# GlobalSign Root E46 root certificate (GlobalSign)

> GlobalSign Root E46 is a root CA certificate operated by GlobalSign (ECDSA P-384, valid until 2046-03-20, SHA-256 CBB9C44D). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/globalsign-root-e46/
Last updated: 2026-11-10

GlobalSign Root E46 is a root CA certificate operated by GlobalSign (ECDSA P-384, valid until 2046-03-20, SHA-256 CBB9C44D). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | GlobalSign |
| Subject | CN=GlobalSign Root E46,O=GlobalSign nv-sa,C=BE |
| SHA-256 | CBB9C44D84B8043E1050EA31A69F514955D7BFD2E2C6B49301019AD61D9F5058 |
| SPKI SHA-256 | E04A022CE32F4CCF2C7F6046287B828A32A909F5E751447F83FD2C71F6FD8173 |
| Valid from | 2019-03-20 |
| Expires | 2046-03-20 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | 11D2BBBA336ED4BCE62468C50D841D98E843 |
| SHA-1 (Windows thumbprint) | 39B46CD5FE8006EBE22F4ABB0833A0AFDBB9DD84 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: NSS 3.63 / Firefox 88; Inclusion bug: #1570724 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication |

Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 52 intermediate CA certificates signed directly by GlobalSign Root E46: 27 currently valid, 14 expired and 11 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| GlobalSign Atlas E46 OV TLS CA 2027 H1 | GlobalSign nv-sa | 2029-10-21 | Valid | 244DD5BE2C99EF3F6FFA7B4ED9C83FA36B09B107B083933B8E9F3C5EC5B94D04 |
| GlobalSign Atlas E46 EV TLS CA 2027 H1 | GlobalSign nv-sa | 2029-10-21 | Valid | 223E004BD6FBEAAC51CEF3755622F2F6FDEBDC0826B2929D765E2E1AD5E84B9D |
| GlobalSign Atlas E46 DV TLS CA 2027 H1 | GlobalSign nv-sa | 2029-10-21 | Valid | 1E0D6F8E6EBC26FD103377698B1EC4ABA136EE4527E09A8CF01765FFCD11D1D1 |
| GlobalSign Atlas E46 OV TLS CA 2026 Q4 | GlobalSign nv-sa | 2028-07-21 | Valid | E003E3E66F590A02BC89714C821D03C89E3EA2CBCB39BCC22B0048947CB4E35D |
| GlobalSign Atlas E46 DV TLS CA 2026 Q4 | GlobalSign nv-sa | 2028-07-21 | Valid | D709B1E35A1B4D4724C01B3FB88860DFDFCB66AEF1DE05F9A349F4DC358FCEDE |
| GlobalSign Atlas E46 EV TLS CA 2026 Q4 | GlobalSign nv-sa | 2028-07-21 | Valid | 83CF7FA823D8A074FE0C5FCAC27C095A234FAAB5F2EBB1E65E898D70F7EB14F5 |
| GlobalSign TLS Root E41 | GlobalSign nv-sa | 2041-03-31 | Valid | 0FA1FCDC8C3AE03355D7062A025CD08F2EA98238708CD04D5D3CB8509C3B67FB |
| GlobalSign Atlas E46 OV TLS CA 2026 Q3 | GlobalSign nv-sa | 2028-04-22 | Valid | DDE0B4EAFE7F47C783D7178A420268879A352969057CE8D39DB017CA6AA99B07 |
| GlobalSign Atlas E46 EV TLS CA 2026 Q3 | GlobalSign nv-sa | 2028-04-22 | Valid | 8A793687C20B7076E15D8E77AC73DEDFCC355D31FF1D023F5518B8DD503BEF7E |
| GlobalSign Atlas E46 DV TLS CA 2026 Q3 | GlobalSign nv-sa | 2028-04-22 | Valid | 761102F1D7AEB9EE364B3EA0464E553B4BAACB74963D46501905D50C0F91B95C |
| GlobalSign Atlas E46 EV TLS CA 2026 Q2 | GlobalSign nv-sa | 2028-01-21 | Valid | 9EF94964B445161A7E69380CBCA0001ACA466818E5019AC8F7F75A9ADA910FF3 |
| GlobalSign Atlas E46 OV TLS CA 2026 Q2 | GlobalSign nv-sa | 2028-01-21 | Valid | 76E7856C3CFB8F37BBE651B42A05CC144ABA59017616E2819D196D7C7E2F83F5 |
| GlobalSign Atlas E46 DV TLS CA 2026 Q2 | GlobalSign nv-sa | 2028-01-21 | Valid | 1F361F27E8CB224ED70498730AE8C8553854EC33EF04F3CA23AE8801F57AB5BB |
| GlobalSign Atlas E46 EV TLS CA 2026 Q1 | GlobalSign nv-sa | 2027-10-15 | Valid | 4AAAD9A0D4B1E2BA8D5C571ECCBF5327664FF22EC131DEBBD1D8767F968F6AFB |
| GlobalSign Atlas E46 OV TLS CA 2026 Q1 | GlobalSign nv-sa | 2027-10-15 | Valid | 1207B166DA6171A51AEE0E68E4612E747BE7049E85239C8E79003C5FAA95D9A9 |
| GlobalSign Atlas E46 DV TLS CA 2026 Q1 | GlobalSign nv-sa | 2027-10-15 | Valid | 035250381A210A3142AB058B5FB4732F8B0EC52B2758A60304FC43A14B57F784 |
| GlobalSign GCC E46 EV TLS CA 2025 | GlobalSign nv-sa | 2029-06-23 | Valid | D077F277688DD5141029DD84D02F51966E1F337B5CFED88C5BBD61929EB3B748 |
| GlobalSign GCC E46 OV TLS CA 2025 | GlobalSign nv-sa | 2029-06-23 | Valid | 66F815D7925CBB2537BFEAA24A0041F7DDEF90E5D4717B16C21CCC0447A5B6FB |
| GlobalSign GCC E46 DV TLS CA 2025 | GlobalSign nv-sa | 2029-06-23 | Valid | 216D556D2F305606357A52F311CB825ABBB7227571B3522DF0F823600007D2ED |
| GlobalSign Atlas E46 DV TLS CA 2025 Q4 | GlobalSign nv-sa | 2027-07-16 | Valid | FEDE979C0D16F9FF1C5A824DEDB0AF24E1AF8ECF20227489026B32108CC9C6F3 |

