# GTS Root R1 root certificate (Google Trust Services, SHA-256 D947432A)

> GTS Root R1 is a root CA certificate operated by Google Trust Services (RSA 4096, valid until 2036-06-22, SHA-256 D947432A). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/google-trust-services-gts-root-r1/
Last updated: 2026-11-10

GTS Root R1 is a root CA certificate operated by Google Trust Services (RSA 4096, valid until 2036-06-22, SHA-256 D947432A). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Google Trust Services |
| Subject | CN=GTS Root R1,O=Google Trust Services LLC,C=US |
| SHA-256 | D947432ABDE7B7FA90FC2E6B59101B1280E0E1C7E4E40FA3C6887FFF57A7F4CF |
| SPKI SHA-256 | 871A9194F4EED5B312FF40C84C1D524AED2F778BBFF25F138CF81F680A7ADC67 |
| Valid from | 2016-06-22 |
| Expires | 2036-06-22 |
| Key | RSA 4096 |
| Signature algorithm | sha384WithRSAEncryption |
| Serial number | 203E5936F31B01349886BA217 |
| SHA-1 (Windows thumbprint) | E58C1CC4913B38634BE9106EE3AD8E6B9DD9814A |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.74 / Firefox 97; Inclusion bug: #1675821 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Secure Email |

The CCADB lists no EV policy OID for GTS Root R1.

## Intermediate CAs issued by this root

The CCADB lists 10 intermediate CA certificates signed directly by GTS Root R1: 4 currently valid, 0 expired and 6 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| WR2 | Google Trust Services LLC | 2029-02-20 | Valid | E6FE22BF45E4F0D3B85C59E02C0F495418E1EB8D3210F788D48CD5E1CB547CD4 |
| WR4 | Google Trust Services LLC | 2029-02-20 | Valid | DC9416C2F855126D6DE977677538F2F967FF4998E90DFA435A17219BE077FC06 |
| WR1 | Google Trust Services LLC | 2029-02-20 | Valid | B10B6F00E609509E8700F6D34687A2BFCE38EA05A8FDF1CDC40C3A2A0D0D0E45 |
| WR3 | Google Trust Services LLC | 2029-02-20 | Valid | 2FE357DB13751FF9160E87354975B3407498F41C9BD16A48657866E6E5A9B4C7 |
| GIAG4x | Google Trust Services LLC | 2023-09-30 | Revoked | D3680B4E3F88DB1F5BB9DDDBFB6BFF319C780E3D9F44EE24EC1995AB42D6914F |
| GTS CA 1P5 | Google Trust Services LLC | 2027-09-30 | Revoked | 97D42003E132552946097F20EF955F5B1CD570AA4372D780033A65EFBE69758D |
| GTS CA 1D4 | Google Trust Services LLC | 2027-09-30 | Revoked | 64E286B76063602A372EFD60CDE8DB2656A49EE15E84254B3D6EB5FE38F4288B |
| GTS CA 1C3 | Google Trust Services LLC | 2027-09-30 | Revoked | 23ECB03EEC17338C4E33A6B48A41DC3CDA12281BBC3FF813C0589D6CC2387522 |
| GTS Y1 | Google Trust Services LLC | 2028-11-01 | Revoked | 7D740341B5193F53E675E3A1E3B4B1095E602509F65A5FA7576B0E3A5470F9C6 |
| GTS X1 | Google Trust Services LLC | 2026-06-22 | Revoked | C2864EAB2306A57B2CDA90F1557EACDB88B302D8EE499A5AE938EF6725CBE2B1 |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as GTS Root R1 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not GTS Root R1, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| GlobalSign Root CA | GlobalSign nv-sa | 2028-01-28 | Valid | 3EE0278DF71FA3C125C4CD487F01D774694E6FC57E0CD94C24EFD769133918E5 |

## What happens when it expires

GTS Root R1 is valid until 2036-06-22, about 9.6 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is GTS Root R1 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does GTS Root R1 expire?**

On 2036-06-22, about 9.6 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has GTS Root R1 issued?**

The CCADB lists 10: 4 valid, 0 expired and 6 revoked. The newest valid one is WR2, valid until 2029-02-20.

**Is GTS Root R1 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by GlobalSign Root CA; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).