# vTrus ECC Root CA root certificate (iTrusChina Co., Ltd.)

> vTrus ECC Root CA is a root CA certificate operated by iTrusChina Co., Ltd. (ECDSA P-384, valid until 2043-07-31, SHA-256 30FBBA2C). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Chrome, Mozilla.

Source: https://ssl.sh/roots/itruschina-vtrus-ecc-root-ca/
Last updated: 2026-11-10

vTrus ECC Root CA is a root CA certificate operated by iTrusChina Co., Ltd. (ECDSA P-384, valid until 2043-07-31, SHA-256 30FBBA2C). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Chrome, Mozilla.

| Field | Value |
|---|---|
| CA owner | iTrusChina Co., Ltd. |
| Subject | CN=vTrus ECC Root CA,O=iTrusChina Co.\,Ltd.,C=CN |
| SHA-256 | 30FBBA2C32238E2A98547AF97931E550428B9B3F1C8EEB6633DCFA86C5B27DD3 |
| SPKI SHA-256 | A246B822F96CFECC155156E5476957845492ACF32187EC8A2EF12D89618D711D |
| Valid from | 2018-07-31 |
| Expires | 2043-07-31 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | 6E6ABC59AA53BE983967A2D26BA43BE66D1CD6DA |
| SHA-1 (Windows thumbprint) | F69CDBB0FCF60213B65232A6A3913F1670DAC3E1 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2027-01-14 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: NSS 3.74 / Firefox 97; Inclusion bug: #1554846 |
| Apple | Not included | No | - | - |
| Microsoft | Not included | No | - | - |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2027-01-14 (sct_not_after). Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 8 intermediate CA certificates signed directly by vTrus ECC Root CA: 3 currently valid, 0 expired and 5 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| vTrus ECC DV SSL CA | iTrusChina Co., Ltd. | 2035-09-14 | Valid | D66D9BF522907D5DC8296582CB9745908E460009792F3EB9AFEC2D71ADF357A1 |
| vTrus ECC OV SSL CA | iTrusChina Co., Ltd. | 2035-09-14 | Valid | D31FC18643699E258A7E10924B1B19F02FF107FBD4C092F3F74F8DCDC7B99CC0 |
| vTrus ECC EV SSL CA | iTrusChina Co., Ltd. | 2035-09-14 | Valid | 64E6D958EEE44AFD0FE8C4AB93DA50DA536BA7EB426D2D8627BCB64A183D7493 |
| vTrus ECC DV SSL CA | iTrusChina Co., Ltd. | 2033-12-10 | Revoked | 4D391FC790BD702CAD3CCBC0B025C5CDD88C6FDF274DCF5FBD3F027A80C2C7E5 |
| vTrus ECC OV SSL CA | iTrusChina Co., Ltd. | 2033-12-10 | Revoked | 42E46C4487459128517649731457B6AE20099D541BD182C5497B2E67E6FFD0F6 |
| vTrus ECC DV SSL CA | iTrusChina Co., Ltd. | 2038-07-31 | Revoked | C97E36CEBF1580AB1BDAD61C1D53B05C75819E85D937214BE684C859B22D45E0 |
| vTrus ECC EV SSL CA | iTrusChina Co., Ltd. | 2038-07-31 | Revoked | BD30C0D1E7ACB83EFC4F5F6C62F8F3A579BAB27527AFAE666C696C3A867175F1 |
| vTrus ECC OV SSL CA | iTrusChina Co., Ltd. | 2038-07-31 | Revoked | 23581EF1921DF2F9290DBA0D4D4F48A97F98AEAEFB5E3350B3F70582E8CDBE78 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as vTrus ECC Root CA with a different issuer, so a client has to carry vTrus ECC Root CA itself in its root store to trust it.


## What happens when it expires

vTrus ECC Root CA is valid until 2043-07-31, about 16.7 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2027-01-14.

## FAQ

**Is vTrus ECC Root CA trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Chrome, Mozilla trust it for TLS server authentication; Apple, Microsoft do not. Distrust-after dates already set: Chrome 2027-01-14.

**When does vTrus ECC Root CA expire?**

On 2043-07-31, about 16.7 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has vTrus ECC Root CA issued?**

The CCADB lists 8: 3 valid, 0 expired and 5 revoked. The newest valid one is vTrus ECC DV SSL CA, valid until 2035-09-14.

**Is vTrus ECC Root CA cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).