extended Validation CA - EV1 | Entrust | 2030-12-02 | Revoked | CF88915CF996932C2B4CBE3039076D119BB728B4F31E49B63A5022FE65489A12 |
| Trend Micro S2 CA | Entrust | 2030-12-31 | Revoked | 8CD591F3314BD57BAC74B3FAEE2D70471B5D996A4FE197E64380ABAF9E8B3133 |
| AffirmTrust Commercial Extended Validation CA | Entrust | 2030-12-31 | Revoked | 241136327DC0AEC84973D1FA9B2D0DC027797037AE3ED654564E3B85FC7DB221 |
| AffirmTrust Commercial Extended Validation CA | Entrust | 2030-12-31 | Revoked | 62F692B7447953D4205AB31B4E34D45A02A12CA45654AF8270FECD89E2DB3E47 |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as AffirmTrust Commercial but a different issuer. A server can send one of them so that clients which trust the issuing root, but not AffirmTrust Commercial, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| SwissSign Gold CA - G2 | SwissSign AG | 2019-11-02 | Revoked | B102959F862B71B78EFDC7FA9F43B3AFD7E52312A07493A752835B991D840F4C |

## What happens when it expires

AffirmTrust Commercial is valid until 2030-12-31, about 4.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is AffirmTrust Commercial trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does AffirmTrust Commercial expire?**

On 2030-12-31, about 4.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has AffirmTrust Commercial issued?**

The CCADB lists 10: 0 valid, 0 expired and 10 revoked.

**Is AffirmTrust Commercial cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by SwissSign Gold CA - G2; 0 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).