# COMODO RSA Certification Authority root certificate (Sectigo)

> COMODO RSA Certification Authority is a root CA certificate operated by Sectigo (RSA 4096, valid until 2038-01-18, SHA-256 52F0E1C4). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/sectigo-comodo-rsa-ca/
Last updated: 2026-11-10

COMODO RSA Certification Authority is a root CA certificate operated by Sectigo (RSA 4096, valid until 2038-01-18, SHA-256 52F0E1C4). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Sectigo |
| Subject | CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB |
| SHA-256 | 52F0E1C4E58EC629291B60317F074671B85D7EA80D5B07273463534B32B40234 |
| SPKI SHA-256 | 82B5F84DAF47A59C7AB521E4982AEFA40A53406A3AEC26039EFA6B2E0E7244C1 |
| Valid from | 2010-01-19 |
| Expires | 2038-01-18 |
| Key | RSA 4096 |
| Signature algorithm | sha384WithRSAEncryption |
| Serial number | 4CAAF9CADB636FE01FF74ED85B03869D |
| SHA-1 (Windows thumbprint) | AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2026-09-30 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: 1.3.6.1.4.1.6449.1.2.1.5.1; First included in: NSS 3.17.3 / Firefox 36; Inclusion bug: #606947 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2026-09-30 (sct_not_after). Mozilla treats it as an EV root for policy OID 1.3.6.1.4.1.6449.1.2.1.5.1.

## Intermediate CAs issued by this root

The CCADB lists 42 intermediate CA certificates signed directly by COMODO RSA Certification Authority: 23 currently valid, 15 expired and 4 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Sectigo Public Server Authentication Root R46 | Sectigo | 2038-01-18 | Valid | 481B043B61A2FC959D0E5A6546D5EDF49A474A8408E51EAA198800FB9EB9875B |
| WebNIC Code Signing CA | Sectigo | 2029-09-22 | Valid | D334D359A9944864B4D08F6B509E370BBE378F71BDED0B239A3AB8BE052A296E |
| WebNIC Assured ID CA | Sectigo | 2029-09-22 | Valid | 7CB1F0F103D4EE82D9AD41F69023C594211F5285C394E87D54BF0474622C8265 |
| WebNIC RSA Domain Secure Site CA | Sectigo | 2029-09-22 | Valid | 668901E5764D7D9099ABC21348599D9FF36B916CA839B351E6875B18B16130BE |
| WebNIC RSA Business Secure Site CA | Sectigo | 2029-09-22 | Valid | 48855C93594527339D98449689FAB7C315FF5465066C516C29DBDCF1853901D3 |
| WebNIC RSA Extended Validation Secure Site CA | Sectigo | 2029-09-22 | Valid | 198E332F10FA0F58AF083AE964BC6441F06CD0FAD319B1235FE3ED0F7C6EAF93 |
| WoTrus DV Server CA | Sectigo | 2029-02-26 | Valid | E36F165FF7739CD900A2562767B3EAFBE67A34C83C3A82F4C21D5F51C3ED191E |
| Trustico RSA OV CA | Sectigo | 2027-09-08 | Valid | AFE1595E7097CCDFB432CEA639BDEE86CF2576C27DF36F9C691CF03E1324C1D4 |
| Trustico RSA Client CA | Sectigo | 2027-09-08 | Valid | 97221453BB214642C1DC5ABCDA79FE4EEDB5F2B03944F002B81B847C39F80FEC |
| Trustico RSA Codesigning CA | Sectigo | 2027-09-08 | Valid | 78CDBC6AA95CAA547448379F8CD3AD01722CAD1C28C7CD016EA3032178B6F90E |
| Trustico RSA EV CA | Sectigo | 2027-09-08 | Valid | 663A4E658FBBF74FC19B0155F2FACB12CC9B697058F447EF791178FE9B8D073D |
| Trustico RSA DV CA | Sectigo | 2027-09-08 | Valid | 33CFB062CD2951E4DD1A256BED156BEA53F290D039DEEFB85BE95E1901216A36 |
| cPanel Extended Validation RSA Certification Authority | Sectigo | 2026-12-13 | Valid | 7F07C12FFF4653D6BB65F9CCFD1A0E9EE466884EB077277BB9BB45D76243CC22 |
| cPanel High Assurance RSA Certification Authority | Sectigo | 2026-12-13 | Valid | 690EF214BC114EF1D726BD7EF03E546CD6CB7BE5BC23FACD391263BFFB57970A |
| UbiquiTLS™ DV RSA Server CA | Sectigo | 2031-03-29 | Valid | F00322C97B57CEA6D64A6A1D365C6C6B7F0EBA3089876C1430E1063E8A82A676 |
| COMODO RSA Extended Validation Code Signing CA | Sectigo | 2029-12-02 | Valid | D1863B55A0629F32A5DAD867D02DF1D1A4550B23AC422B53581E79E548FD6617 |
| COMODO/HP Secure Email CA 2 | Sectigo | 2029-11-25 | Valid | B9B8851C25F6CC35D48E1B2B77E3EBF057EDCAC9885A4177ACB5A3960458261E |
| COMODO RSA Organization Validation Secure Server CA | Sectigo | 2029-02-11 | Valid | 111006378AFBE8E99BB02BA87390CA429FCA2773F74D7F7EB5744F5DDF68014B |
| COMODO RSA Domain Validation Secure Server CA | Sectigo | 2029-02-11 | Valid | 02AB57E4E67A0CB48DD2FF34830E8AC40F4476FB08CA6BE3F5CD846F646840F0 |
| COMODO RSA Code Signing CA | Sectigo | 2028-05-08 | Valid | 5E6D2F88F617DC8B809AEE712445A41B3CDE26AF874A221A9DC98EA1DC68E3D5 |

## Cross-signed versions

2 certificate(s) in the CCADB have the same subject and public key as COMODO RSA Certification Authority but a different issuer. A server can send one of them so that clients which trust the issuing root, but not COMODO RSA Certification Authority, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| AAA Certificate Services | Sectigo | 2028-12-31 | Valid | 38392F17CE7B682C198D29C6E71D2740964A2074C8D2558E6CFF64C27823F129 |
| AddTrust External CA Root | Sectigo | 2020-05-30 | Expired | 4F32D5DC00F715250ABCC486511E37F501A899DEB3BF7EA8ADBBD3AEF1C412DA |

## What happens when it expires

COMODO RSA Certification Authority is valid until 2038-01-18, about 11.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2026-09-30.

## FAQ

**Is COMODO RSA Certification Authority trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2026-09-30.

**When does COMODO RSA Certification Authority expire?**

On 2038-01-18, about 11.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has COMODO RSA Certification Authority issued?**

The CCADB lists 42: 23 valid, 15 expired and 4 revoked. The newest valid one is Sectigo Public Server Authentication Root R46, valid until 2038-01-18.

**Is COMODO RSA Certification Authority cross-signed?**

Yes. The CCADB has 2 cross-certificate(s) with its subject and key, signed by AAA Certificate Services, AddTrust External CA Root; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).