# USERTrust ECC Certification Authority root certificate (Sectigo)

> USERTrust ECC Certification Authority is a root CA certificate operated by Sectigo (ECDSA P-384, valid until 2038-01-18, SHA-256 4FF460D5). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/sectigo-usertrust-ecc-ca/
Last updated: 2026-11-10

USERTrust ECC Certification Authority is a root CA certificate operated by Sectigo (ECDSA P-384, valid until 2038-01-18, SHA-256 4FF460D5). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Sectigo |
| Subject | CN=USERTrust ECC Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US |
| SHA-256 | 4FF460D54B9C86DABFBCFC5712E0400D2BED3FBC4D4FBDAA86E06ADCD2A9AD7A |
| SPKI SHA-256 | 2021917E98263945C859C43F1D73CB4139053C414FA03CA3BC7EE88614298F3B |
| Valid from | 2010-02-01 |
| Expires | 2038-01-18 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | 5C8B99C55A94C5D27156DECD8980CC26 |
| SHA-1 (Windows thumbprint) | D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2026-09-30 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: 1.3.6.1.4.1.6449.1.2.1.5.1; First included in: NSS 3.17.3 / Firefox 36; Inclusion bug: #606947 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2026-09-30 (sct_not_after). Mozilla treats it as an EV root for policy OID 1.3.6.1.4.1.6449.1.2.1.5.1.

## Intermediate CAs issued by this root

The CCADB lists 214 intermediate CA certificates signed directly by USERTrust ECC Certification Authority: 195 currently valid, 8 expired and 11 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| iTrust ECC DV SSL CA | Sectigo | 2034-11-05 | Valid | 94FD12939554F97054583CE858E1AA345FA22EF5F7CA7A80D3EE63C0688CAB56 |
| iTrust ECC OV SSL CA | Sectigo | 2034-11-05 | Valid | 8ECFADF063633CEF9DA78F7821691D3CBB32213105EAA0DC9F97BBEA9121D72E |
| iTrust ECC EV SSL CA | Sectigo | 2034-11-05 | Valid | 689BA8075005AAD64E63706950C486142A001D217131A9E2EAD84347B3C7299F |
| iTrust ECC Secure Email CA | Sectigo | 2034-11-05 | Valid | 506B33503BB6F79424F8249CFEFB0351C3677C00A20E17AB645732677AB506B7 |
| GZCA ECC EV SSL CA | Sectigo | 2034-09-17 | Valid | 54E1EC76C8134B3BAFB068616513B2AEC1219A6F6A98D995B7DAC057DB6290C5 |
| GZCA ECC OV SSL CA | Sectigo | 2034-09-17 | Valid | 420095BFEC065888FEFC201391A3BD053BB24DB44A51F155B46F3C8C578A8254 |
| TLC ECC EV SSL CA 2 | Sectigo | 2034-06-20 | Valid | B2B02F9B91B8CF4BC89BA1E000E60306B002AEA8A24C08B2D7F3DD8B8EADAEA5 |
| TLC ECC DV SSL CA 2 | Sectigo | 2034-06-20 | Valid | 356B78A4DB9ABCAC9EB8051D5A51143C6F93EF41DBAEFD7FDE2717B6A39DD6C4 |
| TLC ECC OV SSL CA 2 | Sectigo | 2034-06-20 | Valid | 2CB3C7F685709CA94748A829D034515D99ED447AC502F63C07D12ECCD337B161 |
| Apple Public Client ECC CA 50 - G1 | Apple Inc. | 2030-04-10 | Valid | 5F8AD1286DD9D1DAF23272E4E13CC995CCE5BE27BBF79029152BE09EF39ED296 |
| ZDNS ECC EV SSL CA | Sectigo | 2033-10-25 | Valid | F8E11AB7F833BBE93BD13BBED3E30A3EABA9E34A4510E344ABC93404C26D1801 |
| ZDNS ECC DV SSL CA | Sectigo | 2033-10-25 | Valid | E95EF2C74714C4F557B76EF2CFEBC3779F5011CDF572A2316D43357CCBF34896 |
| ZDNS ECC OV SSL CA | Sectigo | 2033-10-25 | Valid | 3DC272BDEE4E4604D498732C28C026963E3CB21DF198A29DB9428578B2447DA1 |
| CTI ECC Code Signing CA | Sectigo | 2033-08-01 | Valid | ED2F6940ACCF5E919142F4AEA3FD28CCB7DD6EDB3963A5244129D5399DADEDFB |
| CTI ECC OV SSL CA | Sectigo | 2033-08-01 | Valid | E98682C76B048510ADE4E70EDDB460102EBCA3BE4B8A11F25716756089B1C813 |
| 时代互联 ECC Secure Email CA | Sectigo | 2033-08-01 | Valid | E28C33D74EB5C3EA936AE55A5CBC4F1EBA9C604404032FB33DBF158D6AC821E5 |
| 时代互联 ECC OV SSL CA | Sectigo | 2033-08-01 | Valid | D1F35AFDA0483B9478B4DABB819F9887E8A7FBF6BE1B38B38CED919567C3E72E |
| Site Blindado ECC Organization Validation Secure Server CA 3 | Sectigo | 2033-08-01 | Valid | CFFD65450DD92A16792978A05FF239B2DB9EB7F48E9DFCDA2FC377184F2BBA66 |
| Site Blindado ECC Code Signing CA 3 | Sectigo | 2033-08-01 | Valid | C8474388A65232ABF5C711DFF0245569FF83D81D207F490362CF9538DE2364C7 |
| CTI ECC EV SSL CA | Sectigo | 2033-08-01 | Valid | C4BAADAF730EFC93441CF184D60951270315B065DD4200D8FA15D349B19469DC |

## Cross-signed versions

3 certificate(s) in the CCADB have the same subject and public key as USERTrust ECC Certification Authority but a different issuer. A server can send one of them so that clients which trust the issuing root, but not USERTrust ECC Certification Authority, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| AAA Certificate Services | Sectigo | 2028-12-31 | Valid | A6CF64DBB4C8D5FD19CE48896068DB03B533A8D1336C6256A87D00CBB3DEF3EA |
| AddTrust External CA Root | Sectigo | 2020-05-30 | Expired | 5578748AC97944D13CAE572A3794CF3C3B6D3A6B6752FD2A029713B16D8D2659 |
| AddTrust External CA Root | Sectigo | 2020-05-30 | Expired | C2B25BAD6F6ED65216CADAD7420BE9A3C787B7789F4C0222C35A2574BBACE92A |

## What happens when it expires

USERTrust ECC Certification Authority is valid until 2038-01-18, about 11.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2026-09-30.

## FAQ

**Is USERTrust ECC Certification Authority trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2026-09-30.

**When does USERTrust ECC Certification Authority expire?**

On 2038-01-18, about 11.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has USERTrust ECC Certification Authority issued?**

The CCADB lists 214: 195 valid, 8 expired and 11 revoked. The newest valid one is iTrust ECC DV SSL CA, valid until 2034-11-05.

**Is USERTrust ECC Certification Authority cross-signed?**

Yes. The CCADB has 3 cross-certificate(s) with its subject and key, signed by AAA Certificate Services, AddTrust External CA Root; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).