# AffirmTrust Networking root certificate (Entrust)

> AffirmTrust Networking is a root CA certificate operated by Entrust (RSA 2048, valid until 2030-12-31, SHA-256 0A81EC5A). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/entrust-affirmtrust-networking/
Last updated: 2026-11-10

AffirmTrust Networking is a root CA certificate operated by Entrust (RSA 2048, valid until 2030-12-31, SHA-256 0A81EC5A). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Entrust |
| Subject | CN=AffirmTrust Networking,O=AffirmTrust,C=US |
| SHA-256 | 0A81EC5A929777F145904AF38D5D509F66B5E2C58FCDB531058B0E17F3F0B41B |
| SPKI SHA-256 | 94072AD3F58F70F93098E5A5F6C04C96C710BD849D83184919AE90EB890AE400 |
| Valid from | 2010-01-29 |
| Expires | 2030-12-31 |
| Key | RSA 2048 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 7C4F04391CD4992D |
| SHA-1 (Windows thumbprint) | 293621028B20ED02F566C532D1D6ED909F45002F |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Removed | No | - | - |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth; Allowed policies: Server Authentication, Client Authentication, Code Signing, Timestamp Signing |
| Microsoft | Included (NotBefore cutoff) | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping |

The CCADB lists EV policy OID 2.23.140.1.1, 1.3.6.1.4.1.34697.2.2 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 7 intermediate CA certificates signed directly by AffirmTrust Networking: 0 currently valid, 0 expired and 7 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| AffirmTrust Extended Validation CA - EV3 | Entrust | 2030-12-02 | Revoked | B700BA49AF4D19E72FB15A2DAC3C213BA44C319FA7DA92772B3682E12B781093 |
| AffirmTrust Extended Validation CA - EV3 | Entrust | 2030-12-02 | Revoked | 6B63EC3BECDECF9F9127235C0995F578D66F77B14D1C7F0FDC2DC060F3C78DD6 |
| AffirmTrust Networking Extended Validation CA | Entrust | 2030-12-31 | Revoked | AF639DC0BBB168EFF75B15117D888937EB64C1B0453F168D1B8C52ECF04ACB93 |
| Trend Micro CA | Entrust | 2030-12-31 | Revoked | 938C4557589B7263D59B2F0F6B84CBEB27EFB9B23BA724EB3CCD5B7E2A58716F |
| Trend Micro CA | Entrust | 2030-12-31 | Revoked | 3F0AE5B3D05652472A108C28546364B31B5A33D01528B555FEAB21AFAEBB5B3A |
| Trend Micro CA | Entrust | 2030-12-31 | Revoked | 58C95D17907E743E121CEF47D48064D7B3AF32B514BEA3EF74D290A52D70B96C |
| AffirmTrust Networking Extended Validation CA | Entrust | 2030-12-31 | Revoked | DD0C0BE9CE09041F16B72D6B3D62A5B8F538427EC1A42D8331AF1B59DFE69446 |

## Cross-signed versions

2 certificate(s) in the CCADB have the same subject and public key as AffirmTrust Networking but a different issuer. A server can send one of them so that clients which trust the issuing root, but not AffirmTrust Networking, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| SwissSign Silver CA - G2 | SwissSign AG | 2019-11-02 | Revoked | 3156CB7FE72C051B5AFB2C17F5AEA75AF810D04A0757293974925ECE5356DFC4 |
| SwissSign Gold CA - G2 | SwissSign AG | 2019-11-02 | Revoked | F2D15E3A4872DFE9AE9114DC19B1B436614BE08486A61069E6787E81D86A12C4 |

## What happens when it expires

AffirmTrust Networking is valid until 2030-12-31, about 4.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is AffirmTrust Networking trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does AffirmTrust Networking expire?**

On 2030-12-31, about 4.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has AffirmTrust Networking issued?**

The CCADB lists 7: 0 valid, 0 expired and 7 revoked.

**Is AffirmTrust Networking cross-signed?**

Yes. The CCADB has 2 cross-certificate(s) with its subject and key, signed by SwissSign Silver CA - G2, SwissSign Gold CA - G2; 0 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).