## Cross-signed versions

3 certificate(s) in the CCADB have the same subject and public key as GlobalSign Root E46 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not GlobalSign Root E46, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| GlobalSign Root CA | GlobalSign nv-sa | 2028-01-28 | Valid | 33EF151EFB08D1C44FB85CC3F23EC6873014E9F881691BD4938B7F251580B694 |
| GlobalSign | GlobalSign nv-sa | 2029-03-18 | Valid | 1DF6054D6641404633641BB5FA3742FDA7D075E2514840AB61E00CCBBB7D341D |
| GlobalSign | GlobalSign nv-sa | 2038-01-19 | Valid | 0F1554C2FD591B0256A608E1C136A837E7A6E041561EE08A911B2AFDCD3C6C1B |

## What happens when it expires

GlobalSign Root E46 is valid until 2046-03-20, about 19.4 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is GlobalSign Root E46 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does GlobalSign Root E46 expire?**

On 2046-03-20, about 19.4 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has GlobalSign Root E46 issued?**

The CCADB lists 52: 27 valid, 14 expired and 11 revoked. The newest valid one is GlobalSign Atlas E46 OV TLS CA 2027 H1, valid until 2029-10-21.

**Is GlobalSign Root E46 cross-signed?**

Yes. The CCADB has 3 cross-certificate(s) with its subject and key, signed by GlobalSign Root CA, GlobalSign; 3 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).