# Izenpe.com root certificate (Izenpe S.A.)

> Izenpe.com is a root CA certificate operated by Izenpe S.A. (RSA 4096, valid until 2037-12-13, SHA-256 2530CC8E). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/izenpe-com/
Last updated: 2026-11-10

Izenpe.com is a root CA certificate operated by Izenpe S.A. (RSA 4096, valid until 2037-12-13, SHA-256 2530CC8E). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Izenpe S.A. |
| Subject | CN=Izenpe.com,O=IZENPE S.A.,C=ES |
| SHA-256 | 2530CC8E98321502BAD96F9B1FBA1B099E2D299E0F4548BB914F363BC0D4531F |
| SPKI SHA-256 | 952C2039C0243EB515DD73D83FC3643184874FEB0862A9837731ED9B4742E17A |
| Valid from | 2007-12-13 |
| Expires | 2037-12-13 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | B0B75A16485FBFE1CBF58BD719E67D |
| SHA-1 (Windows thumbprint) | 2F783D255218A74A653971B52CA29C45156FE919 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2026-04-14 | - |
| Mozilla | Included | Yes | 2026-04-15 | Trust bits: Websites; EV policy OIDs: 1.3.6.1.4.1.14777.6.1.1, 1.3.6.1.4.1.14777.6.1.2; First included in: NSS 3.12.9 / Firefox 4.0; Inclusion bug: #361957 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2026-04-14 (sct_not_after). Mozilla stops trusting TLS certificates from this root issued after 2026-04-15. Mozilla treats it as an EV root for policy OID 1.3.6.1.4.1.14777.6.1.1, 1.3.6.1.4.1.14777.6.1.2.

## Intermediate CAs issued by this root

The CCADB lists 17 intermediate CA certificates signed directly by Izenpe.com: 6 currently valid, 3 expired and 8 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| CA de Certificados SSL EV | Izenpe S.A. | 2028-07-06 | Valid | DB476339CCBFCC9E4BD1D6CB606CA27F00679E1EF8A581E7236309B9D63FFE37 |
| EAEko Herri Administrazioen CA - CA AAPP Vascas (2) | Izenpe S.A. | 2037-12-12 | Valid | CD6EB937EE17A9FCFF60A790F8BDE0CA9ABCA07B3EF46074DD1978F0BCA4D449 |
| Herritar eta Erakundeen CA - CA de Ciudadanos y Entidades (4) | Izenpe S.A. | 2037-12-12 | Valid | 7ED19361AD734D703FBADF029F52EC3B6648D8DD56BABA0884ED4F859B5B9375 |
| Herritar eta Erakundeen CA - CA de Ciudadanos y Entidades (3) | Izenpe S.A. | 2037-12-12 | Valid | 5A49B15AE60FF627DA272A8743D67162BACA1096168203213ACF8227AF4C4942 |
| CA Teknikoa - CA Tecnica | Izenpe S.A. | 2037-12-12 | Valid | 337C625377592F1DFCC6E65631C605EB8B96E00C146B437FC1F067268154E959 |
| EAEko HAetako langileen CA - CA personal de AAPP vascas (2) | Izenpe S.A. | 2037-12-12 | Valid | 25303CFD0BF1BAA1EF248C29F073FFFC2E7C81582EE23B45C7F1C3B32E341AD8 |
| CA de Certificados SSL EV | Izenpe S.A. | 2020-10-20 | Expired | B08C196A2ED1E84F9892DB1B61219CEB642882478F39B08719603D0735FA03D1 |
| Eusko Jaurlaritzako langileen CA - CA personal Gobierno Vasco | Izenpe S.A. | 2020-02-11 | Expired | FAEEC9860A3C472B589A301393FC3C314F6792D31351A78AD3B80639DC2B235C |
| CA de Certificados SSL EV | Izenpe S.A. | 2018-11-19 | Expired | 02F0F0FD1E95535AEF3DF4747C7321DEA376F5263F21EB0AC9B8FAFC68332F20 |
| CA de Certificados SSL EV | Izenpe S.A. | 2020-10-20 | Revoked | C6252EC013C79390153F2BAD7A9D12A4FE16C96B43A58F30430EE5F7ACF52B81 |
| Eusko Jaurlaritzako langileen CA - CA personal Gobierno Vasco | Izenpe S.A. | 2020-02-11 | Revoked | 0BC36A9B6E42DDBF074CFE38834F200CD44C1D28E23529CFE629BC484B9898B9 |
| EAEko Herri Administrazioen CA - CA AAPP Vascas (2) | Izenpe S.A. | 2037-12-12 | Revoked | D1BA58DEC4A4643BCD0A1111872474EC7928041BFAC7B53D24972BECFA2B871A |
| Herritar eta Erakundeen CA - CA de Ciudadanos y Entidades (4) | Izenpe S.A. | 2037-12-12 | Revoked | 2626B19563BC78D9B1442B93CE98D14A1E4B74264ACC90222F1F3C2385C27337 |
| EAEko HAetako langileen CA - CA personal de AAPP vascas (2) | Izenpe S.A. | 2037-12-12 | Revoked | 1F11A6555CC6F24D43E6E4E30EE804D41645847B7FD1565A191863345C4E256F |
| CA Teknikoa - CA Tecnica | Izenpe S.A. | 2037-12-12 | Revoked | DA95618B648BEB7C6437008BBBCE81D7B1A73FE6EE7C9617A67FA3FFCCBD5368 |
| Herritar eta Erakundeen CA - CA de Ciudadanos y Entidades (3) | Izenpe S.A. | 2037-12-12 | Revoked | 60592873D28AFEB801C613F0B721D2152FD2636959382A6330E7FE2672B0E45E |
| Izenpe.com | Izenpe S.A. | 2037-12-13 | Revoked | 23804203CA45D8CDE716B8C13BF3B448457FA06CC10250997FA01458317C41E5 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as Izenpe.com with a different issuer, so a client has to carry Izenpe.com itself in its root store to trust it.


## What happens when it expires

Izenpe.com is valid until 2037-12-13, about 11.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2026-04-14, Mozilla 2026-04-15.

## FAQ

**Is Izenpe.com trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2026-04-14, Mozilla 2026-04-15.

**When does Izenpe.com expire?**

On 2037-12-13, about 11.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Izenpe.com issued?**

The CCADB lists 17: 6 valid, 3 expired and 8 revoked. The newest valid one is CA de Certificados SSL EV, valid until 2028-07-06.

**Is Izenpe.com cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).