# HARICA TLS ECC Root CA 2021 root certificate (HARICA)

> HARICA TLS ECC Root CA 2021 is a root CA certificate operated by HARICA (ECDSA P-384, valid until 2045-02-13, SHA-256 3F99CC47). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/harica-tls-ecc-root-ca-2021/
Last updated: 2026-11-10

HARICA TLS ECC Root CA 2021 is a root CA certificate operated by HARICA (ECDSA P-384, valid until 2045-02-13, SHA-256 3F99CC47). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | HARICA |
| Subject | CN=HARICA TLS ECC Root CA 2021,O=Hellenic Academic and Research Institutions CA,C=GR |
| SHA-256 | 3F99CC474ACFCE4DFED58794665E478D1547739F2E780F1BB4CA9B133097D401 |
| SPKI SHA-256 | FC784300EC8DF4D3D1BAD763835182918D52A9FF0238BDF695A1CD9BDB98321C |
| Valid from | 2021-02-19 |
| Expires | 2045-02-13 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | 67749D8D77D83B6ADB22F4FF59E2BFCE |
| SHA-1 (Windows thumbprint) | BCB0C19DE9989270193857E98DA7B45D6EEE0148 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: NSS 3.71 / Firefox 94; Inclusion bug: #1695487 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication |

Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 8 intermediate CA certificates signed directly by HARICA TLS ECC Root CA 2021: 8 currently valid, 0 expired and 0 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| GEANT TLS ECC 1 | HARICA | 2039-12-31 | Valid | 6CDF0BA1711E856D228BA00CA04C5C1C3D79944C037B713B155A4EE4B47EC53C |
| HARICA Qualified Web Authentication Certificates ECC | HARICA | 2038-07-14 | Valid | 27417A09FA7410B9198A1B0645CDFEC28079EF5E8143AF2BDB697731045027CE |
| HARICA Institutional TLS ECC 2 | HARICA | 2037-06-25 | Valid | 94802F1B0DB27426293B12C8775880EFF0345E6620079F714A7513E1946579C3 |
| HARICA EV TLS ECC 2 | HARICA | 2037-01-24 | Valid | 7CFE34378E73069F3A6813BEC89A0E47693C21AE26A3760D50CDF4D05E40D1F3 |
| HARICA DV TLS ECC | HARICA | 2036-03-15 | Valid | 392377A719E3E65A40D8651B92361DB95320B39CA361072A3A3CF42C66E00DBC |
| HARICA OV TLS ECC | HARICA | 2036-03-15 | Valid | 3293500CAA507B1E920A441F277BADCBB75002CAEC6282D23A3578F7817D2380 |
| HARICA IV TLS ECC | HARICA | 2036-03-15 | Valid | 2D923F67980DA53AAD5E5E6A61BAAD9FC645DD208D76C51C8EDA5C73870A8F95 |
| HARICA EV TLS ECC | HARICA | 2036-03-15 | Valid | 223ADE0E45CCC4BECB255DB009DF1E239AA5D71B17CF3DB0A582C292C25ECC52 |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as HARICA TLS ECC Root CA 2021 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not HARICA TLS ECC Root CA 2021, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Hellenic Academic and Research Institutions ECC RootCA 2015 | HARICA | 2029-08-31 | Valid | 50E27F90EB6AF495B0E6EEB655CC89444C27D3C95B6823FA02ABDC95F1636AE1 |

## What happens when it expires

HARICA TLS ECC Root CA 2021 is valid until 2045-02-13, about 18.3 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is HARICA TLS ECC Root CA 2021 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does HARICA TLS ECC Root CA 2021 expire?**

On 2045-02-13, about 18.3 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has HARICA TLS ECC Root CA 2021 issued?**

The CCADB lists 8: 8 valid, 0 expired and 0 revoked. The newest valid one is GEANT TLS ECC 1, valid until 2039-12-31.

**Is HARICA TLS ECC Root CA 2021 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by Hellenic Academic and Research Institutions ECC RootCA 2015; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).