Root certificate · Netrust Pte Ltd

Netrust Root CA 2

Netrust Root CA 2 is a root CA certificate operated by Netrust Pte Ltd (RSA 4096, valid until 2041-09-01, SHA-256 65353833). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

Data updated Nov 10, 2026

Root store status

Root store	Status	Trusted for TLS	Distrust for TLS after	Constrained
Chrome	Not included Not included	No	—	No
Mozilla	Not included Not included	No	—	No
Apple	Not included Not included	No	—	No
Microsoft	Included Included	Yes	—	Yes

The CCADB lists no EV policy OID for Netrust Root CA 2.

Not included Chrome

Status: Not included

Not included Mozilla

Status: Not included

Not included Apple

Status: Not included

Included Microsoft

Status: Included
Trusted EKUs: Server Authentication, Client Authentication, IP Security IKE Intermediate, IP Security Tunnel Termination, IP Security User, OCSP Signing, Secure Email, Time Stamping
Not-before cutoff: 2020-06-01 (OCSP Signing)

"Trusted for TLS" means the store includes the root with the server-authentication trust bit (Mozilla "Websites", Apple serverAuth, Microsoft Server Authentication EKU). Microsoft "NotBefore" means only certificates issued before a cutoff date are still trusted. "Constrained" means the store applies extra restrictions.

Details

CA owner: Netrust Pte Ltd
Subject: CN=Netrust Root CA 2,OU=Netrust Certificate Authority,O=Netrust Pte Ltd,C=SG
SHA-256: 65353833CF234C79562164F90849C0D104DBABF8EE41064D83E8CBE03BA1C5A5
SHA-1 (Windows thumbprint): 0AB5C3CD7448B86D711E77A549838B87CE525F7F
SPKI SHA-256: 3EE6B341402851B27E64021A3023AAC7C1A0D2DEF27D5BCE5C2DBEB0B22DCC71
Valid from: 2016-09-01
Expires: 2041-09-01
Key: RSA 4096
Signature algorithm: sha256WithRSAEncryption
Serial number: 57C7ECF4
Country: SG
Trust bits (CCADB): Server Authentication, Client Authentication, Secure Email, Time Stamping, IP Security Tunnel Termination, IP Security User, IP Security IKE Intermediate
EV policy OIDs (CCADB): not EV-enabled · TLS EV capable: No
Test websites: valid: https://activecert.netrust.net:8444/ · expired: https://expiredcert.netrust.net:8445/ · revoked: https://revokedcert.netrust.net:8443/
CCADB record: A004493
PEM: netrust-root-ca-2.pem

Look up this certificate on crt.sh

Intermediate CAs issued by this root

The CCADB lists 2 intermediate CA certificates signed directly by Netrust Root CA 2: 2 currently valid, 0 expired and 0 revoked (revoked includes those whose parent was revoked).

Showing 2 of 2: valid certificates first, newest first. Each name links to its crt.sh entry by SHA-256; an arrow marks a cross-certificate for another root on this site.

Intermediate	Operated by	Expires	Status
Netrust CA 2-2	Netrust Pte Ltd	2036-09-02	Valid
Netrust CA 2-1	Netrust Pte Ltd	2036-09-02	Valid

Cross-signed versions

No certificate in the CCADB has the same subject and public key as Netrust Root CA 2 with a different issuer, so a client has to carry Netrust Root CA 2 itself in its root store to trust it.

CRL and OCSP addresses

In the root certificate

Netrust Root CA 2 itself contains no CRL Distribution Points and no OCSP (Authority Information Access) extension. That is normal for a root: clients trust it directly and do not check its own revocation status.

Full CRL this CA publishes (CCADB)

http://crl.netrust.net/netrustca2.crl

Used by the intermediates it issued

Addresses found in the CRL Distribution Points and OCSP fields of the 2 valid intermediates signed by Netrust Root CA 2; the number in brackets is how many of them use each address.

CRL: http://crl.netrust.net/netrustca2.crl (2)

None of the valid intermediates under this root lists an OCSP responder.

