# Sectigo Public Server Authentication Root R46 root certificate (Sectigo)

> Sectigo Public Server Authentication Root R46 is a root CA certificate operated by Sectigo (RSA 4096, valid until 2046-03-21, SHA-256 7BB647A6). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/sectigo-public-server-authentication-root-r46/
Last updated: 2026-11-10

Sectigo Public Server Authentication Root R46 is a root CA certificate operated by Sectigo (RSA 4096, valid until 2046-03-21, SHA-256 7BB647A6). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Sectigo |
| Subject | CN=Sectigo Public Server Authentication Root R46,O=Sectigo Limited,C=GB |
| SHA-256 | 7BB647A62AEEAC88BF257AA522D01FFEA395E0AB45C73F93F65654EC38F25A06 |
| SPKI SHA-256 | 0E8BB18BBEEFB381BE21BFC1A206D317298462AD104855F04A0542699708D3D4 |
| Valid from | 2021-03-22 |
| Expires | 2046-03-21 |
| Key | RSA 4096 |
| Signature algorithm | sha384WithRSAEncryption |
| Serial number | 758DFD8BAE7C0700FAA925A7E1C7AD14 |
| SHA-1 (Windows thumbprint) | AD98F9F3E47D753B65D482B3A45217BB6EF5E438 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: NSS 3.92 / Firefox 117; Inclusion bug: #1817340 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication |

Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 136 intermediate CA certificates signed directly by Sectigo Public Server Authentication Root R46: 135 currently valid, 0 expired and 1 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| BJCA RSA Extended Validation Secure Server CA | Sectigo | 2036-10-20 | Valid | BBF324C8E48E576540D7C14112A4F76AFB0209E5B6848F08D1B3DE75535F644E |
| BJCA RSA Organization Validation Secure Server CA | Sectigo | 2036-10-20 | Valid | 9FD2F9904FDA88ED75A7F793DB48B15EB9FD92B16B5A9305513063C94831FB0B |
| BJCA RSA Domain Validation Secure Server CA | Sectigo | 2036-10-20 | Valid | 1265B97FEAF3B82E570C3F09B4B4EA94C34ADA6DB9DD66B622AF1FDB083DE829 |
| XServer RSA Extended Validation Secure Server CA | Sectigo | 2036-09-22 | Valid | 94841540890E9DC3DCD6FA036F255079CDC3A3D409A3356F37725550DCE49C6A |
| XServer RSA Organization Validation Secure Server CA | Sectigo | 2036-09-22 | Valid | 6C71ABABC5EF15668E8978F0CEC7D52570F1D678717DBF342DE2C155F06F9C5D |
| XServer RSA Domain Validation Secure Server CA | Sectigo | 2036-09-22 | Valid | 5AA7D137D52F73FD57BFB31968C7D8925ACF2BE553774745FB7EB4BE1F36244E |
| MarketWare RSA Organization Validation Secure Server CA 4 | Sectigo | 2036-07-21 | Valid | 045B1122D0B7E74B867ABC87C56F90D4DF558169F252358B236C6D7AC3C35A28 |
| Sectigo CN Public Server Authentication CA OV R31 | Sectigo | 2031-03-24 | Valid | 9DB9B17B64516396F43DCC0311C950EBBC0BDC5F6C8C6854D704CE8C3BBF9537 |
| Sectigo CN Public Server Authentication CA EV R31 | Sectigo | 2031-03-24 | Valid | 949C599693C3BE5DB291EEDE97AD69E00C632B5B5054082185C360D7D6CCE737 |
| CATrust RSA OV SSL CA 2 | Sectigo | 2036-03-24 | Valid | 8F8C0C584646FB55E1EF42BF1C7886C1574B4AA25AA96E616B6A16BC2EDE1FA1 |
| CATrust RSA DV SSL CA 2 | Sectigo | 2036-03-24 | Valid | 347F43510DE1535D586EE862D0299CAA75662FD55E35CBDF8E231ABE1A337A76 |
| Sectigo CN Public Server Authentication CA DV R31 | Sectigo | 2031-03-24 | Valid | 2F3C8ECBE2157ED6756C93718602D74E28BD4EA04340D85AE6BCBEB5841ECE29 |
| CATrust RSA EV SSL CA 2 | Sectigo | 2036-03-24 | Valid | 090E2D63987BBAA108945C033646C66E8F4963F8021CBBD09B28ED03C518F15D |
| cnTrus RSA DV SSL CA 2 | Sectigo | 2036-02-03 | Valid | F659B59D5BFEC06DF86BE2D7978D55CA540FE603E7257EBB740280648AF5C3EF |
| cnTrus RSA OV SSL CA 2 | Sectigo | 2036-02-03 | Valid | F369A2A7F1CF3ABD1B5F8C68BC528B4976CE5E47AD9C4B4AE90AE9F69078B4CE |
| GlobeSSL RSA DV SSL CA 2 | Sectigo | 2036-02-03 | Valid | EBB15ED57516666035C343C3EB2D49F6B9EF85BC20FC12425759A2FCCBAE2287 |
| cnWebTrust RSA OV SSL CA 2 | Sectigo | 2036-02-03 | Valid | E1533EA2AD1E5B497ED168434380B76A0F8EB80AA626B45A00FCAD294B9EBD63 |
| XinChaCha Trust RSA DV SSL CA 2 | Sectigo | 2036-02-03 | Valid | DCC3F2DAC794463BA0EE149DC3374A130E8253C7F763D9B83A936C572B7077B1 |
| cnTrus RSA EV SSL CA 2 | Sectigo | 2036-02-03 | Valid | D35D20A84887BEF2FF6164911BFB0A4246475B94022E1ADAC27D8CA202F8805E |
| CerSign RSA DV SSL CA 2 | Sectigo | 2036-02-03 | Valid | D1155A85651741F0473CD1C754405EBF29C4E3DCFDA38EC3724E4543C5D1A7F1 |

## Cross-signed versions

3 certificate(s) in the CCADB have the same subject and public key as Sectigo Public Server Authentication Root R46 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Sectigo Public Server Authentication Root R46, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| AAA Certificate Services | Sectigo | 2028-12-31 | Valid | CE75580BC6796D3B3EA2C3E74259D0D403072408E960C77139C2FB5A3D9419E4 |
| COMODO RSA Certification Authority | Sectigo | 2038-01-18 | Valid | 481B043B61A2FC959D0E5A6546D5EDF49A474A8408E51EAA198800FB9EB9875B |
| USERTrust RSA Certification Authority | Sectigo | 2038-01-18 | Valid | 92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5 |

## What happens when it expires

Sectigo Public Server Authentication Root R46 is valid until 2046-03-21, about 19.4 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Sectigo Public Server Authentication Root R46 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does Sectigo Public Server Authentication Root R46 expire?**

On 2046-03-21, about 19.4 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Sectigo Public Server Authentication Root R46 issued?**

The CCADB lists 136: 135 valid, 0 expired and 1 revoked. The newest valid one is BJCA RSA Extended Validation Secure Server CA, valid until 2036-10-20.

**Is Sectigo Public Server Authentication Root R46 cross-signed?**

Yes. The CCADB has 3 cross-certificate(s) with its subject and key, signed by AAA Certificate Services, COMODO RSA Certification Authority, USERTrust RSA Certification Authority; 3 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).