Root certificate · SI-TRUST

SI-TRUST Root

SI-TRUST Root is a root CA certificate operated by SI-TRUST (RSA 3072, valid until 2037-12-25, SHA-256 FAD54081). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

Data updated Nov 10, 2026

Root store status

Root store	Status	Trusted for TLS	Distrust for TLS after	Constrained
Chrome	Not included Not included	No	—	No
Mozilla	Not included Not included	No	—	No
Apple	Not included Not included	No	—	No
Microsoft	Included Included	Yes	—	Yes

The CCADB lists no EV policy OID for SI-TRUST Root.

Not included Chrome

Status: Not included

Not included Mozilla

Status: Not included

Not included Apple

Status: Not included

Included Microsoft

Status: Included
Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Document Signing, Encrypting File System, OCSP Signing, Secure Email, Time Stamping
Not-before cutoff: 2020-08-01 (Code Signing, Encrypting File System, OCSP Signing)

"Trusted for TLS" means the store includes the root with the server-authentication trust bit (Mozilla "Websites", Apple serverAuth, Microsoft Server Authentication EKU). Microsoft "NotBefore" means only certificates issued before a cutoff date are still trusted. "Constrained" means the store applies extra restrictions.

Details

CA owner: SI-TRUST
Subject: CN=SI-TRUST Root,2.5.4.97=VATSI-17659957,O=Republika Slovenija,C=SI
SHA-256: FAD540811AFAE0DC767CDF6572A088FA3CE8493DD82B3B869A67D10AAB4E8124
SHA-1 (Windows thumbprint): 3A4979B40FA841488200B582FBEEB63AAB9919AE
SPKI SHA-256: 21AE412566324725FFEFC1DCCF88F16F8D6BF4DBBB37FE8CABA47E8D66C2CDF9
Valid from: 2016-04-25
Expires: 2037-12-25
Key: RSA 3072
Signature algorithm: sha256WithRSAEncryption
Serial number: 90AE777600000000571DD06F
Country: SI
Trust bits (CCADB): Server Authentication, Client Authentication, Document Signing, Secure Email, Time Stamping
EV policy OIDs (CCADB): not EV-enabled · TLS EV capable: No
Test websites: valid: https://valid.si-trust.gov.si:1443 · expired: https://expired.si-trust.gov.si:2443 · revoked: https://revoked.si-trust.gov.si:3443
CCADB record: A004164
PEM: si-trust-root.pem

Look up this certificate on crt.sh

Intermediate CAs issued by this root

The CCADB lists 5 intermediate CA certificates signed directly by SI-TRUST Root: 3 currently valid, 2 expired and 0 revoked (revoked includes those whose parent was revoked).

Showing 5 of 5: valid certificates first, newest first. Each name links to its crt.sh entry by SHA-256; an arrow marks a cross-certificate for another root on this site.

Intermediate	Operated by	Expires	Status
SI-PASS-CA	SI-TRUST	2036-05-30	Valid
SIGOV-CA	SI-TRUST	2035-12-22	Valid
SIGEN-CA G2	SI-TRUST	2036-04-23	Valid
sigen-ca	SI-TRUST	2021-06-27	Expired
sigov-ca	SI-TRUST	2021-01-08	Expired

Cross-signed versions

No certificate in the CCADB has the same subject and public key as SI-TRUST Root with a different issuer, so a client has to carry SI-TRUST Root itself in its root store to trust it.

CRL and OCSP addresses

In the root certificate

SI-TRUST Root itself contains no CRL Distribution Points and no OCSP (Authority Information Access) extension. That is normal for a root: clients trust it directly and do not check its own revocation status.

Full CRL this CA publishes (CCADB)

http://www.ca.gov.si/crl/si-trust-root.crl

Used by the intermediates it issued

Addresses found in the CRL Distribution Points and OCSP fields of the 3 valid intermediates signed by SI-TRUST Root; the number in brackets is how many of them use each address.

