# SSL.com EV Root Certification Authority RSA R2 root certificate (SSL.com)

> SSL.com EV Root Certification Authority RSA R2 is a root CA certificate operated by SSL.com (RSA 4096, valid until 2042-05-30, SHA-256 2E7BF16C). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/ssl-com-ev-root-ca-rsa-r2/
Last updated: 2026-11-10

SSL.com EV Root Certification Authority RSA R2 is a root CA certificate operated by SSL.com (RSA 4096, valid until 2042-05-30, SHA-256 2E7BF16C). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | SSL.com |
| Subject | CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US |
| SHA-256 | 2E7BF16CC22485A7BBE2AA8696750761B0AE39BE3B2FE9D0CC6D4EF73491425C |
| SPKI SHA-256 | 7CD67C248F69D83FC2F9BB01DCB1F7AD67A363D046043796D0984C3A231F6BB0 |
| Valid from | 2017-05-31 |
| Expires | 2042-05-30 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 56B629CD34BC78F6 |
| SHA-1 (Windows thumbprint) | 743AF0529BD032A0F44A83CDD4BAA97B7C2EC49A |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2026-06-14 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: NSS 3.34 / Firefox 58; Inclusion bug: #1277336 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth; Allowed policies: Server Authentication, Client Authentication |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Document Signing, Encrypting File System, Secure Email, Time Stamping; Not-before cutoff: 2025-09-15 (Secure Email) |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2026-06-14 (sct_not_after). Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 21 intermediate CA certificates signed directly by SSL.com EV Root Certification Authority RSA R2: 10 currently valid, 0 expired and 11 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| SSL.com TLS RSA Root CA 2022 | SSL.com | 2038-11-03 | Valid | 6BCB147D41E9B577F40002A5C4BA08846737805AAFE8554DD0E72204F6007BA7 |
| E-Tugra EV TLS RSA CA R1 | SSL.com | 2032-02-26 | Valid | 24E7A0475697793ABF3E0DDB04D542FFE7C93CC71D19F6067144ACA89A4CA678 |
| SSL.com EV Code Signing Transit RSA CA R1 | SSL.com | 2037-02-24 | Valid | 05E038D0EE8EBB28D52C188469676F1B22F4DF79EB40D9BDC20BCD017782EA28 |
| SSL.com EV Code Signing Intermediate CA RSA R3 | SSL.com | 2034-03-22 | Valid | E98DDCC0D158876836CD4B6AD826C44BF0A59A363896CE266C9F0E6CEDC040BC |
| SSL.com EV SSL Enterprise Intermediate CA RSA R2 | SSL.com | 2034-03-22 | Valid | 9B25A6A7BD51BC5F5C4F06E0D1218FD370DD31FAFD5CD3B627C82F202F1B4657 |
| SSL.com EV SSL Intermediate CA RSA R3 | SSL.com | 2034-03-22 | Valid | 85DB0BEED0668D04D7074000F98E84B08D0FD5429FF4A262DE7CBC1528A1A1DA |
| SSL.com EV Root Certification Authority ECC | SSL.com | 2027-02-12 | Valid | 60EF412EABE7C3FC6399EED1B633B777747515B29D721B963DD258BC498AB292 |
| SSL.com EV Code Signing Intermediate CA RSA R2 | SSL.com | 2032-04-06 | Valid | D8D382E37D2F93811AA3D940EEF4C6EEA47BB3BA50271A8BF2E8C24CDD393C56 |
| SSL.com EV Root Certification Authority RSA R2 | SSL.com | 2042-04-05 | Valid | 89EFEB25096BA4CCD40AF4FB8756F0A4843995974822020914C4E859D932B7F3 |
| SSL.com EV Timestamping Intermediate CA RSA R1 | SSL.com | 2032-04-05 | Valid | 554E3AE314AFF264D3FDE7F2BBC818F2E734D94B336208EDEFE7C37B162B6A96 |
| Quantum EV Secure Code Signing RSA R1 | SSL.com | 2031-02-07 | Revoked | FE6702302434EB3371F57B86668E3C582A17BA1B753A7B73D40292007312E571 |
| Quantum Secure Site EV TLS RSA R1 | SSL.com | 2031-02-07 | Revoked | E836C135661901E0840E887AF6EE516C56550D644990C57BFA60E297C1517FFA |
| Quantum EV Secure Code Signing CN RSA R1 | SSL.com | 2031-02-07 | Revoked | 663DEA3F6F286EB1F192EA424B83E18081CE9D0116855623BEDCE8A8140D3A46 |
| Quantum Secure Site EV Pro TLS CN RSA R1 | SSL.com | 2031-02-07 | Revoked | 0291CF02849132F714E810C9D0B24DB37BAEABF8CC91781E6C338E141767C39B |
| EV TLS RSA ICA R1 | SSL.com | 2029-12-02 | Revoked | 613BC7B39C378241EE953BA1A519E8F5FE30223B0457F10CC35E30A4933BA13F |
| SSL X Y & Z EV TLS CA RSA R1 | SSL.com | 2029-08-19 | Revoked | FC55270FECC7CD8B139E34CB0E896606B2B03BBF5848930A50A251343A36D10C |
| InterCloud EV SSL Certificate CA RSA R3 | SSL.com | 2029-03-23 | Revoked | E56AEEEBF288069EEC2D6E198A27E19F9DF309135068CFA9354026943D24F3B1 |
| InterCloud EV SSL Certificate CA RSA | SSL.com | 2029-02-11 | Revoked | 1E61F80F20BA092D402CF3F46FFA242DD350363623C7714E1276798EABA140A2 |
| SSL.com EV Enterprise Intermediate CA RSA R1 | SSL.com | 2034-01-12 | Revoked | A1725CC3E2FE78AC09D73FCFC5F00104136E1841262D056C214778FEAE9760D3 |
| InterCloud Ventures CA for EV SSL RSA | SSL.com | 2029-01-13 | Revoked | 3964D85BEFA07FE1F1F932C0FEF2367DE58007C1045F964D3D2D0DD92105AA84 |

