# COMODO Certification Authority root certificate (Sectigo, SHA-256 0C2CD63D)

> COMODO Certification Authority is a root CA certificate operated by Sectigo (RSA 2048, valid until 2029-12-31, SHA-256 0C2CD63D). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Apple.

Source: https://ssl.sh/roots/sectigo-comodo-ca/
Last updated: 2026-11-10

COMODO Certification Authority is a root CA certificate operated by Sectigo (RSA 2048, valid until 2029-12-31, SHA-256 0C2CD63D). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Apple.

| Field | Value |
|---|---|
| CA owner | Sectigo |
| Subject | CN=COMODO Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB |
| SHA-256 | 0C2CD63DF7806FA399EDE809116B575BF87989F06518F9808C860503178BAF66 |
| SPKI SHA-256 | 006D7BE7555DD82026442C4F1A27A80E89A1989CB87B34448ED2194C18196D5E |
| Valid from | 2006-12-01 |
| Expires | 2029-12-31 |
| Key | RSA 2048 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 4E812D8A8265E00B02EE3E350246E53D |
| SHA-1 (Windows thumbprint) | 6631BF9EF74F9EB6C9D5A60CBA6ABED1F7BDEF7B |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Not included | No | - | - |
| Mozilla | Included | No | - | Trust bits: Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.11.10 / Firefox 3.0.2; Inclusion bug: #401587 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Removed | No | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping |

The CCADB lists EV policy OID 2.23.140.1.1, 1.3.6.1.4.1.6449.1.2.1.5.1 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 27 intermediate CA certificates signed directly by COMODO Certification Authority: 4 currently valid, 23 expired and 0 revoked (revoked includes those whose parent was revoked). 4 of the valid ones run past the expiry date of the root itself (2029-12-31).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Sectigo SHA-256 DV Secure Server CA 2 | Sectigo | 2030-12-31 | Valid | EED0A95E7DE3CA53E4A6C72A86B3F164C0C23E380F8F6B79A349EF1784342C1F |
| Sectigo SHA-256 OV Secure Server CA 2 | Sectigo | 2030-12-31 | Valid | BDA4672A403CA2451C74D7E93E7A4E71A9ED22A2A8CCD6F91F8FE9AE0E6CA881 |
| Sectigo SHA-256 EV Secure Server CA 2 | Sectigo | 2030-12-31 | Valid | 8464FFEB29A3AD17E9D6F46E48C5C727C9D7868DAC0262BF256E20B3CFB55882 |
| COMODO SHA-256 Client Authentication and Secure Email CA 2 | Sectigo | 2032-06-12 | Valid | D86A18B5F76952B736E89A2DB3F0FDF9070711460114B6A08D649CA627935C96 |
| TrustAsia EV SSL Server CA | Sectigo | 2020-05-30 | Expired | 67AE776B47B11B4E80EA8A1F23431776CA194107C71CD67CA3BFFE24AF286BA3 |
| SecureCore SHA-1 EV CA | Sectigo | 2020-05-30 | Expired | DCFD457D3738B19EA3BEF63209E20AE153E188D107B89B2FC84690BE945276F8 |
| EUNETIC - EuropeanSSL Extended Validation Server CA | Sectigo | 2020-05-30 | Expired | C2D889F019BC64D84F828488B37D9C7F3E65DC00696BE09AE0F97DFE5E1E8C89 |
| CertAssure EV Secure Server Certification Authority | Sectigo | 2020-05-30 | Expired | 9D9EA534F57F2D04886F92B9ECC1DA87E773F7535A85864DA54608FADA6691E7 |
| SSL.com Premium EV CA | Sectigo | 2020-05-30 | Expired | 513BDEA67548E8687168FCE367A56446C72DB0A72E5C770FCCCF6362464CEEBB |
| PSW GROUP Extended Validation SSL CA | Sectigo | 2020-05-30 | Expired | BEC24581C616152ECB4275FAB82AE1B3A73F0B77CA3F8F703F3E923C480F1106 |
| ReliaSite EV Server CA | Sectigo | 2020-05-30 | Expired | 9C137A4A73A5155C2D4732BE9723638D73AE994A80AA429EA4FB8F55D5793136 |
| SSL Blindado PRO EV | Sectigo | 2020-05-30 | Expired | C286E1F74B1FA06054B1F7C2EE242452B67E7D10A93CDDC402C94E2A72B85EE0 |
| EUNETIC - EuropeanSSL Extended Validation Server CA | Sectigo | 2020-05-30 | Expired | 7857E2DDB36187BFEA3CA223DEE260EFE8B30A761188B88A979E5B0A6FC71FCA |
| SSL Blindado EV | Sectigo | 2020-05-30 | Expired | A0A9E281723A0E59879BA898F3DAD3B621C27E5190AF8AD3219DB6BCF53F99A6 |
| Formidable CA Services Extended Validation | Sectigo | 2020-05-30 | Expired | 5F3ACAB3A3CFA9F0FCB0E8C10167ADFA0BA5D52959988A4CA383A3215EF23E06 |
| SSL.com Premium EV CA | Sectigo | 2020-05-30 | Expired | 9C9C739CD5C5A1078691AB1CA917FA4953A81A1766199F2D45C98D02367133B0 |
| DOMENY.PL EV Certification Authority | Sectigo | 2020-05-30 | Expired | 30266ADE5BF0CAD9B1747740980A33A9D9F8141906698786CA09A9D49D4B8760 |
| TrustSign BR Certification Authority (EV) | Sectigo | 2020-05-30 | Expired | 48345343F8241F481BCD40D030AC867BF3B392194EADC358B4F203663FA30F92 |
| GlobalTrust Extended Validation CA | Sectigo | 2020-05-30 | Expired | A8F4AD9FEE833302F18D50322C0283D02B75ED89E2453F1275E06A182FF86ADA |
| GlobeSSL CA | Sectigo | 2020-05-30 | Expired | 6E42AB2429A0E5889C7C34B9E39B34824DC95326B9C07E7C55DDEE9FCA42195A |

