# Entrust Root Certification Authority root certificate (Sectigo)

> Entrust Root Certification Authority is a root CA certificate operated by Sectigo (RSA 2048, valid until 2026-11-27, SHA-256 73C17643). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/sectigo-entrust-root-ca/
Last updated: 2026-11-10

Entrust Root Certification Authority is a root CA certificate operated by Sectigo (RSA 2048, valid until 2026-11-27, SHA-256 73C17643). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Sectigo |
| Subject | CN=Entrust Root Certification Authority,OU=(c) 2006 Entrust\, Inc.,OU=www.entrust.net/CPS is incorporated by reference,O=Entrust\, Inc.,C=US |
| SHA-256 | 73C176434F1BC6D5ADF45B0E76E727287C8DE57616C1E6E6141A2B2CBC7D8E4C |
| SPKI SHA-256 | 6DBFAE00D37B9CD73F8FB47DE65917AF00E0DDDF42DBCEAC20C17C0275EE2095 |
| Valid from | 2006-11-27 |
| Expires | 2026-11-27 |
| Key | RSA 2048 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 456B5054 |
| SHA-1 (Windows thumbprint) | B31EB1B740E36C8402DADC37D44DF5D4674952F9 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Removed | No | - | - |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security IKE Intermediate, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping |

The CCADB lists EV policy OID 2.23.140.1.1, 2.16.840.1.114028.10.1.2 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 18 intermediate CA certificates signed directly by Entrust Root Certification Authority: 2 currently valid, 7 expired and 9 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Entrust Root Certification Authority - G2 | Sectigo | 2026-11-26 | Valid | 65F0358FC93934CD5AAC43122F37948D7BD042D148E6FD88B2E65AA9AC399DDD |
| Entrust Root Certification Authority - EC1 | Sectigo | 2026-11-10 | Valid | 3FDE0D36E026B6E8EBE2C28883607C8651DE10BD6C1FCAD365E560F4EA2F3B03 |
| UIS-IntB-CA | Unisys Corporation | 2021-07-19 | Expired | D48EAA55C32E49431A53198776BEC719E5C3359D8CB5EE406016C184815D0429 |
| UIS-IntB-CA | Unisys Corporation | 2020-06-27 | Expired | 5E1DA6E92E2892BA6A73FC508E41F35F9F927E4684282980E17A013918A2EA50 |
| UIS-IntB-CA | Unisys Corporation | 2019-07-11 | Expired | DAD193FC8C249091221477AB22A4D36B8BCF5BAAD6C98722E1A244520257FCED |
| UIS-IntB-CA | Unisys Corporation | 2018-07-14 | Expired | 0E399F16B7533E3263C27CF90BF18C239FE17B05230206ACF41D2327B698D5B6 |
| Entrust Certification Authority - L1M | Sectigo | 2024-11-19 | Expired | CA290389E0D8C62A4083F628A39F52FE3F38B73199CFFAF7C0372378A440FB6A |
| Entrust Root Certification Authority - G2 | Sectigo | 2024-09-23 | Expired | 6B143C2005D5539CC22EAB5F772DB2A9FE87467FEFFA07FCF0A9F7D28274CA7A |
| Entrust Certification Authority - L1A | Entrust | 2017-01-05 | Expired | DBFF8D57050EED2210EB67B25CE9203FBBBADA1293950B41EB465950AD54495B |
| UIS-IntB-CA | Unisys Corporation | 2024-07-01 | Revoked | C5526461E26BCED934BF5173943EEDCE5773D2F31FB2E07EAFD83DD9BB6FEBFD |
| UIS-IntB-CA | Unisys Corporation | 2023-07-29 | Revoked | 337BB0C55F4D848CA79856B1598A6463FF5C59AAF00711C231F5A03E2301998A |
| UIS-IntB-CA | Unisys Corporation | 2022-07-28 | Revoked | EC29EFD0C5DD4453F9121BBE4C9CCEBE895955EAD873C92CFE743854F5B8F09C |
| Entrust Certification Authority - L1E | Entrust | 2026-11-19 | Revoked | 232F6367CF561E00C83E180A9FCA8546B3771FB450EBCB4A0526F8349C8CA139 |
| UIS-INTB2-CA | Entrust | 2020-07-16 | Revoked | F4A396C7C2A053EBE5A3CEEF4B8D8AA490A67B307F1F60B3E0A0786D74A1BCA7 |
| UIS-IntB-CA | Unisys Corporation | 2020-07-13 | Revoked | 7EE9378ACCAC4EFDD489571BBA04B77DCFAFEA761C67C599FFF8DCA12BE7DDFB |
| Entrust Certification Authority - L1E | Entrust | 2021-11-12 | Revoked | CD81453E6C678FBE6054E5CBD90C734FCCF7A0CDC993F47696771C770962F45A |
| Entrust Certification Authority - L1E | Entrust | 2021-11-12 | Revoked | 3C7A634E5778A0F731972B702DAE24B2CF2060219F607E69878B164C61A06C41 |
| Entrust Certification Authority - L1E | Entrust | 2019-12-10 | Revoked | 03A2B6EF02FF1AC934F2414A7967D67F5F27AFFDE34C63FDA61C5E0C7D6506C8 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as Entrust Root Certification Authority with a different issuer, so a client has to carry Entrust Root Certification Authority itself in its root store to trust it.


## What happens when it expires

Entrust Root Certification Authority is valid until 2026-11-27, about 0.0 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Entrust Root Certification Authority trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does Entrust Root Certification Authority expire?**

On 2026-11-27, about 0.0 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Entrust Root Certification Authority issued?**

The CCADB lists 18: 2 valid, 7 expired and 9 revoked. The newest valid one is Entrust Root Certification Authority - G2, valid until 2026-11-26.

**Is Entrust Root Certification Authority cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).