# e-Szigno Root CA 2017 root certificate (Microsec Ltd.)

> e-Szigno Root CA 2017 is a root CA certificate operated by Microsec Ltd. (ECDSA P-256, valid until 2042-08-22, SHA-256 BEB00B30). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Mozilla, Microsoft.

Source: https://ssl.sh/roots/microsec-e-szigno-root-ca-2017/
Last updated: 2026-11-10

e-Szigno Root CA 2017 is a root CA certificate operated by Microsec Ltd. (ECDSA P-256, valid until 2042-08-22, SHA-256 BEB00B30). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Mozilla, Microsoft.

| Field | Value |
|---|---|
| CA owner | Microsec Ltd. |
| Subject | CN=e-Szigno Root CA 2017,2.5.4.97=VATHU-23584497,O=Microsec Ltd.,L=Budapest,C=HU |
| SHA-256 | BEB00B30839B9BC32C32E4447905950641F26421B15ED089198B518AE2EA1B99 |
| SPKI SHA-256 | 42431627EA76CC78697F915E3455B1B2EC82FF2F6380EE6423EF3C0840B7E631 |
| Valid from | 2017-08-22 |
| Expires | 2042-08-22 |
| Key | ECDSA P-256 |
| Signature algorithm | ecdsa-with-SHA256 |
| Serial number | 15448EF21FD97590DF5040A |
| SHA-1 (Windows thumbprint) | 89D483034F9E9A48805F7237D4A9A6EFCB7C1FD1 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2026-09-30 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.54 / Firefox 79; Inclusion bug: #1445364 |
| Apple | Not included | No | - | - |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Document Signing, Secure Email, Time Stamping |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2026-09-30 (sct_not_after). The CCADB lists no EV policy OID for e-Szigno Root CA 2017.

## Intermediate CAs issued by this root

The CCADB lists 23 intermediate CA certificates signed directly by e-Szigno Root CA 2017: 18 currently valid, 0 expired and 5 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| e-Szigno TSA CA 2026 | Microsec Ltd. | 2042-08-21 | Valid | 3097F6BA226A5CB3F7D38E40117C9C4E8E7704BC612F36EA00B1FAE661DB500C |
| e-Szigno Qualified SMIME CA 2023 | Microsec Ltd. | 2042-08-21 | Valid | A40938BABD88FF42144B611298E90B3426194099152C49EAA4A8A6EAF42D2DD2 |
| e-Szigno SMIME CA 2023 | Microsec Ltd. | 2042-08-21 | Valid | EDFB8A183C13D1B2530F8DE9BC5F0AAEBC7145DECA4FB5094A40B2F6A3987A7C |
| e-Szigno Class2 CodeSigning CA 2020 | Microsec Ltd. | 2042-08-22 | Valid | BA52633D91DFD48EE5B135B2543E8DD3557F2DB33C0534E41A2268097C3008CA |
| e-Szigno TSA CA 2020 | Microsec Ltd. | 2042-08-22 | Valid | B4C177E357565C99E90ED886D799F8C6BEFF806DA5A048551878489B9C27E488 |
| e-Szigno Class3 CodeSigning CA 2020 | Microsec Ltd. | 2042-08-22 | Valid | 711CBB0479DDC596745815E797423305F95EDD792C5BC5854CED5A7FAFB4AA8D |
| e-Szigno Qualified TLS CA 2018 | Microsec Ltd. | 2042-08-22 | Valid | 7DF800075F5203C017364E81195A9AC9FF00C507D64A70F737D8D3E8CB3F0845 |
| e-Szigno Class3 SSL CA 2017 | Microsec Ltd. | 2042-08-22 | Valid | BCBC18C463B61F3A033B10C74974ED8A2C328AFCD67A338D9871506A3515419F |
| e-Szigno TSA CA 2017 | Microsec Ltd. | 2042-08-22 | Valid | 9E94BB8ADAD7A6CE4DCB1208F1239DC1E43483F1B7E81F74A90A20FB5E5C49B7 |
| e-Szigno Online SSL CA 2017 | Microsec Ltd. | 2042-08-22 | Valid | 974B82076154CEFF56ED4DB562186F7394A02FF387AA205D6367A8B08FF7FAA0 |
| e-Szigno Pseudonymous CA 2017 | Microsec Ltd. | 2042-08-22 | Valid | 6A6F2FA13B2D9DBBB409802002D3370672760A2178D9B8D5694D660474231FA4 |
| e-Szigno Qualified QCP CA 2017 | Microsec Ltd. | 2042-08-22 | Valid | 6081BEE5B0DF191AC4E265AC0F6F7899F078B8C89F06055AE166AF91DF70D6E0 |
| e-Szigno Qualified CA 2017 | Microsec Ltd. | 2042-08-22 | Valid | 5ABE5818F6D02F05106C6C355540E1BE217C2354B535CF2507BF8515E1A6044A |
| e-Szigno Class3 CA 2017 | Microsec Ltd. | 2042-08-22 | Valid | 4F83842F1F04AB1E04D4D8E751666FCA82E5191CAFC24062BFD1FE77C02CA4B4 |
| e-Szigno Class2 CA 2017 | Microsec Ltd. | 2042-08-22 | Valid | 42DC827F46FB5E85DFFAE47D3C690F501ECE25D575D597A50D8F878FA42AFCEA |
| e-Szigno Class2 SSL CA 2017 | Microsec Ltd. | 2042-08-22 | Valid | 2A0E3F2A77A80DCBE5CD52D50D65076EBD37FAD531DB10D6A1385A557F7B725D |
| e-Szigno Qualified Pseudonymous CA 2017 | Microsec Ltd. | 2042-08-22 | Valid | 1648CE4AB1BB65C485CB2236C768FABB865147D426915B92AFBCA81E9B2EE3BC |
| e-Szigno Qualified Organization CA 2017 | Microsec Ltd. | 2042-08-22 | Valid | 12EA26F6EEEFEC76AB8592545403AB88515B00E275D9888713407A86FC5C7FD7 |
| e-Szigno Class2 CodeSigning CA 2017 | Microsec Ltd. | 2042-08-22 | Revoked | EEA77E4D1862BF41FCC0F9B562AD45A9F446D7C27380E09DD756F53903828CBE |
| e-Szigno Class3 CodeSigning CA 2017 | Microsec Ltd. | 2042-08-22 | Revoked | DDAB688031C1F96164812D49B513E538DAF1AAC84C10AB976BBE8C400B3F25A1 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as e-Szigno Root CA 2017 with a different issuer, so a client has to carry e-Szigno Root CA 2017 itself in its root store to trust it.


## What happens when it expires

e-Szigno Root CA 2017 is valid until 2042-08-22, about 15.8 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2026-09-30.

## FAQ

**Is e-Szigno Root CA 2017 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Chrome, Mozilla, Microsoft trust it for TLS server authentication; Apple do not. Distrust-after dates already set: Chrome 2026-09-30.

**When does e-Szigno Root CA 2017 expire?**

On 2042-08-22, about 15.8 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has e-Szigno Root CA 2017 issued?**

The CCADB lists 23: 18 valid, 0 expired and 5 revoked. The newest valid one is e-Szigno TSA CA 2026, valid until 2042-08-21.

**Is e-Szigno Root CA 2017 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).