# AffirmTrust Premium ECC root certificate (Entrust)

> AffirmTrust Premium ECC is a root CA certificate operated by Entrust (ECDSA P-384, valid until 2040-12-31, SHA-256 BD71FDF6). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/entrust-affirmtrust-premium-ecc/
Last updated: 2026-11-10

AffirmTrust Premium ECC is a root CA certificate operated by Entrust (ECDSA P-384, valid until 2040-12-31, SHA-256 BD71FDF6). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Entrust |
| Subject | CN=AffirmTrust Premium ECC,O=AffirmTrust,C=US |
| SHA-256 | BD71FDF6DA97E4CF62D1647ADD2581B07D79ADF8397EB4ECBA9C5E8488821423 |
| SPKI SHA-256 | 3219B09114FF495A3EB6EB00C2EFEAB34002AE5F0A56C7679EA087A3FA037E4F |
| Valid from | 2010-01-29 |
| Expires | 2040-12-31 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | 7497258AC73F7A54 |
| SHA-1 (Windows thumbprint) | B8236B002F1D16865301556C11A437CAEBFFC3BB |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Removed | No | - | - |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth; Allowed policies: Server Authentication, Client Authentication, Code Signing, Timestamp Signing |
| Microsoft | Included (NotBefore cutoff) | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping |

The CCADB lists EV policy OID 2.23.140.1.1, 1.3.6.1.4.1.34697.2.4 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 4 intermediate CA certificates signed directly by AffirmTrust Premium ECC: 0 currently valid, 0 expired and 4 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| AffirmTrust Extended Validation CA - EVEC1 | Entrust | 2030-12-02 | Revoked | CDE23A52303C3CA67A4BBBCC9582FF5C9203AA98CB0F387139308CE2289506A2 |
| AffirmTrust Extended Validation CA - EVEC1 | Entrust | 2030-12-02 | Revoked | 59518FC1EF1C337EF34F601E30E623DF4D07D3A7B6E402BCA2BE6E027385C7B8 |
| AffirmTrust Premium ECC Extended Validation CA | Entrust | 2040-12-31 | Revoked | 077B75F6B7FA71BE4F8121E1EC52FAEBCA0D0AED2DC01711A0F6DCDC38E7BF38 |
| AffirmTrust Premium ECC Extended Validation CA | Entrust | 2040-12-31 | Revoked | 5ADCC54514916B02DBF5E065952E9C130BEC59421E0FEA1CE9647F02050B7EC6 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as AffirmTrust Premium ECC with a different issuer, so a client has to carry AffirmTrust Premium ECC itself in its root store to trust it.


## What happens when it expires

AffirmTrust Premium ECC is valid until 2040-12-31, about 14.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is AffirmTrust Premium ECC trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does AffirmTrust Premium ECC expire?**

On 2040-12-31, about 14.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has AffirmTrust Premium ECC issued?**

The CCADB lists 4: 0 valid, 0 expired and 4 revoked.

**Is AffirmTrust Premium ECC cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).