# Entrust Root Certification Authority - EC1 root certificate (Sectigo)

> Entrust Root Certification Authority - EC1 is a root CA certificate operated by Sectigo (ECDSA P-384, valid until 2037-12-18, SHA-256 02ED0EB2). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/sectigo-entrust-root-ca-ec1/
Last updated: 2026-11-10

Entrust Root Certification Authority - EC1 is a root CA certificate operated by Sectigo (ECDSA P-384, valid until 2037-12-18, SHA-256 02ED0EB2). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Sectigo |
| Subject | CN=Entrust Root Certification Authority - EC1,OU=(c) 2012 Entrust\, Inc. - for authorized use only,OU=See www.entrust.net/legal-terms,O=Entrust\, Inc.,C=US |
| SHA-256 | 02ED0EB28C14DA45165C566791700D6451D7FB56F0B2AB1D3B8EB070E56EDFF5 |
| SPKI SHA-256 | FEA2B7D645FBA73D753C1EC9A7870C40E1F7B0C561E927B985BF711866E36F22 |
| Valid from | 2012-12-18 |
| Expires | 2037-12-18 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | A68B79290000000050D091F9 |
| SHA-1 (Windows thumbprint) | 20D80640DF9B25F512253A11EAF7598AEB14B547 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | No | 2024-11-30 | Trust bits: Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.18 / Firefox 38; Inclusion bug: #849950 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email, Time Stamping |

Mozilla stops trusting TLS certificates from this root issued after 2024-11-30. The CCADB lists EV policy OID 2.23.140.1.1, 2.16.840.1.114028.10.1.2 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 4 intermediate CA certificates signed directly by Entrust Root Certification Authority - EC1: 2 currently valid, 0 expired and 2 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Entrust Certification Authority - L1J | Sectigo | 2037-10-05 | Valid | 3447B74B5E500A549983FA2CED73A5642E6AAEC78829546158437DF66D7435B8 |
| Entrust Certification Authority - L1F | Sectigo | 2037-10-05 | Valid | 1835B0E482EA65536FC010E4BC13C060F65668165FBA97E2F542CE96CA6DFEFC |
| Entrust Certification Authority - L1E | Entrust | 2024-10-22 | Revoked | CBB3445425AF506646CF6EB0C61197FF714BDBEE9424067B3C0772E2D304FBB7 |
| Entrust Certification Authority - L1E | Entrust | 2024-09-12 | Revoked | 7FA8450051BAC3EFD7EA4DBBD070075D7E7B7D27F3F119E6FA1F7103B8A89F24 |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as Entrust Root Certification Authority - EC1 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Entrust Root Certification Authority - EC1, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Entrust Root Certification Authority | Sectigo | 2026-11-10 | Valid | 3FDE0D36E026B6E8EBE2C28883607C8651DE10BD6C1FCAD365E560F4EA2F3B03 |

## What happens when it expires

Entrust Root Certification Authority - EC1 is valid until 2037-12-18, about 11.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Mozilla 2024-11-30.

## FAQ

**Is Entrust Root Certification Authority - EC1 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not. Distrust-after dates already set: Mozilla 2024-11-30.

**When does Entrust Root Certification Authority - EC1 expire?**

On 2037-12-18, about 11.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Entrust Root Certification Authority - EC1 issued?**

The CCADB lists 4: 2 valid, 0 expired and 2 revoked. The newest valid one is Entrust Certification Authority - L1J, valid until 2037-10-05.

**Is Entrust Root Certification Authority - EC1 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by Entrust Root Certification Authority; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).