# AC RAIZ FNMT-RCM root certificate (FNMT (Spain))

> AC RAIZ FNMT-RCM is a root CA certificate operated by FNMT (Spain) (RSA 4096, valid until 2030-01-01, SHA-256 EBC5570C). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/fnmt-ac-raiz-fnmt-rcm/
Last updated: 2026-11-10

AC RAIZ FNMT-RCM is a root CA certificate operated by FNMT (Spain) (RSA 4096, valid until 2030-01-01, SHA-256 EBC5570C). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | FNMT (Spain) |
| Subject | OU=AC RAIZ FNMT-RCM,O=FNMT-RCM,C=ES |
| SHA-256 | EBC5570C29018C4D67B1AA127BAF12F703B4611EBC17B7DAB5573894179B93FA |
| SPKI SHA-256 | 2FC5667A4B9A2678ED6AC6AD25465FCBF6094BFCD9504097C7A8FA47ADE5E888 |
| Valid from | 2008-10-29 |
| Expires | 2030-01-01 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 5D938D306736C8061D1AC754846907 |
| SHA-1 (Windows thumbprint) | EC503507B215C4956219E2A89A5B42992C4C2C20 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.28.1 / Firefox 51; Inclusion bug: #435736 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Document Signing, Secure Email, Time Stamping |

The CCADB lists no EV policy OID for AC RAIZ FNMT-RCM.

## Intermediate CAs issued by this root

The CCADB lists 15 intermediate CA certificates signed directly by AC RAIZ FNMT-RCM: 6 currently valid, 2 expired and 7 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R | Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) | 2029-12-16 | Valid | 327EC93955C9145261B087C6FC5EAC8A71262BF2568E8D36F7C2FEDBD1B1077A |
| AC Unidades de Sellado de Tiempo | Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) | 2029-11-28 | Valid | 9CE630B35F8AE2C6419E734AD9D2FA30476DD9E7394B1E93B27F83F776A024EA |
| AC Sector Público | Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) | 2029-11-28 | Valid | 8265756DD5CD8A37EE61E40351288E4B16A89DD248C1EC4EBA25AAF161ABF498 |
| AC Representación | Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) | 2029-12-31 | Valid | 8FD16A179944D5D1D420AF09405EDA7ABF2A9C742883E8C2F89E0D90AFAF754B |
| AC FNMT Usuarios | Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) | 2029-10-28 | Valid | 601293CA20B09A03295D196256C6953FF9EBA811DB8E3CE140413C1BFFE9A869 |
| AC Componentes Informáticos | Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) | 2028-06-24 | Valid | F038421F07F20D63A20D3691E5A178AB8459EBE570C1647B7690554EF23876AB |
| AC Administración Pública | Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) | 2022-05-21 | Expired | 830FF205AE69485059C3FB2376A7F2F9EE1C2A61DE259DD09D0BB6AD69F88832 |
| AC Administración Pública | Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) | 2022-05-21 | Expired | 18A43C51D08174C3A6D85F1C1318BD2909753E75D91CF6599F73347B00702890 |
| AC Componentes Informáticos | Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) | 2028-06-27 | Revoked | DB0DA16032F1643A2496FDE742E2BBE81DACA58CD7612061420E154CE1BCE2BD |
| EU ISA CA | Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) | 2026-05-31 | Revoked | BF1C7EBAA0AC089C16DDC7EA0388D83F4721DD862FE8715E19BA0782AED146FE |
| EU ISA CA | Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) | 2026-05-31 | Revoked | 699CE8E205651EF48B03853315AE482CA04BF2B3E2D9B5A5EF08E8CB13869BB6 |
| ISA CA | Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) | 2025-11-02 | Revoked | 052BEBBDCD5C847BFA0F6FB0EA2246B55BA9EE55E02A2D480B87FC2F342C8443 |
| AC APE | Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) | 2023-11-03 | Revoked | FD01901FE7C4F514D636DF64C0744AA4029DB916A36F28474C840E6807936A1E |
| AC APE | Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) | 2023-11-03 | Revoked | C081EAC7B9807B70BDDCAC131F07B667E4D9DE7F568C43BA011113A1E7534899 |
| AC APE | Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) | 2023-11-03 | Revoked | 0D4C324BB0B008F45EEC738B8E51B37D250F76F05F6A0C3013661020A2072565 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as AC RAIZ FNMT-RCM with a different issuer, so a client has to carry AC RAIZ FNMT-RCM itself in its root store to trust it.


## What happens when it expires

AC RAIZ FNMT-RCM is valid until 2030-01-01, about 3.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is AC RAIZ FNMT-RCM trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does AC RAIZ FNMT-RCM expire?**

On 2030-01-01, about 3.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has AC RAIZ FNMT-RCM issued?**

The CCADB lists 15: 6 valid, 2 expired and 7 revoked. The newest valid one is AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R, valid until 2029-12-16.

**Is AC RAIZ FNMT-RCM cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).