# Sectigo Public Server Authentication Root E46 root certificate (Sectigo)

> Sectigo Public Server Authentication Root E46 is a root CA certificate operated by Sectigo (ECDSA P-384, valid until 2046-03-21, SHA-256 C90F26F0). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/sectigo-public-server-authentication-root-e46/
Last updated: 2026-11-10

Sectigo Public Server Authentication Root E46 is a root CA certificate operated by Sectigo (ECDSA P-384, valid until 2046-03-21, SHA-256 C90F26F0). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Sectigo |
| Subject | CN=Sectigo Public Server Authentication Root E46,O=Sectigo Limited,C=GB |
| SHA-256 | C90F26F0FB1B4018B22227519B5CA2B53E2CA5B3BE5CF18EFE1BEF47380C5383 |
| SPKI SHA-256 | B0B56335468561F5BB9FA12D801784A633A572705D34F32B643445DFA8B005D1 |
| Valid from | 2021-03-22 |
| Expires | 2046-03-21 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | 42F2CCDA1B6937445F15FE752810B8F4 |
| SHA-1 (Windows thumbprint) | EC8A396C40F02EBC4275D49FAB1C1A5B67BED29A |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: NSS 3.92 / Firefox 117; Inclusion bug: #1817340 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication |

Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 103 intermediate CA certificates signed directly by Sectigo Public Server Authentication Root E46: 102 currently valid, 0 expired and 1 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| XServer ECC Organization Validation Secure Server CA | Sectigo | 2036-09-22 | Valid | A438D0F5F36B8899BA67DCC4A6C270850F72203B53E5CDD0EB42846D2B376239 |
| XServer ECC Domain Validation Secure Server CA | Sectigo | 2036-09-22 | Valid | A35EB5CDD1B1E090AC5EA3E58A8570091C18634636320FEDABFE40F65CC5A4A0 |
| XServer ECC Extended Validation Secure Server CA | Sectigo | 2036-09-22 | Valid | 0EC2FF94961236793A093DF0B0DE19C11F08EB5AD850AA066EA62DE2004C7F68 |
| CATrust ECC OV SSL CA 2 | Sectigo | 2036-03-24 | Valid | F3B5DEE60354F34F1171F636A767153C4EC2A40828A131A84D5FA0C42B8798A4 |
| CATrust ECC DV SSL CA 2 | Sectigo | 2036-03-24 | Valid | B56462CC3B077DB36E99E6EE98992F6F771280E1F2C7046877A2BFB575F980C3 |
| CATrust ECC EV SSL CA 2 | Sectigo | 2036-03-24 | Valid | A827607C8875556942C04621E00B2F4FBBC24D72D1BA2157327E94DB5B8822E9 |
| Sectigo CN Public Server Authentication CA OV E31 | Sectigo | 2031-03-24 | Valid | 96F8C11D27D17AA30F6039049962FE7A613751ECACD35BE085446E83E4A6C715 |
| Sectigo CN Public Server Authentication CA EV E31 | Sectigo | 2031-03-24 | Valid | 846574A0F1AA358732677895BFCE3B915657E12B0F44283FCC6B8FF5E131667C |
| Sectigo CN Public Server Authentication CA DV E31 | Sectigo | 2031-03-24 | Valid | 1C0E39018E328FC8BBFF35F5993287D0934DC44EF4311F44622AD5BF07351AB4 |
| XinChaCha Trust ECC OV SSL CA 2 | Sectigo | 2036-02-03 | Valid | EA6ED0BF00D0C7E9F143D84F570E292DD1D631F9129D961BE2EC8ECC67FCFBB9 |
| cnTrus ECC EV SSL CA 2 | Sectigo | 2036-02-03 | Valid | E315CE7477C0CE1874C489F027BB01DDCFBAD7D067B942F11E4C76EE59B72C13 |
| E-SAFER CYBERSECURITY ECC DV SSL CA 2 | Sectigo | 2036-02-03 | Valid | E0450E95C22D9ACC1F210DF45D3966312201A430E7B4A99E087936562CA1F50C |
| E-SAFER CYBERSECURITY ECC EV SSL CA 2 | Sectigo | 2036-02-03 | Valid | D77E532FCA2E536B3D2006B0AC2EFECB2F129D663D9475F87A258D8DE5E3955D |
| cnTrus ECC OV SSL CA 2 | Sectigo | 2036-02-03 | Valid | D3C8F9F195680A574CFC84828222CDFEF9EE24D1FE63ABA10015CA6ECFBFBA46 |
| XinChaCha Trust ECC EV SSL CA 2 | Sectigo | 2036-02-03 | Valid | D3C55B93369061B0CCBAA74F8142BD2A3570EA03C29C1C38953295F815F9949B |
| cnWebTrust ECC DV SSL CA 2 | Sectigo | 2036-02-03 | Valid | CB19B5773D79401BDE5DEFA70CA7B7682884A8EE61766A3EB6ACB1DF2B22B248 |
| cnWebTrust ECC OV SSL CA 2 | Sectigo | 2036-02-03 | Valid | 89B13FF3EA81B650BF72F850269D6AC6BBA49B5091A13F6F7CE3F31C0B426DF8 |
| cnTrus ECC DV SSL CA 2 | Sectigo | 2036-02-03 | Valid | 7969D8F0CF8C369DF82D318D82D4E2D9FDED95842FA3D7A548B9652B72749F6A |
| ZoTrus ECC DV SSL CA 2 | Sectigo | 2036-02-03 | Valid | 3E5028950D05210C26E71131B618781F9C27660BBB429D61AD163C347DF92E81 |
| sslTrus ECC DV SSL CA 2 | Sectigo | 2036-02-03 | Valid | 38F59E29D9EB402A727EEF56D463038769B3C69ED463D11BD450E05713BA8290 |

## Cross-signed versions

3 certificate(s) in the CCADB have the same subject and public key as Sectigo Public Server Authentication Root E46 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Sectigo Public Server Authentication Root E46, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| AAA Certificate Services | Sectigo | 2028-12-31 | Valid | 6802701F0FD0960FF2B51F39AAEB20A778D83261A959AD0D7FF0BE54240F673D |
| COMODO ECC Certification Authority | Sectigo | 2038-01-18 | Valid | 81C46F95EEF5683EF15ACDDD9AEC5A20BF22B6B5C048FE1AC95297FBED949F2A |
| USERTrust ECC Certification Authority | Sectigo | 2038-01-18 | Valid | EA6B89ED6907A209FF9188676FB164E7ACED894B8996DFBE5CE5BBCC22DE4DDD |

## What happens when it expires

Sectigo Public Server Authentication Root E46 is valid until 2046-03-21, about 19.4 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Sectigo Public Server Authentication Root E46 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does Sectigo Public Server Authentication Root E46 expire?**

On 2046-03-21, about 19.4 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Sectigo Public Server Authentication Root E46 issued?**

The CCADB lists 103: 102 valid, 0 expired and 1 revoked. The newest valid one is XServer ECC Organization Validation Secure Server CA, valid until 2036-09-22.

**Is Sectigo Public Server Authentication Root E46 cross-signed?**

Yes. The CCADB has 3 cross-certificate(s) with its subject and key, signed by AAA Certificate Services, COMODO ECC Certification Authority, USERTrust ECC Certification Authority; 3 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).