# SSL.com Root Certification Authority RSA root certificate (SSL.com)

> SSL.com Root Certification Authority RSA is a root CA certificate operated by SSL.com (RSA 4096, valid until 2041-02-12, SHA-256 85666A56). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/ssl-com-root-ca-rsa/
Last updated: 2026-11-10

SSL.com Root Certification Authority RSA is a root CA certificate operated by SSL.com (RSA 4096, valid until 2041-02-12, SHA-256 85666A56). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | SSL.com |
| Subject | CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US |
| SHA-256 | 85666A562EE0BE5CE925C1D8890A6F76A87EC16D4D7D5F29EA7419CF20123B69 |
| SPKI SHA-256 | D1C45377EBDCD618CD1651DC2E02C21D751E5AA9FCD1B3431FF6ECF6A31348FA |
| Valid from | 2016-02-12 |
| Expires | 2041-02-12 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 7B2C9BD316803299 |
| SHA-1 (Windows thumbprint) | B7AB3308D1EA4477BA1480125A6FBDA936490CBB |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2026-06-14 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.34 / Firefox 58; Inclusion bug: #1277336 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Document Signing, Encrypting File System, Secure Email, Time Stamping |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2026-06-14 (sct_not_after). The CCADB lists no EV policy OID for SSL.com Root Certification Authority RSA.

## Intermediate CAs issued by this root

The CCADB lists 40 intermediate CA certificates signed directly by SSL.com Root Certification Authority RSA: 16 currently valid, 0 expired and 24 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| SSL.com Timestamping Issuing RSA CA 2 | SSL.com | 2041-02-12 | Valid | A06CEE4E0F3F70E5307DB186EAB839D5BCCE91BB65C9077099DCE31C16BFA5AD |
| SSL.com TLS RSA Root CA 2022 | SSL.com | 2040-02-15 | Valid | 336CD76B6C7F7878B3D4AB59B28982CBEE40804AABC9C2BEE98827B34CFFF2C0 |
| SSL.com Client Authentication Issuing RSA CA R1 | SSL.com | 2032-03-18 | Valid | 816CB0782117EEB32535CFFA12A7D40B60BD3B2258B79263F72D3D9F4B65C22C |
| SSL.com Document Signing Transit RSA CA R1 | SSL.com | 2037-03-17 | Valid | 1A6CD68DD63F3466C0E4808C4D663376D58426301772339823CFB6E5BC075BD3 |
| SSL.com Client Authentication Transit RSA CA R1 | SSL.com | 2037-03-17 | Valid | 0546601756A3F862E4DE2D1EDA3DB90EF271CAEF8D7B28A5FEE32D947269F137 |
| E-Tugra TLS RSA CA R1 | SSL.com | 2032-02-26 | Valid | 586A5C9836D9FB3BE863BA765A7966D940297FEC7BDD488016C7AA1EAE1F1D51 |
| SSL.com Timestamping Issuing RSA CA R1 | SSL.com | 2034-11-12 | Valid | 5F4D2C0E0CBA7D1FB600EDD3506D4331C866A11F20D137054EE39CF514576679 |
| SSL.com SSL Enterprise Intermediate CA RSA R1 | SSL.com | 2034-03-22 | Valid | EDAC9C45909F4DEC7BB65F0A4FBF6A8A0375E52AEDD66E06888FED7E3EDEC537 |
| SSL.com Client Certificate Intermediate CA RSA R2 | SSL.com | 2034-03-22 | Valid | B6E44A69342D84363AB12182F2D2B888501B063A76BEB00350E38DDC74715034 |
| SSL.com Client Certificate Enterprise Intermediate CA RSA R1 | SSL.com | 2034-03-22 | Valid | 17CD6504B275A6634EE0016EFFE53B26BFFCCA289C7DED4A1C8F4353CD05B09C |
| SSL.com Code Signing Enterprise Intermediate CA RSA R1 | SSL.com | 2034-03-22 | Valid | 11EADC5379B152C1A90D1DBE00722C53165B320031F5BA469ADF5902FDB1FA45 |
| SSL.com Root Certification Authority ECC | SSL.com | 2027-02-12 | Valid | 06B9722A699C57DFF1869F430B479BB6EB49AAE1184EAC9C5325C1334A34EA4C |
| SSL.com Client Certificate Intermediate CA RSA R1 | SSL.com | 2033-12-13 | Valid | 9B9C55D586F15F4FF0A12E3E87AA2AE5F6C0C218857E0DB4CC4A1BA74E493F54 |
| SSL.com NAESB Client Authentication Intermediate CA RSA R1 | SSL.com | 2033-07-02 | Valid | FC3F577DF125232A08E63DDA9AD74E10755750E1DFC80A9BF5281F411AE4C0EB |
| SSL.com Code Signing Intermediate CA RSA R1 | SSL.com | 2031-06-24 | Valid | 8F6D67C6F8FC5159A8E77A17099B74B9C96C0A7E1BC7D8EB86A08E0DC7681598 |
| SSL.com RSA SSL subCA | SSL.com | 2031-02-12 | Valid | 527A60B02ABF3A4A5519C4F62FBBD560E3034074EEEC8B8799AA9368693FE36D |
| Quantum Basic TLS DV RSA R1 | SSL.com | 2031-02-07 | Revoked | FCCF7CE88A642874D1C107F4D10C6A7DD334797639BA98130454562C303AF170 |
| Quantum Secure Code Signing CN RSA R1 | SSL.com | 2031-02-07 | Revoked | F1D12FBDA2BC4D6E6A080FB2B9D3D50326891BD2F46137FC173193E8B677AC84 |
| Quantum Secure Site DV TLS CN RSA R1 | SSL.com | 2031-02-07 | Revoked | E477EDF11EB54F6F2EDD56987B3DBF8AFA6B85507AE792AC63CD41CE41AC1397 |
| Quantum Secure Code Signing RSA R1 | SSL.com | 2031-02-07 | Revoked | CC548E5A702717EDF7AF08DB3A64CACF8F85416AA6E761DF01A9C51C4E3ACA90 |

