# IdenTrust Commercial Root TLS ECC CA 2 root certificate (IdenTrust)

> IdenTrust Commercial Root TLS ECC CA 2 is a root CA certificate operated by IdenTrust (ECDSA P-521, valid until 2039-04-11, SHA-256 983D826B). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

Source: https://ssl.sh/roots/identrust-commercial-root-tls-ecc-ca-2/
Last updated: 2026-11-10

IdenTrust Commercial Root TLS ECC CA 2 is a root CA certificate operated by IdenTrust (ECDSA P-521, valid until 2039-04-11, SHA-256 983D826B). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

| Field | Value |
|---|---|
| CA owner | IdenTrust |
| Subject | CN=IdenTrust Commercial Root TLS ECC CA 2,O=IdenTrust,C=US |
| SHA-256 | 983D826BA9C87F653FF9E8384C5413E1D59ACF19DDC9C98CECAE5FDEA2AC229C |
| SPKI SHA-256 | BAEE4F07E312F4BDFF7DF07F3EE4C6E80F968EC4ED4DA179DAAAA3ADC1C55D15 |
| Valid from | 2024-04-11 |
| Expires | 2039-04-11 |
| Key | ECDSA P-521 |
| Signature algorithm | ecdsa-with-SHA512 |
| Serial number | 40018ECF000DE911D7447B73E4C1F82E |
| SHA-1 (Windows thumbprint) | DA1310A3C0A704508A22AC4215B6C4FF19DCAA78 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Not included | No | - | - |
| Mozilla | Not included | No | - | - |
| Apple | Not included | No | - | - |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication |

The CCADB lists no EV policy OID for IdenTrust Commercial Root TLS ECC CA 2.

## Intermediate CAs issued by this root

The CCADB lists 2 intermediate CA certificates signed directly by IdenTrust Commercial Root TLS ECC CA 2: 1 currently valid, 0 expired and 1 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| TrustID ECC Server CA 1 | IdenTrust Services, LLC | 2032-06-21 | Valid | E3C8552F6B39366B5AAEDB7608A73E3FD68D100C1309CB15718143EA8683F254 |
| ZeroSSL TLS ECC DV CA 1 | IdenTrust Services, LLC | 2029-10-20 | Revoked | E0C0F6CB9AC949BABB2B170427CA5A0C51BAAB982A7F269B5E387F82076A6847 |

## Cross-signed versions

2 certificate(s) in the CCADB have the same subject and public key as IdenTrust Commercial Root TLS ECC CA 2 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not IdenTrust Commercial Root TLS ECC CA 2, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| IdenTrust Commercial Root CA 1 | IdenTrust Services, LLC | 2029-09-06 | Valid | CEFB479638BF1E4D10D3303ECD29E18A63451B782826C13B803DF23C5156B41F |
| IdenTrust Commercial Root CA 1 | IdenTrust Services, LLC | 2029-02-02 | Revoked | 1CA8C3285540354E57B49A3D5EDF540FBB3218F95F8D07636507AD6BB1DBDC0A |

## What happens when it expires

IdenTrust Commercial Root TLS ECC CA 2 is valid until 2039-04-11, about 12.4 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is IdenTrust Commercial Root TLS ECC CA 2 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Microsoft trust it for TLS server authentication; Chrome, Mozilla, Apple do not.

**When does IdenTrust Commercial Root TLS ECC CA 2 expire?**

On 2039-04-11, about 12.4 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has IdenTrust Commercial Root TLS ECC CA 2 issued?**

The CCADB lists 2: 1 valid, 0 expired and 1 revoked. The newest valid one is TrustID ECC Server CA 1, valid until 2032-06-21.

**Is IdenTrust Commercial Root TLS ECC CA 2 cross-signed?**

Yes. The CCADB has 2 cross-certificate(s) with its subject and key, signed by IdenTrust Commercial Root CA 1; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).