# IdenTrust Public Sector Root CA 1 root certificate (IdenTrust)

> IdenTrust Public Sector Root CA 1 is a root CA certificate operated by IdenTrust (RSA 4096, valid until 2034-01-16, SHA-256 30D0895A). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/identrust-public-sector-root-ca-1/
Last updated: 2026-11-10

IdenTrust Public Sector Root CA 1 is a root CA certificate operated by IdenTrust (RSA 4096, valid until 2034-01-16, SHA-256 30D0895A). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | IdenTrust |
| Subject | CN=IdenTrust Public Sector Root CA 1,O=IdenTrust,C=US |
| SHA-256 | 30D0895A9A448A262091635522D1F52010B5867ACAE12C78EF958FD4F4389F2F |
| SPKI SHA-256 | 58DD61FEB36EA7D258724371709149CB121337864CACB2D0999AD20739D06477 |
| Valid from | 2014-01-16 |
| Expires | 2034-01-16 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | A0142800000014523CF467C00000002 |
| SHA-1 (Windows thumbprint) | BA29416077983FF4F3EFF231053B2EEA6D4D45FD |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.18 / Firefox 38; Inclusion bug: #1037590 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Document Signing, Encrypting File System, Secure Email, Time Stamping; Not-before cutoff: 2020-08-01 (Encrypting File System) |

The CCADB lists no EV policy OID for IdenTrust Public Sector Root CA 1.

## Intermediate CAs issued by this root

The CCADB lists 18 intermediate CA certificates signed directly by IdenTrust Public Sector Root CA 1: 9 currently valid, 1 expired and 8 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| IdenTrust Commercial Root Client-Auth ECC CA 2 | IdenTrust Services, LLC | 2029-06-10 | Valid | 96F2E2EB5964AAEAFC50F66CD4E3A45912E1C78B81C1E51C34E6F2681B3D48CA |
| IdenTrust Commercial Root SMIME RSA CA 2 | IdenTrust Services, LLC | 2029-06-10 | Valid | 82578FCC5643F5E630E6FCE4675A3ED26209B2D373417E41CBF12B3052B1098F |
| IdenTrust Commercial Root SMIME ECC CA 2 | IdenTrust Services, LLC | 2029-06-10 | Valid | 6C2AAFC16F94C3F8C1B3E6325028F203CCA5CE6679DADAD91E5047FB9F59C849 |
| IdenTrust Commercial Root Client-Auth RSA CA 2 | IdenTrust Services, LLC | 2029-06-10 | Valid | 60F2AB77188DC4BF2217FE7C6EF33711EC4D764961813473C6766AA9E3FC02E4 |
| TrustID Timestamping CA 6 | IdenTrust Services, LLC | 2032-06-09 | Valid | 33543A2CB830CC879EC1FE9270607E329FF9AE120BA9D8FC2CDB5BFAFBD641B3 |
| TrustID SAIC Public Email Issuing CA 2 | IdenTrust Services, LLC | 2029-09-15 | Valid | 99451FBBDF460C77308EDC6D8E37A3B80D856C94FEC834C53D6A13EA4EB89F39 |
| TrustID CA A14 | IdenTrust Services, LLC | 2029-01-19 | Valid | D961E10E03A039C4BA4DB3D5442166FED653074015F53D99CF345672E57482F5 |
| TrustID CA A13 | IdenTrust Services, LLC | 2028-01-08 | Valid | B46D3890E6F96851C9FBC9BE87F6C742297ADCC1EA0EC0E8BD714C007A019C2C |
| IdenTrust Public Sector Server CA 1 | IdenTrust Services, LLC | 2028-08-12 | Valid | 288B35466FB8E228B98832019E1A7956AC3E9F154280CC97486ECC8E2C9CABC1 |
| TrustID SAIC Public Email Issuing CA | IdenTrust Services, LLC | 2026-10-13 | Expired | AC5D9A4A7C7379E7BD0A075DCBDF4547333F48839267469E62673B56E688A583 |
| IdenTrust Commercial Root Client-Auth RSA CA 2 | IdenTrust Services, LLC | 2029-02-10 | Revoked | C003B8CB3F04CB680D9E27577D497E3C6FEBE3E2A400B7A92B09A5EB38C9FAC7 |
| IdenTrust Commercial Root Client-Auth ECC CA 2 | IdenTrust Services, LLC | 2029-02-10 | Revoked | 0833517BD6D7EE01217322CBA8733C11346887F0653404F24DED1F8E485C2B6B |
| IdenTrust Commercial Root SMIME RSA CA 2 | IdenTrust Services, LLC | 2029-01-25 | Revoked | BE6EEE3B377E6D2415D83B9D8CBE28056193501FA67BBE9357611D49285185FB |
| IdenTrust Commercial Root SMIME ECC CA 2 | IdenTrust Services, LLC | 2029-01-25 | Revoked | 25748C3AD820464275383E16D37B0ED026DD0EBB792D9C6F7EBC03E35FD3DBD6 |
| IdenTrust ACES CA 2 | IdenTrust Services, LLC | 2022-03-28 | Revoked | C5480D7BFF952D1BE86178FF713F11F51CF74232EE5676FC5A170D4A6A6FE50A |
| IdenTrust ACES CA 2 | IdenTrust Services, LLC | 2022-03-28 | Revoked | 9D1585E63B4D03D9ABBA0C67D46730BADF0FCEBC2081611CF7B9AA572D2D64A4 |
| IdenTrust ACES CA 2 | IdenTrust Services, LLC | 2022-03-20 | Revoked | A59740F91153C0FB1C1E37081CD7198E0BC28B58C1D561DB785CB82B4AD9DF47 |
| IdenTrust Public Sector Root CA 1 | IdenTrust Services, LLC | 2034-01-16 | Revoked | 0288BDDF4E4B7E487924E812B4E3F25D803CE35A780A4F1459CFA5CEF6D1D00B |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as IdenTrust Public Sector Root CA 1 with a different issuer, so a client has to carry IdenTrust Public Sector Root CA 1 itself in its root store to trust it.


## What happens when it expires

IdenTrust Public Sector Root CA 1 is valid until 2034-01-16, about 7.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is IdenTrust Public Sector Root CA 1 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Mozilla, Apple, Microsoft trust it for TLS server authentication; Chrome do not.

**When does IdenTrust Public Sector Root CA 1 expire?**

On 2034-01-16, about 7.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has IdenTrust Public Sector Root CA 1 issued?**

The CCADB lists 18: 9 valid, 1 expired and 8 revoked. The newest valid one is IdenTrust Commercial Root Client-Auth ECC CA 2, valid until 2029-06-10.

**Is IdenTrust Public Sector Root CA 1 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).