Root certificate · PostSignum

PostSignum Root QCA 4

PostSignum Root QCA 4 is a root CA certificate operated by PostSignum (RSA 4096, valid until 2038-07-26, SHA-256 AC7F7862). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

Data updated Nov 10, 2026

Root store status

Root store	Status	Trusted for TLS	Distrust for TLS after	Constrained
Chrome	Not included Not included	No	—	No
Mozilla	Not included Not included	No	—	No
Apple	Not included Not included	No	—	No
Microsoft	Included Included	Yes	—	Yes

The CCADB lists no EV policy OID for PostSignum Root QCA 4.

Not included Chrome

Status: Not included

Not included Mozilla

Status: Not included

Not included Apple

Status: Not included

Included Microsoft

Status: Included
Trusted EKUs: Server Authentication, Client Authentication, Document Signing, OCSP Signing, Secure Email, Time Stamping
Not-before cutoff: 2019-10-01 (OCSP Signing)
Disallowed EKUs: OCSP Signing

"Trusted for TLS" means the store includes the root with the server-authentication trust bit (Mozilla "Websites", Apple serverAuth, Microsoft Server Authentication EKU). Microsoft "NotBefore" means only certificates issued before a cutoff date are still trusted. "Constrained" means the store applies extra restrictions.

Details

CA owner: PostSignum
Subject: CN=PostSignum Root QCA 4,O=Česká pošta\, s.p.,2.5.4.97=NTRCZ-47114983,C=CZ
SHA-256: AC7F7862E685C7A7D9826A58EA32D183D4893FCC8F8FD6D900C9769A987E77F0
SHA-1 (Windows thumbprint): AA40D2579BA82424CD27719B1D6B1F3571738099
SPKI SHA-256: C372F6D18EBEE5AA23D9E919F3E6BE98488EC01607DF3162FC192E4B1346AFB3
Valid from: 2018-07-26
Expires: 2038-07-26
Key: RSA 4096
Signature algorithm: sha512WithRSAEncryption
Serial number: FA0
Country: CZ
Trust bits (CCADB): Server Authentication, Client Authentication, Document Signing, Secure Email, Time Stamping
EV policy OIDs (CCADB): not EV-enabled · TLS EV capable: No
Test websites: valid: https://demo.postsignum.eu:8443 · expired: https://demo.postsignum.eu:8444 · revoked: https://demo.postsignum.eu:8445
CCADB record: A005969
PEM: postsignum-root-qca-4.pem

Look up this certificate on crt.sh

Intermediate CAs issued by this root

The CCADB lists 2 intermediate CA certificates signed directly by PostSignum Root QCA 4: 2 currently valid, 0 expired and 0 revoked (revoked includes those whose parent was revoked).

Showing 2 of 2: valid certificates first, newest first. Each name links to its crt.sh entry by SHA-256; an arrow marks a cross-certificate for another root on this site.

Intermediate	Operated by	Expires	Status
PostSignum Public CA 4	PostSignum	2033-09-27	Valid
PostSignum Qualified CA 4	PostSignum	2033-09-27	Valid

Cross-signed versions

No certificate in the CCADB has the same subject and public key as PostSignum Root QCA 4 with a different issuer, so a client has to carry PostSignum Root QCA 4 itself in its root store to trust it.

CRL and OCSP addresses

In the root certificate

CRL: http://crl.postsignum.cz/crl/psrootqca4.crl
CRL: http://crl2.postsignum.cz/crl/psrootqca4.crl
CRL: http://crl.postsignum.eu/crl/psrootqca4.crl

Full CRL this CA publishes (CCADB)

http://www.postsignum.cz/crl/psrootqca4.crl

Used by the intermediates it issued

Addresses found in the CRL Distribution Points and OCSP fields of the 2 valid intermediates signed by PostSignum Root QCA 4; the number in brackets is how many of them use each address.

