# GDCA TrustAUTH R5 ROOT root certificate (Global Digital Cybersecurity Authority (GDCA))

> GDCA TrustAUTH R5 ROOT is a root CA certificate operated by Global Digital Cybersecurity Authority (GDCA) (RSA 4096, valid until 2040-12-31, SHA-256 BFFF8FD0). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/gdca-trustauth-r5-root/
Last updated: 2026-11-10

GDCA TrustAUTH R5 ROOT is a root CA certificate operated by Global Digital Cybersecurity Authority (GDCA) (RSA 4096, valid until 2040-12-31, SHA-256 BFFF8FD0). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Global Digital Cybersecurity Authority (GDCA) |
| Subject | CN=GDCA TrustAUTH R5 ROOT,O=GUANG DONG CERTIFICATE AUTHORITY CO.\,LTD.,C=CN |
| SHA-256 | BFFF8FD04433487D6A8AA60C1A29767A9FC2BBB05E420F713A13B992891D3893 |
| SPKI SHA-256 | CEB19411C65052C757F941EB826C96941E4D08D096C7DB7E7EA3C4F8C13F1A13 |
| Valid from | 2014-11-26 |
| Expires | 2040-12-31 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 7D0997FEF047EA7A |
| SHA-1 (Windows thumbprint) | 0F36385B811A25C39B314E83CAE9346670CC74B4 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 1.2.156.112559.1.1.6.1; First included in: NSS 3.34 / Firefox 58; Inclusion bug: #1128392 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Document Signing, Encrypting File System, Secure Email, Time Stamping; Not-before cutoff: 2026-05-19 (Encrypting File System, Secure Email) |

Mozilla treats it as an EV root for policy OID 1.2.156.112559.1.1.6.1.

## Intermediate CAs issued by this root

The CCADB lists 22 intermediate CA certificates signed directly by GDCA TrustAUTH R5 ROOT: 3 currently valid, 0 expired and 19 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| GDCA TrustAUTH R4 EV SSL CA2 | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2029-10-31 | Valid | 9DBD662B8272B3D04AA235074F729C677C59ACBE0831A22D0FDFAA787986B1C6 |
| GDCA TrustAUTH R4 DV SSL CA2 | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2029-10-31 | Valid | 5599662C0B3B37ADD214F0E4FEF7133FDE5916DA62D6772D4D3452EE55579F6A |
| GDCA TrustAUTH R4 OV SSL CA2 | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2029-10-31 | Valid | 28C715A15710E9FF062386C35F89FECF812E521BF403F0DD91B14254AC3BE795 |
| GDCA TrustAUTH R4 OV SSL CA2 | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2036-12-30 | Revoked | 9B69C6ECDA5593C4551613073A1D56563EFA342BADF3E794BD03D5DCFF97057C |
| GDCA TrustAUTH R4 EV SSL CA2 | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2036-12-30 | Revoked | 422952C2BC58A4671AF5E8ACB26EFFA55532F4051EE88F3F1AD019FC7F2B8722 |
| GDCA TrustAUTH R4 DV SSL CA2 | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2036-12-30 | Revoked | 2F7D8EEAB71116CDBC574B2D943D22403D3B8B26E3C7ABDB68F2D8CB49C2D0DF |
| GDCA TrustAUTH R4 CodeSigning CA2 | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2040-02-10 | Revoked | 463562D1F84267AA253EE1CB1FF6F1808C349CE38FF10E9DBB0794EFA7CAE401 |
| GDCA TrustAUTH R4 TimeStamp CA | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2035-12-31 | Revoked | 4FBCDFC8184C41523CEBA58A4F3BAFD36ECADACC11ECA148AA24C774C8E4B47B |
| GDCA TrustAUTH R4 Plus EV CodeSigning CA | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2035-12-31 | Revoked | 3B39A01EB6DD0C0E870359F01AFB66665E0D5C24080291A0769D7F0FB4BB0E4E |
| GDCA TrustAUTH R4 EV CodeSigning CA | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2030-12-30 | Revoked | 882E0146D15D3483EE5981E35067F1449E562B89E22ECC3FDF37274EDD314CDA |
| GDCA TrustAUTH R4 Generic CA | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2030-12-30 | Revoked | 5DB60C2D6B6BECF314477589A3A4FB4CCF84649D69B0B21B3D6B2ABA78BD35FB |
| GDCA TrustAUTH R4 CodeSigning CA | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2030-12-30 | Revoked | 051C238FAD7C1DC0FCEB4AEF79CAE97FE49A82DA8916A4A0920F307AACD60F81 |
| GDCA TrustAUTH R4 EV SSL CA | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2030-12-30 | Revoked | 96A5A2CD39800CFB6A2A830EE52DCF47FBB00FF1B03204DB36915CEA31F13342 |
| GDCA TrustAUTH R4 OV SSL CA | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2030-12-30 | Revoked | 5600AFB6BAE2A83B66B9CBBE9CEEC8F53E26420A69939A48DCC6D56B99790A63 |
| GDCA TrustAUTH R4 IV SSL CA | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2030-12-30 | Revoked | 99442C8F83A3C5090CA50C1C0B1DE4B32ED418FF0AA7C3240E91230159F3E7BF |
| GDCA TrustAUTH R4 DV SSL CA | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2030-12-30 | Revoked | 74468180CE564BAD7E812210AF743E85CA96CBA44CF5851FA00082341B2535F5 |
| GDCA TrustAUTH R4 Primer CA | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2030-12-30 | Revoked | 3253412FDAD4523108C098BB0EE0EFEDD7FAFDD00FB30E47C6BBA9FE3E1CDB88 |
| GDCA TrustAUTH R4 Extended Validation CodeSigning CA | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2030-12-30 | Revoked | BEC06F55344C3DE4F12CD5D808906CDE275234951BE0176A787E628E2BE7D51F |
| GDCA TrustAUTH R4 Generic CA | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2030-12-30 | Revoked | 86C6707BBE27CDE1215E25D3F8146A522281E18C45DF2CB8C6FB7A03C1733510 |
| GDCA TrustAUTH R4 Extended Validation SSL CA | Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) | 2030-12-30 | Revoked | 55324A9832512FC6C99F15BF0E9ED3D6BEB4398CCEE194B7FF849D96D9130D44 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as GDCA TrustAUTH R5 ROOT with a different issuer, so a client has to carry GDCA TrustAUTH R5 ROOT itself in its root store to trust it.


## What happens when it expires

GDCA TrustAUTH R5 ROOT is valid until 2040-12-31, about 14.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is GDCA TrustAUTH R5 ROOT trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does GDCA TrustAUTH R5 ROOT expire?**

On 2040-12-31, about 14.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has GDCA TrustAUTH R5 ROOT issued?**

The CCADB lists 22: 3 valid, 0 expired and 19 revoked. The newest valid one is GDCA TrustAUTH R4 EV SSL CA2, valid until 2029-10-31.

**Is GDCA TrustAUTH R5 ROOT cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).