# SSL.com Root Certification Authority ECC root certificate (SSL.com)

> SSL.com Root Certification Authority ECC is a root CA certificate operated by SSL.com (ECDSA P-384, valid until 2041-02-12, SHA-256 3417BB06). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/ssl-com-root-ca-ecc/
Last updated: 2026-11-10

SSL.com Root Certification Authority ECC is a root CA certificate operated by SSL.com (ECDSA P-384, valid until 2041-02-12, SHA-256 3417BB06). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | SSL.com |
| Subject | CN=SSL.com Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US |
| SHA-256 | 3417BB06CC6007DA1B961C920B8AB4CE3FAD820E4AA30B9ACBC4A74EBDCEBC65 |
| SPKI SHA-256 | A320F4D534D7BE97C1AE8DD0499735BC895C323ADD2D388BFCCF662C23D7F99A |
| Valid from | 2016-02-12 |
| Expires | 2041-02-12 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA256 |
| Serial number | 75E6DFCBC1685BA8 |
| SHA-1 (Windows thumbprint) | C3197C3924E654AF1BC4AB20957AE2C30E13026A |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2026-06-14 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.34 / Firefox 58; Inclusion bug: #1277336 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Document Signing, Encrypting File System, Secure Email, Time Stamping |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2026-06-14 (sct_not_after). The CCADB lists no EV policy OID for SSL.com Root Certification Authority ECC.

## Intermediate CAs issued by this root

The CCADB lists 26 intermediate CA certificates signed directly by SSL.com Root Certification Authority ECC: 10 currently valid, 0 expired and 16 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| SSL.com TLS ECC Root CA 2022 | SSL.com | 2040-02-15 | Valid | 1E6EBEF80676FD20D2597C1F45A5E198DD4C4CBF3328E522837196600C319141 |
| SSL.com Client Authentication Issuing ECC CA R1 | SSL.com | 2032-03-18 | Valid | E37FBC7CC5BDDB3D2DB27F6F71DB6C78A64974A718F7CDB59406B24F1977335A |
| SSL.com Document Signing Transit ECC CA R1 | SSL.com | 2037-03-17 | Valid | 683ABF185050ED924D58D73493F5452C73DC364611107C436FDC2391643D0D0F |
| SSL.com Client Authentication Transit ECC CA R1 | SSL.com | 2037-03-17 | Valid | 57DBBE6283F762C1EE40525F5872180230FDF489D0FBC93F7BA39DAAF4F6B3B7 |
| SSL.com Code Signing Transit ECC CA R1 | SSL.com | 2037-02-24 | Valid | 704F0FD395EA2FF06E6769A69627290453985A4FB5D923DA255D27D5739CB464 |
| E-Tugra TLS ECC CA R1 | SSL.com | 2032-02-26 | Valid | 108162F2B35ED71C6EA9502F94B93E9754789DDE871B2AC26CE06D47207A95CC |
| SSL.com Code Signing Intermediate CA ECC R2 | SSL.com | 2034-03-03 | Valid | F74E750A5DCF00D5E85168A60C963EC2AEBDCA3ADB0291D3281D8F521BA6A3BD |
| SSL.com Client Certificate Intermediate CA ECC R2 | SSL.com | 2034-03-03 | Valid | EAD0C5077C99F8FA40CC556DBC2EACA41F54E9D99EBD468956AEA8BEC5AAF76A |
| SSL.com SSL Intermediate CA ECC R2 | SSL.com | 2034-03-03 | Valid | 948B7111AF42F546D579CFF5CE2BDEC82134DD9914842BDDB0C52872EB604E39 |
| SSL.com NAESB Client Authentication Intermediate CA ECC R2 | SSL.com | 2034-03-03 | Valid | 1BD9D336C9045DC17426B99AC2652FAE31CB9DC2AC3E19B04390C24B0BD4A8A0 |
| TLS ECC ICA R1 | SSL.com | 2029-12-02 | Revoked | ED1FF4070F0868EB20A0319FC601919800F6E5EFD823A6156B27F89CB04B2C26 |
| S/MIME ECC ICA R1 | SSL.com | 2029-12-02 | Revoked | 60D355106DD6464F6ABE54FF59CDC68B9C9615E8B715271F57FC996F6CEF21DC |
| Document Signing ECC ICA R1 | SSL.com | 2029-12-02 | Revoked | 3B91C4CD67ABDF1D5272EEBB2E27A779EF02D820CE02F64B53B9DC5E786743B8 |
| Code Signing ECC ICA R1 | SSL.com | 2029-12-02 | Revoked | 037616326A342FC0780D4AFFB7344FF0E925D1E0FDE4782AB782F4ABD5B532B0 |
| SSL X Y & Z TLS CA ECC R1 | SSL.com | 2029-08-19 | Revoked | 7A7DADE08568FD3BFF2453E69B7A84D5BF4173B4BF58CD0643FF060C35F9165D |
| InterCloud Client Certificate CA ECC R3 | SSL.com | 2029-03-04 | Revoked | 70AB0FA1586CDCAF616E9468AD889957DB88B2FA513260D5BFB4D718624BC9AB |
| InterCloud SSL Certificate CA ECC R2 | SSL.com | 2029-03-04 | Revoked | 36CDCC7C8F383F7485658466FD950E753FCB019E250FD1BC1A06C5981D8A4188 |
| InterCloud Client Certificate CA ECC | SSL.com | 2029-02-11 | Revoked | F5D65A1301C046F8AAFB2DFB09AE84ACF67571769CEB62B9B676F3688BEB28F1 |
| InterCloud SSL Certificate CA ECC | SSL.com | 2029-02-11 | Revoked | A8A832362DE1DC7BB7C368E01DC617FB2FD7EAF36A97B361EA234F81241D3A75 |
| InterCloud Ventures CA for ClientCert ECC | SSL.com | 2029-01-13 | Revoked | 019D3AED2112F4A626CE24CC4DC2196DD19A010BD8B67516E7E554630510CDE2 |

## Cross-signed versions

3 certificate(s) in the CCADB have the same subject and public key as SSL.com Root Certification Authority ECC but a different issuer. A server can send one of them so that clients which trust the issuing root, but not SSL.com Root Certification Authority ECC, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| SSL.com Root Certification Authority RSA | SSL.com | 2027-02-12 | Valid | 06B9722A699C57DFF1869F430B479BB6EB49AAE1184EAC9C5325C1334A34EA4C |
| SecureTrust CA | SSL.com | 2029-12-30 | Valid | A272F56F844FD9F8979FFF8C3CB18621454CB15BA419FC4427824B7BCD2D29B6 |
| XRamp Global Certification Authority | SSL.com | 2034-12-30 | Valid | 3F47228BD9AC6738F87A806336673127CE2E3DA0DFFA0793355EE2EFFF203B9E |

## What happens when it expires

SSL.com Root Certification Authority ECC is valid until 2041-02-12, about 14.3 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2026-06-14.

## FAQ

**Is SSL.com Root Certification Authority ECC trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2026-06-14.

**When does SSL.com Root Certification Authority ECC expire?**

On 2041-02-12, about 14.3 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has SSL.com Root Certification Authority ECC issued?**

The CCADB lists 26: 10 valid, 0 expired and 16 revoked. The newest valid one is SSL.com TLS ECC Root CA 2022, valid until 2040-02-15.

**Is SSL.com Root Certification Authority ECC cross-signed?**

Yes. The CCADB has 3 cross-certificate(s) with its subject and key, signed by SSL.com Root Certification Authority RSA, SecureTrust CA, XRamp Global Certification Authority; 3 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).