## Cross-signed versions

3 certificate(s) in the CCADB have the same subject and public key as SSL.com EV Root Certification Authority RSA R2 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not SSL.com EV Root Certification Authority RSA R2, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| SecureTrust CA | SSL.com | 2029-12-30 | Valid | B8D068DC6C66079A75669E55B0EA3E66FEF104739471EAFC3D167A68197234F6 |
| XRamp Global Certification Authority | SSL.com | 2034-12-30 | Valid | 856E1977F4A860E916356E9741EB5840D6CA42EF312A0BE26268784AFEAC462D |
| Certum Trusted Network CA | Asseco Data Systems S.A. | 2023-09-11 | Expired | B97176F21B6ED64609267B2D1A2A9FAF0C4DEBD44644DC85EB6AE986FC867D56 |

## What happens when it expires

SSL.com EV Root Certification Authority RSA R2 is valid until 2042-05-30, about 15.6 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2026-06-14.

## FAQ

**Is SSL.com EV Root Certification Authority RSA R2 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2026-06-14.

**When does SSL.com EV Root Certification Authority RSA R2 expire?**

On 2042-05-30, about 15.6 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has SSL.com EV Root Certification Authority RSA R2 issued?**

The CCADB lists 21: 10 valid, 0 expired and 11 revoked. The newest valid one is SSL.com TLS RSA Root CA 2022, valid until 2038-11-03.

**Is SSL.com EV Root Certification Authority RSA R2 cross-signed?**

Yes. The CCADB has 3 cross-certificate(s) with its subject and key, signed by SecureTrust CA, XRamp Global Certification Authority, Certum Trusted Network CA; 2 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).