## Cross-signed versions

3 certificate(s) in the CCADB have the same subject and public key as SSL.com Root Certification Authority RSA but a different issuer. A server can send one of them so that clients which trust the issuing root, but not SSL.com Root Certification Authority RSA, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| SecureTrust CA | SSL.com | 2029-12-30 | Valid | B3E86467D178F3CEBE11E739FC2169E4C7859078EC63FB40318981EF3A4EAB26 |
| XRamp Global Certification Authority | SSL.com | 2034-12-30 | Valid | 3F7BEFCE41F251B2282018FB73213A2116A3F4F692389335E04FF5AE33AB45DA |
| Certum Trusted Network CA | Asseco Data Systems S.A. | 2023-09-11 | Expired | ACF718DF838E640051777D1947F51620E8D804BA186553AE52FC9811B5D34B8B |

## What happens when it expires

SSL.com Root Certification Authority RSA is valid until 2041-02-12, about 14.3 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2026-06-14.

## FAQ

**Is SSL.com Root Certification Authority RSA trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2026-06-14.

**When does SSL.com Root Certification Authority RSA expire?**

On 2041-02-12, about 14.3 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has SSL.com Root Certification Authority RSA issued?**

The CCADB lists 40: 16 valid, 0 expired and 24 revoked. The newest valid one is SSL.com Timestamping Issuing RSA CA 2, valid until 2041-02-12.

**Is SSL.com Root Certification Authority RSA cross-signed?**

Yes. The CCADB has 3 cross-certificate(s) with its subject and key, signed by SecureTrust CA, XRamp Global Certification Authority, Certum Trusted Network CA; 2 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).