# GTS Root R3 root certificate (Google Trust Services, SHA-256 34D8A73E)

> GTS Root R3 is a root CA certificate operated by Google Trust Services (ECDSA P-384, valid until 2036-06-22, SHA-256 34D8A73E). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/google-trust-services-gts-root-r3/
Last updated: 2026-11-10

GTS Root R3 is a root CA certificate operated by Google Trust Services (ECDSA P-384, valid until 2036-06-22, SHA-256 34D8A73E). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Google Trust Services |
| Subject | CN=GTS Root R3,O=Google Trust Services LLC,C=US |
| SHA-256 | 34D8A73EE208D9BCDB0D956520934B4E40E69482596E8B6F73C8426B010A6F48 |
| SPKI SHA-256 | 4179EDD981EF747477B49626408AF43DAA2CA7AB7F9E082C1060F84096774348 |
| Valid from | 2016-06-22 |
| Expires | 2036-06-22 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | 203E5B882EB20F825276D3D66 |
| SHA-1 (Windows thumbprint) | EDE571802BC892B95B833CD232683F09CDA01E46 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.74 / Firefox 97; Inclusion bug: #1675821 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Secure Email |

The CCADB lists no EV policy OID for GTS Root R3.

## Intermediate CAs issued by this root

The CCADB lists 6 intermediate CA certificates signed directly by GTS Root R3: 1 currently valid, 0 expired and 5 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| WE5 | Google Trust Services LLC | 2029-02-20 | Valid | 847409E63526F162753AC49F75218EFAAFA7D5C94ADE9095CE72E7F6B6E3AC99 |
| GTS CA 2D6 | Google Trust Services LLC | 2027-09-30 | Revoked | F5D12415A12C07FDE93BD6F9E4E4588E03D20596E4F8A5E9D213A83364BCEE71 |
| GTS CA 2D3 | Google Trust Services LLC | 2027-09-30 | Revoked | 57BE32D0638809F1CB7C6B58D57CFFAEB99774B1F0B57D6A3708923954A54824 |
| GTS Y3 | Google Trust Services LLC | 2030-01-30 | Revoked | 181DC8BE7E91EDF163E66CC3FAD14D979A6DAE53B556DAEE8F7DCA0E114C14F6 |
| GTS Y3 | Google Trust Services LLC | 2028-11-01 | Revoked | 0715C5787344FF4D27C4E79D2AFD91DD38A642D4CF0D9828B12620A62F52659E |
| GTS X3 | Google Trust Services LLC | 2026-06-22 | Revoked | EB73A16A1D61DD86186878EB2BC3485D1C0CA5F04E55E4FDA13785CD6C8FBCB0 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as GTS Root R3 with a different issuer, so a client has to carry GTS Root R3 itself in its root store to trust it.


## What happens when it expires

GTS Root R3 is valid until 2036-06-22, about 9.6 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is GTS Root R3 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Mozilla, Apple, Microsoft trust it for TLS server authentication; Chrome do not.

**When does GTS Root R3 expire?**

On 2036-06-22, about 9.6 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has GTS Root R3 issued?**

The CCADB lists 6: 1 valid, 0 expired and 5 revoked. The newest valid one is WE5, valid until 2029-02-20.

**Is GTS Root R3 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).