# AAA Certificate Services root certificate (Sectigo)

> AAA Certificate Services is a root CA certificate operated by Sectigo (RSA 2048, valid until 2028-12-31, SHA-256 D7A7A0FB). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/sectigo-aaa-certificate-services/
Last updated: 2026-11-10

AAA Certificate Services is a root CA certificate operated by Sectigo (RSA 2048, valid until 2028-12-31, SHA-256 D7A7A0FB). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Sectigo |
| Subject | CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB |
| SHA-256 | D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF4 |
| SPKI SHA-256 | BD153ED7B0434F6886B17BCE8BBE84ED340C7132D702A8F4FA318F756ECBD6F3 |
| Valid from | 2004-01-01 |
| Expires | 2028-12-31 |
| Key | RSA 2048 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 1 |
| SHA-1 (Windows thumbprint) | D1EB23A46D17D68FD92564C2F1F1601764D8E349 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | No | - | Trust bits: Email; EV policy OIDs: not EV-enabled; First included in: Firefox 1; Inclusion bug: #249710 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping |

The CCADB lists EV policy OID 2.23.140.1.3, 1.3.6.1.4.1.6449.1.2.1.5.1 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 95 intermediate CA certificates signed directly by AAA Certificate Services: 53 currently valid, 8 expired and 34 revoked (revoked includes those whose parent was revoked). 3 of the valid ones run past the expiry date of the root itself (2028-12-31).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| SSL.com TLS RSA Root CA 2022 | SSL.com | 2028-12-31 | Valid | D6DF0026E5939EF08BEDAC8C5838F1F0A6EFA7CAD5F6B8BB80AEB255DA96EBB3 |
| SSL.com TLS ECC Root CA 2022 | SSL.com | 2028-12-31 | Valid | BA06D3D3E348FCE7478CC84B422D0E638E9E221EF1A0B53ADC14CC70E04B8AB8 |
| SSL.com TLS Transit ECC CA R2 | SSL.com | 2028-12-31 | Valid | FE9FB0F783EBB843109AA31DE9DA9864B6542940C307DF23180B11F1F7E108DE |
| SSL.com TLS Transit RSA CA R2 | SSL.com | 2028-12-31 | Valid | EBD417F595C3F259B7455C8135293505B692C47E0F74D3BA885CE22C8875CA28 |
| SSL.com IV TLS Issuing ECC CA 1 | SSL.com | 2028-12-31 | Valid | E3191026C526487A05F68ADF4B8CA395C044AA6B5E72A70E8739DA71A860D0DB |
| SSL.com OV TLS Issuing ECC CA 1 | SSL.com | 2028-12-31 | Valid | D306BF0D85BD10D083A1ECA5B38D40149E5C450F996021CC08DE254D1722E619 |
| SSL.com OV TLS Issuing RSA CA 1 | SSL.com | 2028-12-31 | Valid | C28A1FDF14AE3F045FBC5E1602A01030A77236CC52267F2360899C832E975C15 |
| SSL.com IV TLS Transit RSA CA 1 | SSL.com | 2028-12-31 | Valid | B90CF398E1BE2E59C6BF1E0F7F996CAB2E1533734A0BC328989C135EB19D6729 |
| SSL.com TLS Issuing RSA CA R1 | SSL.com | 2028-12-31 | Valid | AB3DE819F342F0A61D199D4BE86A4F7F3F2810CDFF0B0BFF872F4D93E812CE80 |
| SSL.com EV TLS Transit RSA CA R2 | SSL.com | 2028-12-31 | Valid | A4270E5251691F6EC40CF774C6717E2EFEC3EB1E384607DC75836296AAA15C59 |
| SSL.com EV TLS Transit ECC CA R2 | SSL.com | 2028-12-31 | Valid | 7FE5572FBE934AFC4151651FEF098B9940A47966C4085577314D7104CDE84329 |
| SSL.com OV TLS Transit RSA CA 1 | SSL.com | 2028-12-31 | Valid | 5ABA720A2F527774D516DC12021E6248756ADF046EAE0818555E969F8E43CC1F |
| SSL.com EV TLS Issuing ECC CA R1 | SSL.com | 2028-12-31 | Valid | 3B8C379F23FA22256A0E1F44D92F0A0FC770BCDE9F8557F160149BCDA22EDE78 |
| SSL.com IV TLS Transit ECC CA 1 | SSL.com | 2028-12-31 | Valid | 3708FB804391C75AA5D81235C214F398C6DCA6C9492A3AFDE92A5FD92FE48FAB |
| SSL.com TLS Issuing ECC CA R2 | SSL.com | 2028-12-31 | Valid | 2DC7DDC440B6332274868C5E1DF5D15BD71E5A1861D22B6181BC1C2CBFA32B34 |
| SSL.com OV TLS Transit ECC CA 1 | SSL.com | 2028-12-31 | Valid | 28DE5F98B2DB4C4381FDA8307AC9C355DB898966B525665A019F5D6DFE7EF1CA |
| SSL.com EV TLS Issuing RSA CA R1 | SSL.com | 2028-12-31 | Valid | 1DAF812025E2376279C074050EE35E1B2D909F8B57A00F82B7B5D28120C3582A |
| SSL.com IV TLS Issuing RSA CA 1 | SSL.com | 2028-12-31 | Valid | 1372C7B4D6AC3A438BDFC87A29D303315FF34FC5B1E73205936B7B99284A8AF5 |
| Sectigo Public Code Signing Root E46 | Sectigo | 2028-12-31 | Valid | DB44CB073B747CB2ADDFADA3B7A6BF855E0A278194BE6DC28113CE97A7ED26BB |
| TrustAsia ECC OV TLS CA G2 | Sectigo | 2028-12-31 | Valid | DA4792604E554A3894EFC97489CC4B64831B2CF7E5512B3395EF9963D6EFDD7F |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as AAA Certificate Services with a different issuer, so a client has to carry AAA Certificate Services itself in its root store to trust it.


## What happens when it expires

AAA Certificate Services is valid until 2028-12-31, about 2.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. 3 of its valid intermediates expire later than the root, so their operators need another path, such as a cross-sign from a newer root, before 2028-12-31.

## FAQ

**Is AAA Certificate Services trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does AAA Certificate Services expire?**

On 2028-12-31, about 2.1 years after the 2026-11-10 data snapshot. 3 of the valid ones run past the expiry date of the root itself (2028-12-31).

**How many intermediate certificates has AAA Certificate Services issued?**

The CCADB lists 95: 53 valid, 8 expired and 34 revoked. The newest valid one is SSL.com TLS RSA Root CA 2022, valid until 2028-12-31.

**Is AAA Certificate Services cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).