# ISRG Root X2 root certificate (Let's Encrypt)

> ISRG Root X2 is a root CA certificate operated by Let's Encrypt (ECDSA P-384, valid until 2040-09-17, SHA-256 69729B8E). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/lets-encrypt-isrg-root-x2/
Last updated: 2026-11-10

ISRG Root X2 is a root CA certificate operated by Let's Encrypt (ECDSA P-384, valid until 2040-09-17, SHA-256 69729B8E). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Let's Encrypt |
| Subject | CN=ISRG Root X2,O=Internet Security Research Group,C=US |
| SHA-256 | 69729B8E15A86EFC177A57AFB7171DFC64ADD28C2FCA8CF1507E34453CCB1470 |
| SPKI SHA-256 | 762195C225586EE6C0237456E2107DC54F1EFC21F61A792EBD515913CCE68332 |
| Valid from | 2020-09-04 |
| Expires | 2040-09-17 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | 41D29DD172EAEEA780C12C6CE92F8752 |
| SHA-1 (Windows thumbprint) | BDB1B93CD5978D45C6261455F8DB95C75AD153AF |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.74 / Firefox 97; Inclusion bug: #1701317 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth; Allowed policies: Server Authentication, Client Authentication, Code Signing, Timestamp Signing |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication |

The CCADB lists no EV policy OID for ISRG Root X2.

## Intermediate CAs issued by this root

The CCADB lists 9 intermediate CA certificates signed directly by ISRG Root X2: 6 currently valid, 2 expired and 1 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Root YE | Internet Security Research Group | 2032-09-02 | Valid | 0FC0901CCA2BAE9E9FDBB02D50D02F1094F7B36672086991B9E897626DC485F0 |
| E5 | Internet Security Research Group | 2027-03-12 | Valid | E788D14B0436B5120BBEE3F15C15BADF08C1407FE72568A4F16F9151C380E1E3 |
| E8 | Internet Security Research Group | 2027-03-12 | Valid | AC1274542267F17B525535B5563BF731FEBB182533B46A82DC869CB64EB528C0 |
| E7 | Internet Security Research Group | 2027-03-12 | Valid | 54715420224C5B65BEED018DC3940D7338C577E322D5488F633D8C6A8FED61B2 |
| E9 | Internet Security Research Group | 2027-03-12 | Valid | 4185DF97806C2BA76F1D79823F112FFA639A49CCDC990908102067AB6412B886 |
| E6 | Internet Security Research Group | 2027-03-12 | Valid | 065AB7D2A050F947587121765D8D070C0E1330D5798FAA42C2072749ED293762 |
| E2 | Internet Security Research Group | 2025-09-15 | Expired | BACDE0463053CE1D62F8BE74370BBAE79D4FCAF19FC07643AEF195E6A59BD578 |
| E1 | Internet Security Research Group | 2025-09-15 | Expired | 46494E30379059DF18BE52124305E606FC59070E5B21076CE113954B60517CDA |
| Root YE | Internet Security Research Group | 2032-09-02 | Revoked | 2D7B5B429F80C0F0A032A0051F696A0F8D0B98980E71F6F244EAC6367BC4C917 |

## Cross-signed versions

3 certificate(s) in the CCADB have the same subject and public key as ISRG Root X2 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not ISRG Root X2, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| ISRG Root X1 | Internet Security Research Group | 2032-09-02 | Valid | EE5F7ABD6981BB0255632CD8F49283451B4B18844D12040B44EE00F07B8FE2C6 |
| ISRG Root X1 | Internet Security Research Group | 2025-09-15 | Expired | 8B05B68CC659E5ED0FCB38F2C942FBFD200E6F2FF9F85D63C6994EF5E0B02701 |
| ISRG Root X1 | Internet Security Research Group | 2032-09-02 | Revoked | 00BEAEF280277E38999D3C60B27736E8F21E782C3D4B444AC34D465A7AB287C5 |

## What happens when it expires

ISRG Root X2 is valid until 2040-09-17, about 13.9 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is ISRG Root X2 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does ISRG Root X2 expire?**

On 2040-09-17, about 13.9 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has ISRG Root X2 issued?**

The CCADB lists 9: 6 valid, 2 expired and 1 revoked. The newest valid one is Root YE, valid until 2032-09-02.

**Is ISRG Root X2 cross-signed?**

Yes. The CCADB has 3 cross-certificate(s) with its subject and key, signed by ISRG Root X1; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).