# OISTE Server Root ECC G1 root certificate (OISTE)

> OISTE Server Root ECC G1 is a root CA certificate operated by OISTE (ECDSA P-384, valid until 2048-05-24, SHA-256 EEC997C0). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Chrome, Mozilla.

Source: https://ssl.sh/roots/oiste-server-root-ecc-g1/
Last updated: 2026-11-10

OISTE Server Root ECC G1 is a root CA certificate operated by OISTE (ECDSA P-384, valid until 2048-05-24, SHA-256 EEC997C0). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Chrome, Mozilla.

| Field | Value |
|---|---|
| CA owner | OISTE |
| Subject | CN=OISTE Server Root ECC G1,O=OISTE Foundation,C=CH |
| SHA-256 | EEC997C0C30F216F7E3B8B307D2BAE42412D753FC8219DAFD1520B2572850F49 |
| SPKI SHA-256 | D439DD80F1E3BC5C9E5F13E8BFF7A8887DF9DC1C3E19D76AF70C8F8D985EEF22 |
| Valid from | 2023-05-31 |
| Expires | 2048-05-24 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | 23F9C3D635AF8F284B1FF054EA7E979D |
| SHA-1 (Windows thumbprint) | 3BF68B09AE2A927BBAE38D3F1195D9E6440C45E2 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: 3.117 / 145 |
| Apple | Not included | No | - | - |
| Microsoft | Not included | No | - | - |

Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 3 intermediate CA certificates signed directly by OISTE Server Root ECC G1: 3 currently valid, 0 expired and 0 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| TuringSign ECC Secure CA 3 | OISTE | 2029-02-24 | Valid | 7AF2B5644C9FD0D1E73F58047DCF0F5346C6551A84D61A49FBC64B595ACEC72F |
| WISeKey CertifyID Server ECC CA 2 | OISTE | 2029-02-24 | Valid | 4D9D5F52BBE26DB419698A4C7DDC268FBEF3A07915A712F0947FAAE96FB92E93 |
| WISeKey CertifyID Server ECC CA 1 | WISeKey | 2039-02-16 | Valid | 042FCAA086492C92FB02A82AC957489E5C61E47B6E9A6901BBB548A8AC88A380 |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as OISTE Server Root ECC G1 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not OISTE Server Root ECC G1, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| OISTE WISeKey Global Root GB CA | OISTE | 2039-12-01 | Valid | FB641643BA20B9638CEC998793140208E7770D87125DBF49ACA712EE1E516652 |

## What happens when it expires

OISTE Server Root ECC G1 is valid until 2048-05-24, about 21.5 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is OISTE Server Root ECC G1 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Chrome, Mozilla trust it for TLS server authentication; Apple, Microsoft do not.

**When does OISTE Server Root ECC G1 expire?**

On 2048-05-24, about 21.5 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has OISTE Server Root ECC G1 issued?**

The CCADB lists 3: 3 valid, 0 expired and 0 revoked. The newest valid one is TuringSign ECC Secure CA 3, valid until 2029-02-24.

**Is OISTE Server Root ECC G1 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by OISTE WISeKey Global Root GB CA; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).