CRL: http://www.ca.gov.si/crl/si-trust-root.crl (3)
CRL: ldap://x500.gov.si/cn=SI-TRUST%20Root,organizationIdentifier=VATSI-17659957,o=Republika%20Slovenija,c=SI?certificateRevocationList (3)
OCSP: http://ocsp.ca.gov.si (3)

What happens when it expires

SI-TRUST Root is valid until 2037-12-25, about 11.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

Check whether your device trusts it

Each platform keeps its own root store. The commands below look up SI-TRUST Root by common name (SI-TRUST Root) or fingerprint. The store status in each heading comes from the CCADB snapshot; your device can differ if it is out of date or managed by an administrator.

macOS (Apple store: Not included)

Search the system roots keychain by common name. -Z prints the SHA-256 hash, which must match the fingerprint on the last line.

security find-certificate -a -c "SI-TRUST Root" -Z \
  /System/Library/Keychains/SystemRootCertificates.keychain | grep "SHA-256"
# SHA-256 hash: FAD540811AFAE0DC767CDF6572A088FA3CE8493DD82B3B869A67D10AAB4E8124

Windows (Microsoft store: Included · Trusted for TLS)

Windows identifies roots by SHA-1 thumbprint. It installs third-party roots on demand through Automatic Root Certificates Update, so "not found" can also mean the root has not been needed yet; certutil -generateSSTFromWU roots.sst downloads Microsoft's full list.

certutil -verifystore Root 3A4979B40FA841488200B582FBEEB63AAB9919AE

Linux (ca-certificates follows Mozilla: Not included)

Debian, Ubuntu, Fedora and RHEL build their ca-certificates package from Mozilla's root store. Use trust list on p11-kit systems, or search the PEM bundle on Debian and Ubuntu.

# Fedora / RHEL / Arch (p11-kit)
trust list --filter=ca-anchors | grep -iF -A2 "SI-TRUST Root"
# Debian / Ubuntu (ca-certificates)
openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt \
  | openssl pkcs7 -print_certs -noout | grep -iF "SI-TRUST Root"

Java

Java ships its own cacerts keystore; JDK 9 and later accept -cacerts and the default store password is changeit. Search for the SHA-256 fingerprint in colon form.

keytool -list -cacerts -storepass changeit | grep -i "FA:D5:40:81:1A:FA:E0:DC:76:7C:DF:65:72:A0:88:FA:3C:E8:49:3D:D8:2B:3B:86:9A:67:D1:0A:AB:4E:81:24"

Android

Android's system store is maintained by Google separately from the four CCADB stores above. Open Settings → Security & privacy → More security settings → Encryption & credentials → Trusted credentials → System (menu names vary by vendor and version) and look for Republika Slovenija → SI-TRUST Root.

Which root does my site chain to?

List the chain your server sends and compare the last issuer with this root; the fingerprint check confirms a local copy.

Download PEM

# show subject (s:) and issuer (i:) of every certificate the server sends
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null \
  | grep -E '^ *[0-9]+ s:|^ *i:'
# subject and SHA-256 fingerprint of the downloaded PEM file
openssl x509 -in si-trust-root.pem -noout -subject -fingerprint -sha256
# sha256 Fingerprint=FA:D5:40:81:1A:FA:E0:DC:76:7C:DF:65:72:A0:88:FA:3C:E8:49:3D:D8:2B:3B:86:9A:67:D1:0A:AB:4E:81:24

FAQ

Is SI-TRUST Root trusted by Chrome, Firefox, Safari and Windows?

As of 2026-11-10, Microsoft trust it for TLS server authentication; Chrome, Mozilla, Apple do not.

When does SI-TRUST Root expire?

On 2037-12-25, about 11.1 years after the 2026-11-10 data snapshot.

How many intermediate certificates has SI-TRUST Root issued?

The CCADB lists 5: 3 valid, 2 expired and 0 revoked. The newest valid one is SI-PASS-CA, valid until 2036-05-30.

Is SI-TRUST Root cross-signed?

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources

CCADB — Resources (TLS Server Authentication report, All Included Root Certificate Trust Bit Settings)
CCADB — All Certificate Information (root and intermediate), CSV V5
CCADB — Mozilla Included CA Certificate Report
CCADB — Chrome / Mozilla / Apple / Microsoft TLS Server Authentication CSV