# IdenTrust Commercial Root CA 1 root certificate (IdenTrust)

> IdenTrust Commercial Root CA 1 is a root CA certificate operated by IdenTrust (RSA 4096, valid until 2034-01-16, SHA-256 5D56499B). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/identrust-commercial-root-ca-1/
Last updated: 2026-11-10

IdenTrust Commercial Root CA 1 is a root CA certificate operated by IdenTrust (RSA 4096, valid until 2034-01-16, SHA-256 5D56499B). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | IdenTrust |
| Subject | CN=IdenTrust Commercial Root CA 1,O=IdenTrust,C=US |
| SHA-256 | 5D56499BE4D2E08BCFCAD08A3E38723D50503BDE706948E42F55603019E528AE |
| SPKI SHA-256 | 07E854F26A7CBD389927AA041BFEF1B6CD21DD143818AD947DC655A9E587FE88 |
| Valid from | 2014-01-16 |
| Expires | 2034-01-16 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | A0142800000014523C844B500000002 |
| SHA-1 (Windows thumbprint) | DF717EAA4AD94EC9558499602D48DE5FBCF03A25 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: NSS 3.18 / Firefox 38; Inclusion bug: #1037590 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Document Signing, Encrypting File System, Secure Email, Time Stamping |

Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 34 intermediate CA certificates signed directly by IdenTrust Commercial Root CA 1: 7 currently valid, 2 expired and 25 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| IdenTrust Commercial Root TLS ECC CA 2 | IdenTrust Services, LLC | 2029-09-06 | Valid | CEFB479638BF1E4D10D3303ECD29E18A63451B782826C13B803DF23C5156B41F |
| IdenTrust Commercial Root TLS RSA CA 2 | IdenTrust Services, LLC | 2029-07-29 | Valid | 30DCF2598D8A910FA027A75B3F0DF6284A7B5B73152BF54FC5A95D01FFF0FDE2 |
| CrowdStrike TLS CA 1 | IdenTrust Services, LLC | 2033-09-15 | Valid | 0CD568E086A4CCBE7D25A0E0FDCB123FA4522FE3A33CD34228C4886000161B91 |
| TrustID Enterprise TLS CA 3 | IdenTrust Services, LLC | 2032-09-16 | Valid | 86A2E3105F21D5DEDE5A437CEDA47BBE2044D775F6F77F346B1D4BD03A1F5907 |
| HydrantID Server CA O1 | IdenTrust Services, LLC | 2029-12-12 | Valid | 8BB2F6883FED289A521BA27C478482950874E143CACCEC6FC025990C0C46813E |
| TrustID Server CA E1 | IdenTrust Services, LLC | 2029-12-12 | Valid | 743E328F329E194DA252711BF6BFF00CF63B6A4C0AA66B2E1967716910678971 |
| TrustID Server CA O1 | IdenTrust Services, LLC | 2029-12-12 | Valid | 6BAAB0C433D779FD6A4B6D56D6304D5E6EA5DE689FE35A43038A4028F345DF60 |
| TrustID CA A12 | IdenTrust Services, LLC | 2023-02-18 | Expired | 5AE464BD2F83901FC33EF2B50CD880F5118C8DBEB1EB4A4E94B2FB05128805C2 |
| TrustID Server CA A52 | IdenTrust Services, LLC | 2022-03-20 | Expired | B39C4A4596D3191AFA3B3D254D28E5C482FCD0D500E0A9337F99277CB8A2EEF8 |
| IdenTrust Commercial Root TLS ECC CA 2 | IdenTrust Services, LLC | 2029-02-02 | Revoked | 1CA8C3285540354E57B49A3D5EDF540FBB3218F95F8D07636507AD6BB1DBDC0A |
| IdenTrust Commercial Root TLS RSA CA 2 | IdenTrust Services, LLC | 2029-01-25 | Revoked | 8F421B843521876963F1A099F28815CBD79DD1D2C7E414682A9AA8E0E7260E41 |
| IdenTrust Commercial Root TLS ECC CA 2 | IdenTrust Services, LLC | 2029-01-25 | Revoked | 4F2025B16370D274E1330B723BBD66E6AA8A12A2DE0D8AC8E02AEF85CBFFDE8D |
| CrowdStrike TLS CA 1 | IdenTrust Services, LLC | 2033-09-13 | Revoked | D9D1322536C7E01F6DC6741381E30531BE26D3FCF2EA2E54859803FA7696FD51 |
| TrustID Timestamping CA 5 | IdenTrust Services, LLC | 2031-03-11 | Revoked | 8EECA62729D361BE56F3F4234DB73344DF039CFCE80D49418BE93AD187D9850B |
| TrustID Timestamping CA 4 | IdenTrust Services, LLC | 2031-03-06 | Revoked | BCF05F424CEE2DE68775009EFBC921B977B481C64E599CF149F427F14F559950 |
| TrustID Enterprise TLS CA 3 | IdenTrust Services, LLC | 2032-04-29 | Revoked | C46678B11AD9B8B9E46953C38E6F0E3E0C92479070C1512B8A155070E7E4E4FA |
| TrustID Enterprise TLS CA 3 | IdenTrust Services, LLC | 2032-04-29 | Revoked | 187E3D67BA087B9F9BEF3CD62145E7F9C2747AC362664E98CC55AC426A419028 |
| TrustID HID Enterprise CA 2 | IdenTrust Services, LLC | 2033-08-12 | Revoked | AF0926CB0E3C5A37B76F30370583C3CD63BBEC2B33CC8459849CA69D4F9C7CDE |
| TrustID SAIC Public Email Issuing CA 2 | IdenTrust Services, LLC | 2033-08-12 | Revoked | 944586DADCE409FC51017EF473B9ADDA6EF7589F70B21430507FD245809B3BF9 |
| TrustID CA A14 | IdenTrust Services, LLC | 2033-08-12 | Revoked | 7A95A827D6A13C7C191A893D2987E4134ACB403EC9E26E8CD92525A806D794C6 |

## Cross-signed versions

2 certificate(s) in the CCADB have the same subject and public key as IdenTrust Commercial Root CA 1 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not IdenTrust Commercial Root CA 1, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| DST Root CA X3 | IdenTrust Services, LLC | 2021-09-29 | Revoked | 91B18588225035BB2F231FEF7695E497B289934B65CB87CFC2212271EBECB58C |
| DST Root CA X3 | IdenTrust Services, LLC | 2024-09-30 | Expired | 1766FE28F034150CDB62B4469531E4D76FBF3A1EC9684CAB3767C3021AB67E50 |

## What happens when it expires

IdenTrust Commercial Root CA 1 is valid until 2034-01-16, about 7.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is IdenTrust Commercial Root CA 1 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does IdenTrust Commercial Root CA 1 expire?**

On 2034-01-16, about 7.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has IdenTrust Commercial Root CA 1 issued?**

The CCADB lists 34: 7 valid, 2 expired and 25 revoked. The newest valid one is IdenTrust Commercial Root TLS ECC CA 2, valid until 2029-09-06.

**Is IdenTrust Commercial Root CA 1 cross-signed?**

Yes. The CCADB has 2 cross-certificate(s) with its subject and key, signed by DST Root CA X3; 0 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).