# ISRG Root X1 root certificate (Let's Encrypt)

> ISRG Root X1 is a root CA certificate operated by Let's Encrypt (RSA 4096, valid until 2035-06-04, SHA-256 96BCEC06). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/lets-encrypt-isrg-root-x1/
Last updated: 2026-11-10

ISRG Root X1 is a root CA certificate operated by Let's Encrypt (RSA 4096, valid until 2035-06-04, SHA-256 96BCEC06). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Let's Encrypt |
| Subject | CN=ISRG Root X1,O=Internet Security Research Group,C=US |
| SHA-256 | 96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6 |
| SPKI SHA-256 | 0B9FA5A59EED715C26C1020C711B4F6EC42D58B0015E14337A39DAD301C5AFC3 |
| Valid from | 2015-06-04 |
| Expires | 2035-06-04 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 8210CFB0D240E3594463E0BB63828B00 |
| SHA-1 (Windows thumbprint) | CABD2A79A1076A31F21D253635CB039D4329A5E8 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.26 / Firefox 50; Inclusion bug: #1204656 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth; Allowed policies: Server Authentication, Client Authentication, Code Signing, Timestamp Signing |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication |

The CCADB lists no EV policy OID for ISRG Root X1.

## Intermediate CAs issued by this root

The CCADB lists 21 intermediate CA certificates signed directly by ISRG Root X1: 12 currently valid, 7 expired and 2 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| ISRG Root X2 | Internet Security Research Group | 2032-09-02 | Valid | EE5F7ABD6981BB0255632CD8F49283451B4B18844D12040B44EE00F07B8FE2C6 |
| Root YR | Internet Security Research Group | 2032-09-02 | Valid | 072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76 |
| E9 | Internet Security Research Group | 2027-03-12 | Valid | FDE88F2D4F8913D3DC1664D5F8DE51E07FE2ABFED93B45ACAD5A29BFEBAA23FB |
| R13 | Internet Security Research Group | 2027-03-12 | Valid | D3B128216A843F8EF1321501F5DF52A5DF52939EE2C19297712CD3DE4D419354 |
| E7 | Internet Security Research Group | 2027-03-12 | Valid | AEB1FD7410E83BC96F5DA3C6A7C2C1BB836D1FA5CB86E708515890E428A8770B |
| R10 | Internet Security Research Group | 2027-03-12 | Valid | 9D7C3F1AA6AD2B2EC0D5CF1E246F8D9AE6CBC9FD0755AD37BB974B1F2FB603F3 |
| E8 | Internet Security Research Group | 2027-03-12 | Valid | 83624FD338C8D9B023C18A67CB7A9C0519DA43D11775B4C6CBDAD45C3D997C52 |
| E6 | Internet Security Research Group | 2027-03-12 | Valid | 76E9E288AAFC0E37F4390CBF946AAD997D5C1C901B3CE513D3D8FADBABE2AB85 |
| E5 | Internet Security Research Group | 2027-03-12 | Valid | 5DFDB3CF31B26F23D87C09F3A0CEF642F64069A9FB7CFE29270BB5DC0F1E16BB |
| R11 | Internet Security Research Group | 2027-03-12 | Valid | 591E9CE6C863D3A079E9FABE1478C7339A26B21269DDE795211361024AE31A44 |
| R14 | Internet Security Research Group | 2027-03-12 | Valid | 24D45AA9B8D6053D281F3842C8CC0C6C1AF7CCDFD42DD5C12F6A74FA9323F7A2 |
| R12 | Internet Security Research Group | 2027-03-12 | Valid | 131FCE7784016899A5A00203A9EFC80F18EBBD75580717EDC1553580930836EC |
| ISRG Root X2 | Internet Security Research Group | 2025-09-15 | Expired | 8B05B68CC659E5ED0FCB38F2C942FBFD200E6F2FF9F85D63C6994EF5E0B02701 |
| R3 | Internet Security Research Group | 2025-09-15 | Expired | 67ADD1166B020AE61B8F5FC96813C04C2AA589960796865572A3C7E737613DFD |
| R4 | Internet Security Research Group | 2025-09-15 | Expired | 1A07529A8B3F01D231DFAD2ABDF71899200BB65CD7E03C59FA82272533355B74 |
| Let's Encrypt Authority X3 | Internet Security Research Group | 2021-10-06 | Expired | 731D3D9CFAA061487A1D71445A42F67DF0AFCA2A6C2D2F98FF7B3CE112B1F568 |
| Let's Encrypt Authority X4 | Internet Security Research Group | 2021-10-06 | Expired | 5DE9152BED31FA0515DD1FC746133F1327562EF72A84CF2D2403E748A604D0D4 |
| Let's Encrypt Authority X2 | Internet Security Research Group | 2020-06-04 | Expired | E4EB54A7FFA552EF64D8E1AE338B69BE909C29E6AF57170A2F6F44DF225E5A14 |
| Let's Encrypt Authority X1 | Internet Security Research Group | 2020-06-04 | Expired | BDEE0D7C8F9C278F14EA9B6A4F90ED665A9F56DB0A56B1CDDA6765912F398A5E |
| Root YR | Internet Security Research Group | 2032-09-02 | Revoked | 270C64B6BA1AAE94B0756E83D8DB0732F5B534BCDC545D44E334D5DD4D10FEC0 |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as ISRG Root X1 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not ISRG Root X1, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| DST Root CA X3 | IdenTrust Services, LLC | 2024-09-30 | Expired | 6D99FB265EB1C5B3744765FCBC648F3CD8E1BFFAFDC4C2F99B9D47CF7FF1C24F |

## What happens when it expires

ISRG Root X1 is valid until 2035-06-04, about 8.6 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is ISRG Root X1 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does ISRG Root X1 expire?**

On 2035-06-04, about 8.6 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has ISRG Root X1 issued?**

The CCADB lists 21: 12 valid, 7 expired and 2 revoked. The newest valid one is ISRG Root X2, valid until 2032-09-02.

**Is ISRG Root X1 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by DST Root CA X3; 0 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).