What happens when it expires

Netrust Root CA 2 is valid until 2041-09-01, about 14.8 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

Check whether your device trusts it

Each platform keeps its own root store. The commands below look up Netrust Root CA 2 by common name (Netrust Root CA 2) or fingerprint. The store status in each heading comes from the CCADB snapshot; your device can differ if it is out of date or managed by an administrator.

macOS (Apple store: Not included)

Search the system roots keychain by common name. -Z prints the SHA-256 hash, which must match the fingerprint on the last line.

security find-certificate -a -c "Netrust Root CA 2" -Z \
  /System/Library/Keychains/SystemRootCertificates.keychain | grep "SHA-256"
# SHA-256 hash: 65353833CF234C79562164F90849C0D104DBABF8EE41064D83E8CBE03BA1C5A5

Windows (Microsoft store: Included · Trusted for TLS)

Windows identifies roots by SHA-1 thumbprint. It installs third-party roots on demand through Automatic Root Certificates Update, so "not found" can also mean the root has not been needed yet; certutil -generateSSTFromWU roots.sst downloads Microsoft's full list.

certutil -verifystore Root 0AB5C3CD7448B86D711E77A549838B87CE525F7F

Linux (ca-certificates follows Mozilla: Not included)

Debian, Ubuntu, Fedora and RHEL build their ca-certificates package from Mozilla's root store. Use trust list on p11-kit systems, or search the PEM bundle on Debian and Ubuntu.

# Fedora / RHEL / Arch (p11-kit)
trust list --filter=ca-anchors | grep -iF -A2 "Netrust Root CA 2"
# Debian / Ubuntu (ca-certificates)
openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt \
  | openssl pkcs7 -print_certs -noout | grep -iF "Netrust Root CA 2"

Java

Java ships its own cacerts keystore; JDK 9 and later accept -cacerts and the default store password is changeit. Search for the SHA-256 fingerprint in colon form.

keytool -list -cacerts -storepass changeit | grep -i "65:35:38:33:CF:23:4C:79:56:21:64:F9:08:49:C0:D1:04:DB:AB:F8:EE:41:06:4D:83:E8:CB:E0:3B:A1:C5:A5"

Android

Android's system store is maintained by Google separately from the four CCADB stores above. Open Settings → Security & privacy → More security settings → Encryption & credentials → Trusted credentials → System (menu names vary by vendor and version) and look for Netrust Pte Ltd → Netrust Root CA 2.

Which root does my site chain to?

List the chain your server sends and compare the last issuer with this root; the fingerprint check confirms a local copy.

Download PEM

# show subject (s:) and issuer (i:) of every certificate the server sends
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null \
  | grep -E '^ *[0-9]+ s:|^ *i:'
# subject and SHA-256 fingerprint of the downloaded PEM file
openssl x509 -in netrust-root-ca-2.pem -noout -subject -fingerprint -sha256
# sha256 Fingerprint=65:35:38:33:CF:23:4C:79:56:21:64:F9:08:49:C0:D1:04:DB:AB:F8:EE:41:06:4D:83:E8:CB:E0:3B:A1:C5:A5

FAQ

Is Netrust Root CA 2 trusted by Chrome, Firefox, Safari and Windows?

As of 2026-11-10, Microsoft trust it for TLS server authentication; Chrome, Mozilla, Apple do not.

When does Netrust Root CA 2 expire?

On 2041-09-01, about 14.8 years after the 2026-11-10 data snapshot.

How many intermediate certificates has Netrust Root CA 2 issued?

The CCADB lists 2: 2 valid, 0 expired and 0 revoked. The newest valid one is Netrust CA 2-2, valid until 2036-09-02.

Is Netrust Root CA 2 cross-signed?

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources

CCADB — Resources (TLS Server Authentication report, All Included Root Certificate Trust Bit Settings)
CCADB — All Certificate Information (root and intermediate), CSV V5
CCADB — Mozilla Included CA Certificate Report
CCADB — Chrome / Mozilla / Apple / Microsoft TLS Server Authentication CSV