# UCA Extended Validation Root root certificate (SHECA)

> UCA Extended Validation Root is a root CA certificate operated by SHECA (RSA 4096, valid until 2038-12-31, SHA-256 D43AF9B3). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Mozilla, Microsoft.

Source: https://ssl.sh/roots/sheca-uca-extended-validation-root/
Last updated: 2026-11-10

UCA Extended Validation Root is a root CA certificate operated by SHECA (RSA 4096, valid until 2038-12-31, SHA-256 D43AF9B3). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Mozilla, Microsoft.

| Field | Value |
|---|---|
| CA owner | SHECA |
| Subject | CN=UCA Extended Validation Root,O=UniTrust,C=CN |
| SHA-256 | D43AF9B35473755C9684FC06D7D8CB70EE5C28E773FB294EB41EE71722924D24 |
| SPKI SHA-256 | 5C41A73AB2C35DFCD771F6FD6E3E8FAC9B469D386CADDA56A95B646EB48CCA34 |
| Valid from | 2015-03-13 |
| Expires | 2038-12-31 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 4FD22B8FF564C8339E4F345866237060 |
| SHA-1 (Windows thumbprint) | A3A1B06F2461234AE336A5C237FCA6FFDDF0D73A |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: NSS 3.41 / Firefox 65; Inclusion bug: #1309797 |
| Apple | Not included | No | - | - |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing |

Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 11 intermediate CA certificates signed directly by UCA Extended Validation Root: 3 currently valid, 0 expired and 8 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| SHECA EV TLS ECC CA C2 | Shanghai Electronic Certification Authority Co., Ltd. | 2035-04-27 | Valid | E3BF9CA7BC56D03EE6BAE52E3FBA47CAFE4198F2A026C8278087D82B951E428C |
| SHECA EV TLS RSA CA C1 | Shanghai Electronic Certification Authority Co., Ltd. | 2035-04-27 | Valid | 15F4F5D5A8D6DED4CDD54CE4E1B367203B7F2CDF416104BA5D6405AF55AC8045 |
| SHECA EV Server CA G3 | Shanghai Electronic Certification Authority Co., Ltd. | 2036-03-16 | Valid | 7EF3F89456CE636557B20C5DFB37F98C253A0B660D2E9E5E7845CAF9C038C7C1 |
| SHECA EV Code Signing CA G3 | Shanghai Electronic Certification Authority Co., Ltd. | 2039-05-27 | Revoked | E00AC33AC715D8BC3B6607A4165AE8428F9274B4224AB3D8CF36E8C8D62834A3 |
| SHECA OV Server CA G7 | Shanghai Electronic Certification Authority Co., Ltd. | 2038-03-28 | Revoked | F6F8BCD413C9733166E85843B468DD36E727152D9A37B15129C0E7648ECEE639 |
| SHECA OV Server CA G6 | Shanghai Electronic Certification Authority Co., Ltd. | 2037-11-08 | Revoked | 264DF1458FB5EF1FC9DF9F1345E84A6CC1A471CF475AE7598FF52B86713519FB |
| SHECA EV Code Signing CA G2 | Shanghai Electronic Certification Authority Co., Ltd. | 2036-03-16 | Revoked | DD84169585A2E7A216AECD4083265A8EB51A64F7C6F1943671F8584C73F79A74 |
| SHECA RSA Extended Validation Code Signing CA | Shanghai Electronic Certification Authority Co., Ltd. | 2033-04-27 | Revoked | D404FAFA4BA2F426B66CD219C6DA84F91C0FB7CB58429EC8077E2A764314D55D |
| SHECA RSA Extended Validation Server CA | Shanghai Electronic Certification Authority Co., Ltd. | 2033-04-27 | Revoked | 4FD6FA527157EEA463689D7A4C2B934EF222279725413893D9847242C85CA9DF |
| SHECA Extended Validation Code Signing CA | Shanghai Electronic Certification Authority Co., Ltd. | 2030-12-31 | Revoked | A392C645B9A5AD6A214F19DE776346BC7DD6BB15818E433886DAC54EE6661852 |
| SHECA Extended Validation SSL CA | Shanghai Electronic Certification Authority Co., Ltd. | 2030-12-31 | Revoked | 25BFDB1C5FE2CCE051EC6DFBF2BB24E78C92F969B1BB37867DAEDF93D1A7AE7E |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as UCA Extended Validation Root with a different issuer, so a client has to carry UCA Extended Validation Root itself in its root store to trust it.


## What happens when it expires

UCA Extended Validation Root is valid until 2038-12-31, about 12.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is UCA Extended Validation Root trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Chrome, Mozilla, Microsoft trust it for TLS server authentication; Apple do not.

**When does UCA Extended Validation Root expire?**

On 2038-12-31, about 12.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has UCA Extended Validation Root issued?**

The CCADB lists 11: 3 valid, 0 expired and 8 revoked. The newest valid one is SHECA EV TLS ECC CA C2, valid until 2035-04-27.

**Is UCA Extended Validation Root cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).