# AffirmTrust Premium root certificate (Entrust)

> AffirmTrust Premium is a root CA certificate operated by Entrust (RSA 4096, valid until 2040-12-31, SHA-256 70A73F7F). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/entrust-affirmtrust-premium/
Last updated: 2026-11-10

AffirmTrust Premium is a root CA certificate operated by Entrust (RSA 4096, valid until 2040-12-31, SHA-256 70A73F7F). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Entrust |
| Subject | CN=AffirmTrust Premium,O=AffirmTrust,C=US |
| SHA-256 | 70A73F7F376B60074248904534B11482D5BF0E698ECC498DF52577EBF2E93B9A |
| SPKI SHA-256 | C7F43B4CF5B71568294F822B53762605F6DDD15CADECE739E9E2C3CBA61E9D67 |
| Valid from | 2010-01-29 |
| Expires | 2040-12-31 |
| Key | RSA 4096 |
| Signature algorithm | sha384WithRSAEncryption |
| Serial number | 6D8C1446B1A60AEE |
| SHA-1 (Windows thumbprint) | D8A6332CE0036FB185F6634F7D6A066526322827 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Removed | No | - | - |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth; Allowed policies: Server Authentication, Client Authentication, Code Signing, Timestamp Signing |
| Microsoft | Included (NotBefore cutoff) | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping |

The CCADB lists EV policy OID 2.23.140.1.1, 1.3.6.1.4.1.34697.2.3 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 5 intermediate CA certificates signed directly by AffirmTrust Premium: 0 currently valid, 0 expired and 5 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| AffirmTrust 4K TLS Root CA - 2022 | Entrust | 2040-12-30 | Revoked | B0A178E06B7A7274F0B2A640F6A03BF003AB1EDE8693770D5D2741B2D2F01980 |
| AffirmTrust Extended Validation CA - EV2 | Entrust | 2030-12-02 | Revoked | 9DF77488C4B74AC32E3CEC4C643D001D5C3BABFA4001FFD193DCA10C8BE5CB3A |
| AffirmTrust Extended Validation CA - EV2 | Entrust | 2030-12-02 | Revoked | A9EBCFBA0299A10436C4C41A2BD75933CB2C7960CF780267ECBE3D5229C19C76 |
| AffirmTrust Premium Extended Validation CA | Entrust | 2040-12-31 | Revoked | D57B9872B1EEF8E8032AB2E8CB0E63B685D1655C51C454F23F9975DFA2AD7E0A |
| AffirmTrust Premium Extended Validation CA | Entrust | 2040-12-31 | Revoked | 66566FEDD60DB3AE10910F2A89707CF5159092033A71A75CD86851D735919411 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as AffirmTrust Premium with a different issuer, so a client has to carry AffirmTrust Premium itself in its root store to trust it.


## What happens when it expires

AffirmTrust Premium is valid until 2040-12-31, about 14.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is AffirmTrust Premium trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does AffirmTrust Premium expire?**

On 2040-12-31, about 14.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has AffirmTrust Premium issued?**

The CCADB lists 5: 0 valid, 0 expired and 5 revoked.

**Is AffirmTrust Premium cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).