Root certificate · FNMT (Spain)

AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R

AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R is a root CA certificate operated by FNMT (Spain) (RSA 4096, valid until 2040-12-12, SHA-256 FC23DDFB). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

Data updated Nov 10, 2026

Root store status

Root store	Status	Trusted for TLS	Distrust for TLS after	Constrained
Chrome	Not included Not included	No	—	No
Mozilla	Not included Not included	No	—	No
Apple	Not included Not included	No	—	No
Microsoft	Included Included	Yes	—	No

The CCADB lists no EV policy OID for AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R.

Not included Chrome

Status: Not included

Not included Mozilla

Status: Not included

Not included Apple

Status: Not included

Included Microsoft

Status: Included
Trusted EKUs: Server Authentication

"Trusted for TLS" means the store includes the root with the server-authentication trust bit (Mozilla "Websites", Apple serverAuth, Microsoft Server Authentication EKU). Microsoft "NotBefore" means only certificates issued before a cutoff date are still trusted. "Constrained" means the store applies extra restrictions.

Details

CA owner: Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT)
Subject: CN=AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R,O=FNMT-RCM,C=ES
SHA-256: FC23DDFB7AA505D605B2F492FA1587E3738A074A17C0CF06FADFC725650FA42A
SHA-1 (Windows thumbprint): 1987948DAB7D62009E2D6BBED883DC3AF56799E8
SPKI SHA-256: 21C10DC287DA461A907363DC8F28E072E79B0B50E73E8818D587E2B340CB4093
Valid from: 2025-12-16
Expires: 2040-12-12
Key: RSA 4096
Signature algorithm: sha384WithRSAEncryption
Serial number: 2A0E1CA4D4B684F8A85A03C07F484174E669CF40
Country: ES
Trust bits (CCADB): Server Authentication
EV policy OIDs (CCADB): not EV-enabled · TLS EV capable: No
Test websites: valid: https://g2rovactive.testssl.cert.fnmt.es · expired: https://g2rovexpired.testssl.cert.fnmt.es · revoked: https://g2rovrevoked.testssl.cert.fnmt.es
CCADB record: A012873
PEM: fnmt-ac-raiz-fnmt-rcm-servidores-seguros-g2r.pem

Look up this certificate on crt.sh

Intermediate CAs issued by this root

The CCADB lists 1 intermediate CA certificates signed directly by AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R: 1 currently valid, 0 expired and 0 revoked (revoked includes those whose parent was revoked).

Showing 1 of 1: valid certificates first, newest first. Each name links to its crt.sh entry by SHA-256; an arrow marks a cross-certificate for another root on this site.

Intermediate	Operated by	Expires	Status
AC SERVIDORES SEGUROS TIPO2 G2R	Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT)	2035-12-14	Valid

Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R but a different issuer. A server can send one of them so that clients which trust the issuing root, but not AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R, can still build a chain.

Signed by	CA owner	Expires	Status
AC RAIZ FNMT-RCM crt.sh	Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT)	2029-12-16	Valid

CRL and OCSP addresses

In the root certificate

AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R itself contains no CRL Distribution Points and no OCSP (Authority Information Access) extension. That is normal for a root: clients trust it directly and do not check its own revocation status.

Full CRL this CA publishes (CCADB)

http://www.cert.fnmt.es/crls/ARLFNMTRCMSERVIDORESSEGUROSG2R.crl

Used by the intermediates it issued

Addresses found in the CRL Distribution Points and OCSP fields of the 1 valid intermediates signed by AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R; the number in brackets is how many of them use each address.

