# OISTE WISeKey Global Root GB CA root certificate (OISTE)

> OISTE WISeKey Global Root GB CA is a root CA certificate operated by OISTE (RSA 2048, valid until 2039-12-01, SHA-256 6B9C08E8). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/oiste-wisekey-global-root-gb-ca/
Last updated: 2026-11-10

OISTE WISeKey Global Root GB CA is a root CA certificate operated by OISTE (RSA 2048, valid until 2039-12-01, SHA-256 6B9C08E8). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | OISTE |
| Subject | CN=OISTE WISeKey Global Root GB CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH |
| SHA-256 | 6B9C08E86EB0F767CFAD65CD98B62149E5494A67F5845E7BD1ED019F27B86BD6 |
| SPKI SHA-256 | 149F2EE63B9A5E5803240A770DC991FC2E3445E62831C245A49BC4F1F738FF9C |
| Valid from | 2014-12-01 |
| Expires | 2039-12-01 |
| Key | RSA 2048 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 76B1205274F0858746B3F8231AF6C2C0 |
| SHA-1 (Windows thumbprint) | 0FF9407618D3D76A4B98F0A8359E0CFD27ACCCED |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2026-09-30 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: 2.16.756.5.14.7.4.8; First included in: NSS 3.21 / Firefox 44; Inclusion bug: #1172819 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email, Time Stamping; Not-before cutoff: 2019-10-01 (Code Signing) |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2026-09-30 (sct_not_after). Mozilla treats it as an EV root for policy OID 2.16.756.5.14.7.4.8.

## Intermediate CAs issued by this root

The CCADB lists 15 intermediate CA certificates signed directly by OISTE WISeKey Global Root GB CA: 9 currently valid, 2 expired and 4 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| OISTE Server Root ECC G1 | OISTE | 2039-12-01 | Valid | FB641643BA20B9638CEC998793140208E7770D87125DBF49ACA712EE1E516652 |
| OISTE Client Root RSA G1 | OISTE | 2039-12-01 | Valid | DF426697B907906C2C777BF74EE63A408F8D9ECF57C01D687755A3C931464AF5 |
| OISTE Client Root ECC G1 | OISTE | 2039-12-01 | Valid | 1D857BFC6F90496DA7E50AB350A5AE31CB96F9A2C8E0DA5B283DEBB7223CF3EA |
| OISTE Server Root RSA G1 | OISTE | 2039-12-01 | Valid | 16921390648AC0CBD2BF2702699236A39F3B6048A35D2F0893DD9045883910C8 |
| TuringSign RSA Secure CA 2 | OISTE | 2030-05-26 | Valid | A6F9C967EB8AA9283A1CA649B87B764720E9F5C3AFA81C150676F4CA36E98CF6 |
| TuringSign ECC Secure CA 2 | OISTE | 2030-05-26 | Valid | A5F41EDF8D6E045FF3FEED676650CE08375D3A9EF210C1695C47AA9DFF11D5C5 |
| WISeKey CertifyID Personal GB CA 3 | WISeKey | 2039-12-01 | Valid | E5937790AA6915755C9A532B10C9610A07C9877C7C60E1B819A294207A3786F5 |
| WISeKey CertifyID SSL GB CA 2 | WISeKey | 2035-07-04 | Valid | C8A610BA9417770D2C02DE22BCA8C56A428AF75E8E354EFA36C568221DDB7CFC |
| WISeKey CertifyID Personal GB CA 4 | WISeKey | 2035-07-04 | Valid | 8D45BF32C041A7EE46325F06AE604FAF7142DD99373DDB1EB74C70488A56FFB8 |
| TuringSign ECC Secure CA | WISeKey | 2026-06-21 | Expired | 1937B9BF662FB578407B77AB87D8D662B16327CF923340D0F72D951952B19C80 |
| TuringSign RSA Secure CA | WISeKey | 2026-06-21 | Expired | 12976558B68E8E1EAA79A629A8E4D17EDEF93F5AC30DE6DFB0CDEE389D56D156 |
| WISeKey CertifyID Personal GB CA 1 | WISeKey | 2039-12-01 | Revoked | EEBEDF846F1DBA0E88A9B6B9AB0FF65F097F284C06A64A939EE8C5C9E6F313F4 |
| WISeKey CertifyID Personal GB CA 2 | WISeKey | 2039-12-01 | Revoked | 56F32167F003D8F2CB738AB386C35CA15265CC29A98EE1066CD3E1AC556CA15C |
| WISeKey CertifyID SSL GB CA 1 | WISeKey | 2039-12-01 | Revoked | EC02025A1A157B2C02AC49F559A8B6CF072126F8379499FAE7C52ED183DA9012 |
| WISeKey CertifyID Policy GB CA 1 | WISeKey | 2039-12-01 | Revoked | 59159FBC93497193FC1A20CA6ECFA597A00018A105112A6004B79C3292494760 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as OISTE WISeKey Global Root GB CA with a different issuer, so a client has to carry OISTE WISeKey Global Root GB CA itself in its root store to trust it.


## What happens when it expires

OISTE WISeKey Global Root GB CA is valid until 2039-12-01, about 13.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2026-09-30.

## FAQ

**Is OISTE WISeKey Global Root GB CA trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2026-09-30.

**When does OISTE WISeKey Global Root GB CA expire?**

On 2039-12-01, about 13.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has OISTE WISeKey Global Root GB CA issued?**

The CCADB lists 15: 9 valid, 2 expired and 4 revoked. The newest valid one is OISTE Server Root ECC G1, valid until 2039-12-01.

**Is OISTE WISeKey Global Root GB CA cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).