# IdenTrust Commercial Root TLS RSA CA 2 root certificate (IdenTrust)

> IdenTrust Commercial Root TLS RSA CA 2 is a root CA certificate operated by IdenTrust (RSA 4096, valid until 2039-12-14, SHA-256 4C53D674). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

Source: https://ssl.sh/roots/identrust-commercial-root-tls-rsa-ca-2/
Last updated: 2026-11-10

IdenTrust Commercial Root TLS RSA CA 2 is a root CA certificate operated by IdenTrust (RSA 4096, valid until 2039-12-14, SHA-256 4C53D674). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

| Field | Value |
|---|---|
| CA owner | IdenTrust |
| Subject | CN=IdenTrust Commercial Root TLS RSA CA 2,O=IdenTrust,C=US |
| SHA-256 | 4C53D6746D9502530D235A82F9CF8382F5779D5DDDDBD373ABE1724FC1EFE796 |
| SPKI SHA-256 | 946065411C0539CB06F2E56133B9F875D6F19C7F01C2B395DA248B90CC6D8E23 |
| Valid from | 2024-12-17 |
| Expires | 2039-12-14 |
| Key | RSA 4096 |
| Signature algorithm | sha384WithRSAEncryption |
| Serial number | 400193D667FEF15638F11B7B688C5559 |
| SHA-1 (Windows thumbprint) | 32BCB1C3A9687BBDF2003F7FBB3BC490381C4823 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Not included | No | - | - |
| Mozilla | Not included | No | - | - |
| Apple | Not included | No | - | - |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication |

The CCADB lists no EV policy OID for IdenTrust Commercial Root TLS RSA CA 2.

## Intermediate CAs issued by this root

The CCADB lists 2 intermediate CA certificates signed directly by IdenTrust Commercial Root TLS RSA CA 2: 1 currently valid, 0 expired and 1 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| TrustID RSA Server CA 2 | IdenTrust Services, LLC | 2032-07-28 | Valid | 915D668811D195CC7C9614DC3F828DF3B291B35E610ABB2E6B4493862F4DE379 |
| ZeroSSL TLS RSA DV CA 1 | IdenTrust Services, LLC | 2029-10-20 | Revoked | C3E60E6663307B7789141C49E0FDEDFCB3698BDDA9A5D0E1DD5070E302A8BA1C |

## Cross-signed versions

2 certificate(s) in the CCADB have the same subject and public key as IdenTrust Commercial Root TLS RSA CA 2 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not IdenTrust Commercial Root TLS RSA CA 2, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| IdenTrust Commercial Root CA 1 | IdenTrust Services, LLC | 2029-07-29 | Valid | 30DCF2598D8A910FA027A75B3F0DF6284A7B5B73152BF54FC5A95D01FFF0FDE2 |
| IdenTrust Commercial Root CA 1 | IdenTrust Services, LLC | 2029-01-25 | Revoked | 8F421B843521876963F1A099F28815CBD79DD1D2C7E414682A9AA8E0E7260E41 |

## What happens when it expires

IdenTrust Commercial Root TLS RSA CA 2 is valid until 2039-12-14, about 13.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is IdenTrust Commercial Root TLS RSA CA 2 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Microsoft trust it for TLS server authentication; Chrome, Mozilla, Apple do not.

**When does IdenTrust Commercial Root TLS RSA CA 2 expire?**

On 2039-12-14, about 13.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has IdenTrust Commercial Root TLS RSA CA 2 issued?**

The CCADB lists 2: 1 valid, 0 expired and 1 revoked. The newest valid one is TrustID RSA Server CA 2, valid until 2032-07-28.

**Is IdenTrust Commercial Root TLS RSA CA 2 cross-signed?**

Yes. The CCADB has 2 cross-certificate(s) with its subject and key, signed by IdenTrust Commercial Root CA 1; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).