CRL: http://www.cert.fnmt.es/crls/ARLFNMTRCMSERVIDORESSEGUROSG2R.crl (1)
OCSP: http://ocspfnmtssrg2r.cert.fnmt.es/ocspssrg2r/OcspResponder (1)

What happens when it expires

AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R is valid until 2040-12-12, about 14.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

Check whether your device trusts it

Each platform keeps its own root store. The commands below look up AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R by common name (AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R) or fingerprint. The store status in each heading comes from the CCADB snapshot; your device can differ if it is out of date or managed by an administrator.

macOS (Apple store: Not included)

Search the system roots keychain by common name. -Z prints the SHA-256 hash, which must match the fingerprint on the last line.

security find-certificate -a -c "AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R" -Z \
  /System/Library/Keychains/SystemRootCertificates.keychain | grep "SHA-256"
# SHA-256 hash: FC23DDFB7AA505D605B2F492FA1587E3738A074A17C0CF06FADFC725650FA42A

Windows (Microsoft store: Included · Trusted for TLS)

Windows identifies roots by SHA-1 thumbprint. It installs third-party roots on demand through Automatic Root Certificates Update, so "not found" can also mean the root has not been needed yet; certutil -generateSSTFromWU roots.sst downloads Microsoft's full list.

certutil -verifystore Root 1987948DAB7D62009E2D6BBED883DC3AF56799E8

Linux (ca-certificates follows Mozilla: Not included)

Debian, Ubuntu, Fedora and RHEL build their ca-certificates package from Mozilla's root store. Use trust list on p11-kit systems, or search the PEM bundle on Debian and Ubuntu.

# Fedora / RHEL / Arch (p11-kit)
trust list --filter=ca-anchors | grep -iF -A2 "AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R"
# Debian / Ubuntu (ca-certificates)
openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt \
  | openssl pkcs7 -print_certs -noout | grep -iF "AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R"

Java

Java ships its own cacerts keystore; JDK 9 and later accept -cacerts and the default store password is changeit. Search for the SHA-256 fingerprint in colon form.

keytool -list -cacerts -storepass changeit | grep -i "FC:23:DD:FB:7A:A5:05:D6:05:B2:F4:92:FA:15:87:E3:73:8A:07:4A:17:C0:CF:06:FA:DF:C7:25:65:0F:A4:2A"

Android

Android's system store is maintained by Google separately from the four CCADB stores above. Open Settings → Security & privacy → More security settings → Encryption & credentials → Trusted credentials → System (menu names vary by vendor and version) and look for FNMT-RCM → AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R.

Which root does my site chain to?

List the chain your server sends and compare the last issuer with this root; the fingerprint check confirms a local copy.

Download PEM

# show subject (s:) and issuer (i:) of every certificate the server sends
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null \
  | grep -E '^ *[0-9]+ s:|^ *i:'
# subject and SHA-256 fingerprint of the downloaded PEM file
openssl x509 -in fnmt-ac-raiz-fnmt-rcm-servidores-seguros-g2r.pem -noout -subject -fingerprint -sha256
# sha256 Fingerprint=FC:23:DD:FB:7A:A5:05:D6:05:B2:F4:92:FA:15:87:E3:73:8A:07:4A:17:C0:CF:06:FA:DF:C7:25:65:0F:A4:2A

FAQ

Is AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R trusted by Chrome, Firefox, Safari and Windows?

As of 2026-11-10, Microsoft trust it for TLS server authentication; Chrome, Mozilla, Apple do not.

When does AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R expire?

On 2040-12-12, about 14.1 years after the 2026-11-10 data snapshot.

How many intermediate certificates has AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R issued?

The CCADB lists 1: 1 valid, 0 expired and 0 revoked. The newest valid one is AC SERVIDORES SEGUROS TIPO2 G2R, valid until 2035-12-14.

Is AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R cross-signed?

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by AC RAIZ FNMT-RCM; 1 of them are still valid.

Other roots from FNMT (Spain)

AC RAIZ FNMT-RCM RSA 4096 · 2030-01-01
AC RAIZ FNMT-RCM SERVIDORES SEGUROS ECDSA P-384 · 2043-12-20

Sources

CCADB — Resources (TLS Server Authentication report, All Included Root Certificate Trust Bit Settings)
CCADB — All Certificate Information (root and intermediate), CSV V5
CCADB — Mozilla Included CA Certificate Report
CCADB — Chrome / Mozilla / Apple / Microsoft TLS Server Authentication CSV