# Entrust Root Certification Authority - G4 root certificate (Sectigo)

> Entrust Root Certification Authority - G4 is a root CA certificate operated by Sectigo (RSA 4096, valid until 2037-12-27, SHA-256 DB3517D1). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/sectigo-entrust-root-ca-g4/
Last updated: 2026-11-10

Entrust Root Certification Authority - G4 is a root CA certificate operated by Sectigo (RSA 4096, valid until 2037-12-27, SHA-256 DB3517D1). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Sectigo |
| Subject | CN=Entrust Root Certification Authority - G4,OU=(c) 2015 Entrust\, Inc. - for authorized use only,OU=See www.entrust.net/legal-terms,O=Entrust\, Inc.,C=US |
| SHA-256 | DB3517D1F6732A2D5AB97C533EC70779EE3270A62FB4AC4238372460E6F01E88 |
| SPKI SHA-256 | 36D7C79F3D089A0FF79972D90923DEA5CA76B4CCBAF7C2751CB152E9494F52D0 |
| Valid from | 2015-05-27 |
| Expires | 2037-12-27 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | D9B5437FAFA9390F000000005565AD58 |
| SHA-1 (Windows thumbprint) | 14884E862637B026AF59625C4077EC3529BA9601 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | No | 2024-11-19 | Trust bits: Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.48 / Firefox 72; Inclusion bug: #1480510 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Document Signing, OCSP Signing, Secure Email, Time Stamping |

Mozilla stops trusting TLS certificates from this root issued after 2024-11-19. The CCADB lists EV policy OID 2.23.140.1.1, 2.16.840.1.114028.10.1.2 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 3 intermediate CA certificates signed directly by Entrust Root Certification Authority - G4: 0 currently valid, 0 expired and 3 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Entrust Digital Signing Root Certification Authority - DSR1 | Sectigo | 2030-12-30 | Revoked | 20FC75ACB2CAD7978C7B006A9B1523BFDAF5490AFCF49652C585E4A12F601C85 |
| Entrust Certification Authority - AATL1 | Entrust | 2037-12-20 | Revoked | 839F9B91C2E49218A66416DF181B984E9BE634D12A95483D98A6199FC0788D74 |
| Entrust Certification Authority - L1N | Entrust | 2030-12-22 | Revoked | B14D5089079C1D8F7649DB9A5D3CEFB1AAC06F66AFC49225C5BE2AA19FD41A35 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as Entrust Root Certification Authority - G4 with a different issuer, so a client has to carry Entrust Root Certification Authority - G4 itself in its root store to trust it.


## What happens when it expires

Entrust Root Certification Authority - G4 is valid until 2037-12-27, about 11.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Mozilla 2024-11-19.

## FAQ

**Is Entrust Root Certification Authority - G4 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not. Distrust-after dates already set: Mozilla 2024-11-19.

**When does Entrust Root Certification Authority - G4 expire?**

On 2037-12-27, about 11.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Entrust Root Certification Authority - G4 issued?**

The CCADB lists 3: 0 valid, 0 expired and 3 revoked.

**Is Entrust Root Certification Authority - G4 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).