# GlobalSign Root CA root certificate (GlobalSign)

> GlobalSign Root CA is a root CA certificate operated by GlobalSign (RSA 2048, valid until 2028-01-28, SHA-256 EBD41040). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/globalsign-root-ca/
Last updated: 2026-11-10

GlobalSign Root CA is a root CA certificate operated by GlobalSign (RSA 2048, valid until 2028-01-28, SHA-256 EBD41040). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | GlobalSign |
| Subject | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE |
| SHA-256 | EBD41040E4BB3EC742C9E381D31EF2A41A48B6685C96E7CEF3C1DF6CD4331C99 |
| SPKI SHA-256 | 2BCEE858158CF5465FC9D76F0DFA312FEF25A4DCA8501DA9B46B67D1FBFA1B64 |
| Valid from | 1998-09-01 |
| Expires | 2028-01-28 |
| Key | RSA 2048 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 40000000001154B5AC394 |
| SHA-1 (Windows thumbprint) | B1BC968BD4F49D622AA89A81F2150152A41D829C |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | No | - | Trust bits: Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.11.10 / Firefox 3.0.2; Inclusion bug: #406794 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security IKE Intermediate, IP Security Tunnel Termination, IP Security User, OCSP Signing, Secure Email, Time Stamping; Not-before cutoff: 2019-10-01 (OCSP Signing); Disallowed EKUs: OCSP Signing |

The CCADB lists EV policy OID 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1, 2.23.140.1.3 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 73 intermediate CA certificates signed directly by GlobalSign Root CA: 12 currently valid, 30 expired and 31 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| GlobalSign Root R46 | GlobalSign nv-sa | 2028-01-28 | Valid | 69C74C1DDA736D87DF9E8080A4AAE10B1230213347F2E71B9B5BAD5C685B79D5 |
| GlobalSign GCC R1 OV TLS CA 2025 | GlobalSign nv-sa | 2028-01-28 | Valid | DB24FF7CED7C93246DBAA21F7EFBFD261C423AF1964C0E96F1C20267A0C4C067 |
| GTS Root R4 | Google Trust Services LLC | 2028-01-28 | Valid | 76B27B80A58027DC3CF1DA68DAC17010ED93997D0B603E2FADBE85012493B5A7 |
| GlobalSign Atlas R1 EV TLS CA 2023 | GlobalSign nv-sa | 2028-01-28 | Valid | BFB08828EB69B99EE7CEBDD687C8E883A1FE07D3F998347F92EE9356414AD002 |
| AlphaSSL CA - SHA256 - G4 | GlobalSign nv-sa | 2027-10-12 | Valid | 7C4E90207B2B7CAEC080426CC469908CB27B925EE3B1C999C22B8568812FDA8C |
| GTS Root R1 | Google Trust Services LLC | 2028-01-28 | Valid | 3EE0278DF71FA3C125C4CD487F01D774694E6FC57E0CD94C24EFD769133918E5 |
| GlobalSign Timestamping CA - G3 | GlobalSign nv-sa | 2028-01-28 | Valid | 95C6A747DD0BC755A1941827E894B8083592241B792541E2EB1B30FB9B13F57F |
| GlobalSign Root R46 | GlobalSign nv-sa | 2028-01-28 | Valid | A5E33C28E3013A71F5F760AE3B16595090043D2EC5209EC52903C4FBAD258DAD |
| GlobalSign Root E46 | GlobalSign nv-sa | 2028-01-28 | Valid | 33EF151EFB08D1C44FB85CC3F23EC6873014E9F881691BD4938B7F251580B694 |
| GlobalSign | GlobalSign nv-sa | 2028-01-28 | Valid | F349954E8FB6D44011BCB789D97D9A2CB2032BD5F0B598D1FB8A099F5848D523 |
| GlobalSign | GlobalSign nv-sa | 2028-01-28 | Valid | C84E1378B974A991ACDCDD733421E3061E6FA21A0491C8902BAFDE3855E0063E |
| GlobalSign | GlobalSign nv-sa | 2028-01-28 | Valid | 445EEC78BC61215044A0379656AA2D5DB5E42F76CB70B8D14C2077AA943D4EBB |
| GlobalSign CodeSigning CA - G3 | GlobalSign nv-sa | 2024-03-16 | Expired | 4047C9D69260C07213BCB8608A7EC5E2838A56B79F67847812EAC0778D0D27F1 |
| GlobalSign Organization Validation CA - SHA256 - G3 | GlobalSign nv-sa | 2025-09-04 | Expired | 699D54B7482A5D329331EA0415CC2EDCD60FDA01D19E71D054196BCE0677735C |
| GlobalSign Domain Validation CA - SHA256 - G3 | GlobalSign nv-sa | 2025-09-04 | Expired | 09BC1B137C031239EF788673E94EB17F5F3ECAB07D3ADBFB485E75ABFAAF3B9A |
| GlobalSign CloudSSL CA - SHA1 - G3 | GlobalSign nv-sa | 2017-08-19 | Expired | 663E8A2747368820385C98608DC38480B2BAE7A830573D7DC5435E47095BC1EA |
| GlobalSign CloudSSL CA - SHA256 - G3 | GlobalSign nv-sa | 2025-08-19 | Expired | 4B7334E1D8999822BAFA8FF6888125389B18A4E5AB26FFA624C7F68FDC81F0CB |
| GlobalSign CloudSSL CA - SHA1 - G3 | GlobalSign nv-sa | 2017-07-09 | Expired | F80CB5207BAC914E56634E0A88119949C46F999CE327CEA3ACB43C5B365C04E9 |
| GlobalSign CloudSSL CA - SHA1 - G3 | GlobalSign nv-sa | 2017-04-30 | Expired | D68344E566E081B06BA35668D792A100FD20A7DF764A2E66411D165571B67605 |
| AlphaSSL CA - SHA256 - G2 | GlobalSign nv-sa | 2024-02-20 | Expired | EE793643199474ED60EFDC8CCDE4D37445921683593AA751BBF8EE491A391E97 |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as GlobalSign Root CA but a different issuer. A server can send one of them so that clients which trust the issuing root, but not GlobalSign Root CA, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| GlobalSign | Google Trust Services LLC | 2021-12-15 | Revoked | A8CC00DEEF9E19F74CCEAE192B86FE2E3D1A01391BBB01DD62A0438DD07501A7 |

## What happens when it expires

GlobalSign Root CA is valid until 2028-01-28, about 1.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is GlobalSign Root CA trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does GlobalSign Root CA expire?**

On 2028-01-28, about 1.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has GlobalSign Root CA issued?**

The CCADB lists 73: 12 valid, 30 expired and 31 revoked. The newest valid one is GlobalSign Root R46, valid until 2028-01-28.

**Is GlobalSign Root CA cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by GlobalSign; 0 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).