# Entrust.net Certification Authority (2048) root certificate (Sectigo)

> Entrust.net Certification Authority (2048) is a root CA certificate operated by Sectigo (RSA 2048, valid until 2029-07-24, SHA-256 6DC47172). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/sectigo-entrust-net-ca-2048/
Last updated: 2026-11-10

Entrust.net Certification Authority (2048) is a root CA certificate operated by Sectigo (RSA 2048, valid until 2029-07-24, SHA-256 6DC47172). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Sectigo |
| Subject | CN=Entrust.net Certification Authority (2048),OU=(c) 1999 Entrust.net Limited,OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.),O=Entrust.net |
| SHA-256 | 6DC47172E01CBCB0BF62580D895FE2B8AC9AD4F873801E0C10B9C837D21EB177 |
| SPKI SHA-256 | 1EA3C5E43ED66C2DA2983A42A4A79B1E906786CE9F1B58621419A00463A87D38 |
| Valid from | 1999-12-24 |
| Expires | 2029-07-24 |
| Key | RSA 2048 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 3863DEF8 |
| SHA-1 (Windows thumbprint) | 503006091D97D4F5AE39F7CBE7927D7D652D3431 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | No | 2024-11-30 | Trust bits: Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.15 / Firefox 23; Inclusion bug: #694536 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping |

Mozilla stops trusting TLS certificates from this root issued after 2024-11-30. The CCADB lists EV policy OID 2.23.140.1.1, 2.16.840.1.114028.10.1.2 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 35 intermediate CA certificates signed directly by Entrust.net Certification Authority (2048): 9 currently valid, 20 expired and 6 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Entrust Digital Signing Root Certification Authority - DSR1 | Sectigo | 2029-07-23 | Valid | 37C4596A91541642B4DD07AE28A6E968999EA95A057A8182695A33DFEB308C4D |
| Entrust Certification Authority - L1K | Sectigo | 2029-07-23 | Valid | 7F4325CC24107A39441552F27FDC34185802482E164D1794AA415EF1E4206BA7 |
| Entrust Enterprise Intermediate CA - ICA1 | Sectigo | 2029-07-07 | Valid | C54D8B12C438725C2755B4AD81825F6975CBDA6C258A2BFBB8247A14F03BD22A |
| Entrust Class 2 Client CA - C2CA2 | Sectigo | 2029-07-16 | Valid | B14CF550D8F573D93E90963C32A85FB51C983C98164F54D78915F6358C954F0E |
| Entrust Certification Authority - L1F | Sectigo | 2029-07-05 | Valid | 0C5A09DB8AEDF7D2D1DDE14DCCC2DB6EA959BCF6F010360D836C342C624D7E0E |
| Entrust Class 2 Client CA | Sectigo | 2029-06-29 | Valid | 1A20FEF46482A98BAC6F6C7397C017310AC7FB78495438BC7A7DE9035C246679 |
| Entrust Class 2 Client CA | Sectigo | 2028-12-20 | Valid | 95AD94E88F5B8604E40E5FFF36B0D34BE46C1D5BA06C0E735B72AA396735C415 |
| Entrust Class 3 Client CA - SHA256 | Sectigo | 2029-06-25 | Valid | 33857338361ECFC4858DDFF6B9EF6273E3DB856AB9CEA1C0E2C65925D1C87978 |
| Entrust Timestamping CA - TS1 | Sectigo | 2029-06-22 | Valid | 44DFCD2C573110E74BF4E85903595F660650ED925B7306542C54E87396671F03 |
| UIS-IntB-CA | Unisys Corporation | 2018-07-01 | Expired | 3FBAC0700062327F92797C2B18B6B329BCDCCA095D8A0B528E17EB833748CB85 |
| UIS-IntB-CA | Unisys Corporation | 2018-07-01 | Expired | 213924E100B85F6D1159297EB947748BA59ADA87EDA2D3E95EF1C509FFAD48E5 |
| Entrust Certification Authority - L1K | Sectigo | 2024-10-11 | Expired | D6C3FC493BACD1DF8A1BA30F4AE26254B2A4528E4876081EACC6A16A090AA36A |
| UIS-IntB-CA | Unisys Corporation | 2017-07-25 | Expired | B353BED89B8EADC4D62D55F64056088888468E661B2DB1F03B9FE66859004C0B |
| UIS-IntB-CA | Unisys Corporation | 2017-07-25 | Expired | 4BD730D3680D48C22D1A26AA6FB9DBF1EF8321F1EFECD8B2D11ADADC1F400B1C |
| UIS-IntB-CA | Unisys Corporation | 2017-07-24 | Expired | 46F96448FBDAAFF3BE0DC296B3FDA3DB9BDF3F06B078D95BEE13837E8AF6303F |
| Entrust Code Signing Certification Authority - L1D | Entrust | 2021-11-12 | Expired | FA9D6DF1AF0275300D52A485D036B0543B53DFB4441BEC0B8C9A0DFF811B6D88 |
| Entrust Certification Authority - L1C | Entrust | 2021-11-11 | Expired | CA971C936C699BC5D6A609D2529F903A60F6E141A2CF12BE72313DA50CA64E17 |
| Entrust Class 1 Client CA | Entrust | 2021-11-12 | Expired | C23A1F8315538A8651816E9932C044EB856C01FD99771690C863671D22C48564 |
| Entrust Class 1 Client CA | Entrust | 2021-11-11 | Expired | 8CB3D21BBB255DBFEAFA1A27D1D1F70320DC84564297BCE82E29B8F2E461F270 |
| Entrust Code Signing Certification Authority - L1D | Entrust | 2021-11-12 | Expired | 8B16D48F721DFAB157214B9ACE9DDA8EFBA5A06B4EED901806F086D1DF8EAD37 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as Entrust.net Certification Authority (2048) with a different issuer, so a client has to carry Entrust.net Certification Authority (2048) itself in its root store to trust it.


## What happens when it expires

Entrust.net Certification Authority (2048) is valid until 2029-07-24, about 2.7 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Mozilla 2024-11-30.

## FAQ

**Is Entrust.net Certification Authority (2048) trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not. Distrust-after dates already set: Mozilla 2024-11-30.

**When does Entrust.net Certification Authority (2048) expire?**

On 2029-07-24, about 2.7 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Entrust.net Certification Authority (2048) issued?**

The CCADB lists 35: 9 valid, 20 expired and 6 revoked. The newest valid one is Entrust Digital Signing Root Certification Authority - DSR1, valid until 2029-07-23.

**Is Entrust.net Certification Authority (2048) cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).