## Cross-signed versions

5 certificate(s) in the CCADB have the same subject and public key as COMODO Certification Authority but a different issuer. A server can send one of them so that clients which trust the issuing root, but not COMODO Certification Authority, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| AddTrust External CA Root | Sectigo | 2020-05-30 | Expired | 3717F5EADF9A9753AB6CAAD8C6805423FBEC758CC25CA91A2B233D545A17BFE6 |
| UTN-USERFirst-Hardware | Sectigo | 2020-05-30 | Expired | B00DAA3BE3630F729834AADBDEE5A19C5538F916556425F83669B0CDC45B3590 |
| UTN-USERFirst-Hardware | Sectigo | 2020-05-30 | Expired | 665C4DE8D0F419377345E228736143EF648BD727119E60D32F50DCF1FE83864B |
| UTN - DATACorp SGC | Sectigo | 2020-05-30 | Revoked | 59999DFD06B3CB1F73D66A81D551B097DC763D9730E4DF45762D923B416A4C58 |
| AddTrust External CA Root | Sectigo | 2020-05-30 | Expired | E780575EB081F2F35BCDE6B0373F5CFEF66490C5E383DB98F8D2A21CF0DF1A0B |

## What happens when it expires

COMODO Certification Authority is valid until 2029-12-31, about 3.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. 4 of its valid intermediates expire later than the root, so their operators need another path, such as a cross-sign from a newer root, before 2029-12-31.

## FAQ

**Is COMODO Certification Authority trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple trust it for TLS server authentication; Chrome, Mozilla, Microsoft do not.

**When does COMODO Certification Authority expire?**

On 2029-12-31, about 3.1 years after the 2026-11-10 data snapshot. 4 of the valid ones run past the expiry date of the root itself (2029-12-31).

**How many intermediate certificates has COMODO Certification Authority issued?**

The CCADB lists 27: 4 valid, 23 expired and 0 revoked. The newest valid one is Sectigo SHA-256 DV Secure Server CA 2, valid until 2030-12-31.

**Is COMODO Certification Authority cross-signed?**

Yes. The CCADB has 5 cross-certificate(s) with its subject and key, signed by AddTrust External CA Root, UTN-USERFirst-Hardware, UTN - DATACorp SGC; 0 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).