# Entrust Root Certification Authority - G2 root certificate (Sectigo)

> Entrust Root Certification Authority - G2 is a root CA certificate operated by Sectigo (RSA 2048, valid until 2030-12-07, SHA-256 43DF5774). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/sectigo-entrust-root-ca-g2/
Last updated: 2026-11-10

Entrust Root Certification Authority - G2 is a root CA certificate operated by Sectigo (RSA 2048, valid until 2030-12-07, SHA-256 43DF5774). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Sectigo |
| Subject | CN=Entrust Root Certification Authority - G2,OU=(c) 2009 Entrust\, Inc. - for authorized use only,OU=See www.entrust.net/legal-terms,O=Entrust\, Inc.,C=US |
| SHA-256 | 43DF5774B03E7FEF5FE40D931A7BEDF1BB2E6B42738C4E6D3841103D3AA7F339 |
| SPKI SHA-256 | 76EE8590374C715437BBCA6BBA6028EADDE2DC6DBBB8C3F610E851F11D1AB7F5 |
| Valid from | 2009-07-07 |
| Expires | 2030-12-07 |
| Key | RSA 2048 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 4A538C28 |
| SHA-1 (Windows thumbprint) | 8CF427FD790C3AD166068DE81E57EFBB932272D4 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | No | 2024-11-30 | Trust bits: Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.18 / Firefox 38; Inclusion bug: #849950 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping |

Mozilla stops trusting TLS certificates from this root issued after 2024-11-30. The CCADB lists EV policy OID 2.23.140.1.1, 2.16.840.1.114028.10.1.2 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 29 intermediate CA certificates signed directly by Entrust Root Certification Authority - G2: 12 currently valid, 3 expired and 14 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Sectigo Legacy Server Authentication CA OV R30 | Sectigo | 2030-12-06 | Valid | 2E0B84189FF9740C140CC7EBDDA051A2C239F1DEEB12FC4C56DBD500F95398D8 |
| SSL.com TLS RSA Root CA 2022 | SSL.com | 2030-12-06 | Valid | AAC42585276A2BA42710CA7AF27B1369F339F24F70D9095BE956391CAAF8BA94 |
| Entrust SMIME Root CA - 2022 | Sectigo | 2030-12-07 | Valid | E8A2BB3BDE5365BE0BE83AAECC646A104B5C1A2CD03D4534F6CFCF4BDA1533E0 |
| Namirial OV SSL CA 2023 | Sectigo | 2030-12-07 | Valid | F4E26BEB0279228D96D47B05DF744AE6CE6AAD888A3B757D249EB3D22D27F4C6 |
| CrowdStrike TLS CA 2022 | Sectigo | 2030-12-06 | Valid | 2C4AD64B4E862D7D46424D9FA13EA9A974A62F7C4B608AE1A871424CC9A6873D |
| Entrust Certification Authority - ES QWAC2 | Sectigo | 2030-12-01 | Valid | C97F2F6E6A8ADB6ECFE4978F08CA8F6F0123A94784522B610ADF6AB51439FC62 |
| Entrust Code Signing Root Certification Authority - CSBR1 | Sectigo | 2030-11-07 | Valid | 18DD9A467054C74A5AE46182843A6F4EC46D5E338D91ADF4E5980B50193FB94B |
| Entrust Class 1 Client CA - SHA256 | Sectigo | 2030-11-16 | Valid | C6E9E993C258B72124AAD3C9C068B6EF23576155F310B305733361E20B17C943 |
| Entrust Certification Authority - L1K | Sectigo | 2030-12-05 | Valid | 13EFB39A2F6654E8C67BD04F4C6D4C90CD6CAB5091BCEDC73787F6B77D3D3FE7 |
| Entrust Extended Validation Code Signing CA - EVCS1 | Sectigo | 2030-11-10 | Valid | D04DB927C663AA8C853D54716DD6DC2A4B2FEF9C3AE1BFB250447FC5D7771E57 |
| Entrust Code Signing CA - OVCS1 | Sectigo | 2030-11-10 | Valid | CC5B7A0E5D6771BA348D3D763752F0667026B3531C5396EDBE24ADCE93215723 |
| Entrust Certification Authority - L1M | Sectigo | 2030-10-15 | Valid | 75C5B3F01FD1F51A2C447AB7C785D72E69FA9C472C08571E7EADF3B8EABAE70C |
| UIS-IntB-CA | Unisys Corporation | 2018-07-01 | Expired | 53EEF344CB0E784B3405574475768422073498A19266EE2A4D0021D6A4625001 |
| Entrust Certification Authority - L1K | Sectigo | 2024-10-23 | Expired | F5C2F23C6518F9D19B6F39BEAEA4FBAE10031BA9DC985CE1563A520DA0AD4116 |
| Entrust Certification Authority - L1K | Sectigo | 2024-08-27 | Expired | 3B0CC20384AD7F24EB438F2B80C63EBE003F7F215B8877E418EBB0484028DB57 |
| Entrust 4K EV TLS Root CA - 2022 | Entrust | 2030-12-06 | Revoked | E821B11129110567F1607F0B0F368EC78D811418F0C48CC425450F63EB88095D |
| Entrust 4K TLS Root CA - 2022 | Entrust | 2030-12-06 | Revoked | E255DA2D54ECFD16FB6426A38A83399E7E39F6A01E96E649CD850FB0FDFF54EB |
| Namirial EV SSL CA 2023 | Entrust | 2030-12-07 | Revoked | 366DD61ECE49EF68A7E0705915ECE7EE7BAA3C5D71B9363CD487E0FE0242A634 |
| CRYPTAS OV Issuing CA | Entrust | 2030-12-01 | Revoked | FAECDD05D9F2E5FE8498DE56CDF895C0A697094E1773DEDE5FCE2001B4C7B152 |
| CRYPTAS EV Issuing CA | Entrust | 2030-12-01 | Revoked | 1EC0AFC3ED9F2BADCA068E0C2D81F9C62EF97522316317B788662B3EDAD38075 |

## Cross-signed versions

2 certificate(s) in the CCADB have the same subject and public key as Entrust Root Certification Authority - G2 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Entrust Root Certification Authority - G2, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Entrust Root Certification Authority | Sectigo | 2026-11-26 | Valid | 65F0358FC93934CD5AAC43122F37948D7BD042D148E6FD88B2E65AA9AC399DDD |
| Entrust Root Certification Authority | Sectigo | 2024-09-23 | Expired | 6B143C2005D5539CC22EAB5F772DB2A9FE87467FEFFA07FCF0A9F7D28274CA7A |

## What happens when it expires

Entrust Root Certification Authority - G2 is valid until 2030-12-07, about 4.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Mozilla 2024-11-30.

## FAQ

**Is Entrust Root Certification Authority - G2 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not. Distrust-after dates already set: Mozilla 2024-11-30.

**When does Entrust Root Certification Authority - G2 expire?**

On 2030-12-07, about 4.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Entrust Root Certification Authority - G2 issued?**

The CCADB lists 29: 12 valid, 3 expired and 14 revoked. The newest valid one is Sectigo Legacy Server Authentication CA OV R30, valid until 2030-12-06.

**Is Entrust Root Certification Authority - G2 cross-signed?**

Yes. The CCADB has 2 cross-certificate(s) with its subject and key, signed by Entrust Root Certification Authority; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).