# USERTrust RSA Certification Authority root certificate (Sectigo)

> USERTrust RSA Certification Authority is a root CA certificate operated by Sectigo (RSA 4096, valid until 2038-01-18, SHA-256 E793C9B0). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/sectigo-usertrust-rsa-ca/
Last updated: 2026-11-10

USERTrust RSA Certification Authority is a root CA certificate operated by Sectigo (RSA 4096, valid until 2038-01-18, SHA-256 E793C9B0). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Sectigo |
| Subject | CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US |
| SHA-256 | E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2 |
| SPKI SHA-256 | C784333D20BCD742B9FDC3236F4E509B8937070E73067E254DD3BF9C45BF4DDE |
| Valid from | 2010-02-01 |
| Expires | 2038-01-18 |
| Key | RSA 4096 |
| Signature algorithm | sha384WithRSAEncryption |
| Serial number | 1FD6D30FCA3CA51A81BBC640E35032D |
| SHA-1 (Windows thumbprint) | 2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2026-09-30 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: 1.3.6.1.4.1.6449.1.2.1.5.1; First included in: NSS 3.17.3 / Firefox 36; Inclusion bug: #606947 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2026-09-30 (sct_not_after). Mozilla treats it as an EV root for policy OID 1.3.6.1.4.1.6449.1.2.1.5.1.

## Intermediate CAs issued by this root

The CCADB lists 389 intermediate CA certificates signed directly by USERTrust RSA Certification Authority: 288 currently valid, 86 expired and 15 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| iTrust RSA EV SSL CA | Sectigo | 2034-11-05 | Valid | E6D7B5FB7E73CB420550C544FD2FABB044A4AE7A541A01EB748DD7C293442D7F |
| iTrust RSA OV SSL CA | Sectigo | 2034-11-05 | Valid | DFA704FA092B3F2B2734B6935BB1B73B7C09DCD75C111BD5D87EE9D4A759A7DA |
| iTrust RSA Code Signing CA | Sectigo | 2034-11-05 | Valid | D2FAFB3BD01D588C20A19EF4620DBC29928488F722AF79655E5FA5D5EF39F9E6 |
| iTrust RSA Secure Email CA | Sectigo | 2034-11-05 | Valid | 973F0A984FC266FD43B443206149DFCF813E0A570E6D617D85460EF60ACD9654 |
| iTrust RSA DV SSL CA | Sectigo | 2034-11-05 | Valid | 81AB7A1364FB37A1E23B364BB36FB0B13D2E597B6302ABFFCC52D393A7CD2324 |
| Apple Public Client RSA CA 14 - G1 | Apple Inc. | 2030-04-10 | Valid | C1A99C82AD9BC8A2D7B7D599EA2C572BA8CBE0614B6A01C9064F396AC6B124DF |
| TLC RSA EV SSL CA 2 | Sectigo | 2034-06-20 | Valid | 899BA55BEE006E2BBFD395C03F8BEE7EA9C9B528522CEC5E12BF0F58F90C4D26 |
| TLC RSA DV SSL CA 2 | Sectigo | 2034-06-20 | Valid | 4556A3D32A4B654200BA9907CED7486927D9F92F1E08A7AE760766AC37E7FD3A |
| TLC RSA OV SSL CA 2 | Sectigo | 2034-06-20 | Valid | 1DD0D512ADF919DFEFBFEE967524AA6A320B99132530BADF4D22178BFF9E4D1E |
| CloudSecure RSA Domain Validation Secure Server CA 2 | Sectigo | 2034-01-30 | Valid | EFD0668406130E43382CEADEEBB17E625CD77F528E288E8BEDAEB142E19BCE02 |
| CloudSecure RSA Extended Validation Secure Server CA 2 | Sectigo | 2034-01-30 | Valid | E9B9980C8A3F593F4D9E7DA3F497AFF8FB66E242C6CBA0D730E206559513FA5D |
| TrustSign BR RSA OV SSL CA 3 | Sectigo | 2034-01-30 | Valid | D66A9D196CD2C27D74D719CA2825C45846B543502376981378567797B8571D3A |
| CloudSecure RSA Code Signing CA 2 | Sectigo | 2034-01-30 | Valid | CE21274887AE5D3B1038D9514EA1E3F19F22096DB2BD106AEB93E2E3DAEB924A |
| TrustSign BR RSA EV SSL CA 3 | Sectigo | 2034-01-30 | Valid | A021D8E774C6A33C736BDB5C176925ADDF446C99679BCDCD82E5BD2EA5FE444D |
| Apple Public Client RSA CA 50 - G1 | Apple Inc. | 2030-04-10 | Valid | 9EC26DA7082782DE9ED89221DE7B02F7417557C261BA5BCB87CE68C0801E7341 |
| CloudSecure RSA Organization Validation Secure Server CA 2 | Sectigo | 2034-01-30 | Valid | 7242417DBAAD14A9B37FA9CD60BEA5654F20C3B5EF6DE883E95DDC58D48547A7 |
| CloudSecure RSA Secure Email CA 2 | Sectigo | 2034-01-30 | Valid | 5DC9A4589C91E992B435F5381A293C56DA845944315D063A3921651FA270A3ED |
| TrustSign BR RSA DV SSL CA 3 | Sectigo | 2034-01-30 | Valid | 264D980B48BB1DA32FBB147B81043445AC4C85639594BA15AD9A2B8836A2DAC0 |
| McAfee RSA Secure Email CA 3 | Sectigo | 2033-10-25 | Valid | BC0C07C421B489419BFEEB2A50D74E615B7CD7AA5D83CA95378143B6D923BF61 |
| ZDNS RSA EV SSL CA | Sectigo | 2033-10-25 | Valid | 41C29F80B918EF9605CDDCEBDBDB2683C310C5CF0AA7D8EBF6788393501E90B9 |

## Cross-signed versions

2 certificate(s) in the CCADB have the same subject and public key as USERTrust RSA Certification Authority but a different issuer. A server can send one of them so that clients which trust the issuing root, but not USERTrust RSA Certification Authority, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| AAA Certificate Services | Sectigo | 2028-12-31 | Valid | 68B9C761219A5B1F0131784474665DB61BBDB109E00F05CA9F74244EE5F5F52B |
| AddTrust External CA Root | Sectigo | 2020-05-30 | Expired | 1A5174980A294A528A110726D5855650266C48D9883BEA692B67B6D726DA98C5 |

## What happens when it expires

USERTrust RSA Certification Authority is valid until 2038-01-18, about 11.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2026-09-30.

## FAQ

**Is USERTrust RSA Certification Authority trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2026-09-30.

**When does USERTrust RSA Certification Authority expire?**

On 2038-01-18, about 11.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has USERTrust RSA Certification Authority issued?**

The CCADB lists 389: 288 valid, 86 expired and 15 revoked. The newest valid one is iTrust RSA EV SSL CA, valid until 2034-11-05.

**Is USERTrust RSA Certification Authority cross-signed?**

Yes. The CCADB has 2 cross-certificate(s) with its subject and key, signed by AAA Certificate Services, AddTrust External CA Root; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).