# Autoridade Certificadora Raiz Brasileira v10 root certificate (ITI (Brazil))

> Autoridade Certificadora Raiz Brasileira v10 is a root CA certificate operated by ITI (Brazil) (RSA 4096, valid until 2032-07-01, SHA-256 6E0BFF06). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

Source: https://ssl.sh/roots/iti-brazil-autoridade-certificadora-raiz-brasileira-v10/
Last updated: 2026-11-10

Autoridade Certificadora Raiz Brasileira v10 is a root CA certificate operated by ITI (Brazil) (RSA 4096, valid until 2032-07-01, SHA-256 6E0BFF06). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

| Field | Value |
|---|---|
| CA owner | ITI (Brazil) |
| Subject | CN=Autoridade Certificadora Raiz Brasileira v10,OU=Instituto Nacional de Tecnologia da Informacao - ITI,O=ICP-Brasil,C=BR |
| SHA-256 | 6E0BFF069A26994C15DE2C4888CC54AF84882E5495B7FBF66BE9CCFFEC7489F6 |
| SPKI SHA-256 | 96352D0AD875C027DB82D599BAA8D42E5C472649981ECEED3BFC65F4C81FD5C1 |
| Valid from | 2019-07-01 |
| Expires | 2032-07-01 |
| Key | RSA 4096 |
| Signature algorithm | sha512WithRSAEncryption |
| Serial number | D2D58B44BF819342 |
| SHA-1 (Windows thumbprint) | 6C155ED7271A904A0DC040F0C857FF53BF6DB290 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Not included | No | - | - |
| Mozilla | Not included | No | - | - |
| Apple | Not included | No | - | - |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Document Signing |

The CCADB lists no EV policy OID for Autoridade Certificadora Raiz Brasileira v10.

## Intermediate CAs issued by this root

The CCADB lists 5 intermediate CA certificates signed directly by Autoridade Certificadora Raiz Brasileira v10: 5 currently valid, 0 expired and 0 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| AC SERASA SSL EV V2 | AC Serasa SSL EV | 2032-07-01 | Valid | 95E0F89A8E0E12E3E41D6D5AAB4472D7321C2EBCD9290E78D61697CDF5D43D66 |
| AC Certisign ICP-Brasil SSL G2 | AC Certisign | 2032-07-01 | Valid | 55A489F60F785BEBE042E99A69AC8EC33C9F17374CC4B766F604CF7079EA09BA |
| AC SOLUTI SSL EV | AC SOLUTI SSL EV | 2032-07-01 | Valid | 169CBF0547F3DFC4E63E4AF9E0255A76037778FF5B8F4A536ABDFF3A91DFC3C5 |
| AC VALID SSL EV | AC VALID SSL EV | 2032-07-01 | Valid | AD960D6A51AF58E1EC09EE05E6DF827A7718379CABF0A5529DE4B01C122908C0 |
| Autoridade Certificadora do SERPRO SSLv1 | Autoridade Certificadora do SERPRO SSLv1 | 2032-07-01 | Valid | 08FC942D5176E568ACBEF9C595F36A20DE6ACF9EA30C6F5FCEDD48216ED5B070 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as Autoridade Certificadora Raiz Brasileira v10 with a different issuer, so a client has to carry Autoridade Certificadora Raiz Brasileira v10 itself in its root store to trust it.


## What happens when it expires

Autoridade Certificadora Raiz Brasileira v10 is valid until 2032-07-01, about 5.6 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Autoridade Certificadora Raiz Brasileira v10 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Microsoft trust it for TLS server authentication; Chrome, Mozilla, Apple do not.

**When does Autoridade Certificadora Raiz Brasileira v10 expire?**

On 2032-07-01, about 5.6 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Autoridade Certificadora Raiz Brasileira v10 issued?**

The CCADB lists 5: 5 valid, 0 expired and 0 revoked. The newest valid one is AC SERASA SSL EV V2, valid until 2032-07-01.

**Is Autoridade Certificadora Raiz Brasileira v10 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).