CRL: http://crl.postsignum.cz/crl/psrootqca4.crl (2)
CRL: http://crl.postsignum.eu/crl/psrootqca4.crl (2)
CRL: http://crl2.postsignum.cz/crl/psrootqca4.crl (2)
OCSP: http://ocsp.postsignum.cz/OCSP/RQCA4/ (2)

What happens when it expires

PostSignum Root QCA 4 is valid until 2038-07-26, about 11.7 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

Check whether your device trusts it

Each platform keeps its own root store. The commands below look up PostSignum Root QCA 4 by common name (PostSignum Root QCA 4) or fingerprint. The store status in each heading comes from the CCADB snapshot; your device can differ if it is out of date or managed by an administrator.

macOS (Apple store: Not included)

Search the system roots keychain by common name. -Z prints the SHA-256 hash, which must match the fingerprint on the last line.

security find-certificate -a -c "PostSignum Root QCA 4" -Z \
  /System/Library/Keychains/SystemRootCertificates.keychain | grep "SHA-256"
# SHA-256 hash: AC7F7862E685C7A7D9826A58EA32D183D4893FCC8F8FD6D900C9769A987E77F0

Windows (Microsoft store: Included · Trusted for TLS)

Windows identifies roots by SHA-1 thumbprint. It installs third-party roots on demand through Automatic Root Certificates Update, so "not found" can also mean the root has not been needed yet; certutil -generateSSTFromWU roots.sst downloads Microsoft's full list.

certutil -verifystore Root AA40D2579BA82424CD27719B1D6B1F3571738099

Linux (ca-certificates follows Mozilla: Not included)

Debian, Ubuntu, Fedora and RHEL build their ca-certificates package from Mozilla's root store. Use trust list on p11-kit systems, or search the PEM bundle on Debian and Ubuntu.

# Fedora / RHEL / Arch (p11-kit)
trust list --filter=ca-anchors | grep -iF -A2 "PostSignum Root QCA 4"
# Debian / Ubuntu (ca-certificates)
openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt \
  | openssl pkcs7 -print_certs -noout | grep -iF "PostSignum Root QCA 4"

Java

Java ships its own cacerts keystore; JDK 9 and later accept -cacerts and the default store password is changeit. Search for the SHA-256 fingerprint in colon form.

keytool -list -cacerts -storepass changeit | grep -i "AC:7F:78:62:E6:85:C7:A7:D9:82:6A:58:EA:32:D1:83:D4:89:3F:CC:8F:8F:D6:D9:00:C9:76:9A:98:7E:77:F0"

Android

Android's system store is maintained by Google separately from the four CCADB stores above. Open Settings → Security & privacy → More security settings → Encryption & credentials → Trusted credentials → System (menu names vary by vendor and version) and look for Česká pošta, s.p. → PostSignum Root QCA 4.

Which root does my site chain to?

List the chain your server sends and compare the last issuer with this root; the fingerprint check confirms a local copy.

Download PEM

# show subject (s:) and issuer (i:) of every certificate the server sends
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null \
  | grep -E '^ *[0-9]+ s:|^ *i:'
# subject and SHA-256 fingerprint of the downloaded PEM file
openssl x509 -in postsignum-root-qca-4.pem -noout -subject -fingerprint -sha256
# sha256 Fingerprint=AC:7F:78:62:E6:85:C7:A7:D9:82:6A:58:EA:32:D1:83:D4:89:3F:CC:8F:8F:D6:D9:00:C9:76:9A:98:7E:77:F0

FAQ

Is PostSignum Root QCA 4 trusted by Chrome, Firefox, Safari and Windows?

As of 2026-11-10, Microsoft trust it for TLS server authentication; Chrome, Mozilla, Apple do not.

When does PostSignum Root QCA 4 expire?

On 2038-07-26, about 11.7 years after the 2026-11-10 data snapshot.

How many intermediate certificates has PostSignum Root QCA 4 issued?

The CCADB lists 2: 2 valid, 0 expired and 0 revoked. The newest valid one is PostSignum Public CA 4, valid until 2033-09-27.

Is PostSignum Root QCA 4 cross-signed?

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources

CCADB — Resources (TLS Server Authentication report, All Included Root Certificate Trust Bit Settings)
CCADB — All Certificate Information (root and intermediate), CSV V5
CCADB — Mozilla Included CA Certificate Report
CCADB — Chrome / Mozilla / Apple / Microsoft TLS Server Authentication CSV