# SecureTrust CA root certificate (SSL.com)

> SecureTrust CA is a root CA certificate operated by SSL.com (RSA 2048, valid until 2029-12-31, SHA-256 F1C1B50A). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/ssl-com-securetrust-ca/
Last updated: 2026-11-10

SecureTrust CA is a root CA certificate operated by SSL.com (RSA 2048, valid until 2029-12-31, SHA-256 F1C1B50A). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | SSL.com |
| Subject | CN=SecureTrust CA,O=SecureTrust Corporation,C=US |
| SHA-256 | F1C1B50AE5A20DD8030EC9F6BC24823DD367B5255759B4E71B61FCE9F7375D73 |
| SPKI SHA-256 | 77290717614B25F12964EBDB38B5F83CAADC0F6C36B0777F880FC6DEE1D339CC |
| Valid from | 2006-11-07 |
| Expires | 2029-12-31 |
| Key | RSA 2048 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | CF08E5C0816A5AD427FF0EB271859D0 |
| SHA-1 (Windows thumbprint) | 8782C6C304353BCFD29692D2593E7D44D934FF11 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Removed | No | - | - |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email, Time Stamping; Not-before cutoff: 2025-09-15 (Code Signing) |

The CCADB lists EV policy OID 2.23.140.1.1, 2.16.840.1.114404.1.1.2.4.1 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 33 intermediate CA certificates signed directly by SecureTrust CA: 7 currently valid, 1 expired and 25 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| SSL.com SecureTrust TLS OV Issuing RSA CA R2 | SSL.com | 2029-12-28 | Valid | 98B2C87811384E05264E35C020CFBE2346A25A2B26B8B4C6EE88848B32566A30 |
| SSL.com Root Certification Authority ECC | SSL.com | 2029-12-30 | Valid | A272F56F844FD9F8979FFF8C3CB18621454CB15BA419FC4427824B7BCD2D29B6 |
| SSL.com EV Root Certification Authority ECC | SSL.com | 2029-12-30 | Valid | 64BEB202D4BFBDDC7D0D8E7AB1CD3C25FB17F4AC031B83B75EE1BF53DB7D4341 |
| SSL.com EV Root Certification Authority RSA R2 | SSL.com | 2029-12-30 | Valid | B8D068DC6C66079A75669E55B0EA3E66FEF104739471EAFC3D167A68197234F6 |
| SSL.com Root Certification Authority RSA | SSL.com | 2029-12-30 | Valid | B3E86467D178F3CEBE11E739FC2169E4C7859078EC63FB40318981EF3A4EAB26 |
| SSL.com TLS ECC Root CA 2022 | SSL.com | 2029-12-30 | Valid | 469A5624CBF125C29B1C73AA4D05D4B2BF4F8400B5D569E9A4CA554AB4C4FAF5 |
| SSL.com TLS RSA Root CA 2022 | SSL.com | 2029-12-30 | Valid | 1B1DE06990CD0B305E2E124806103B1ADCFFC499F212504DC77F48DD0AD62209 |
| Trustwave Code Signing SHA256 CA, Level 1 | SSL.com | 2024-09-29 | Expired | 53A8129F71A9827D03704670720C375061821155C076E86A490D6EB871E03AF0 |
| SSL.com SecureTrust TLS Issuing RSA CA R1 | SSL.com | 2029-12-30 | Revoked | F1A05F6936FC0B814D21AE52B869F4E741B222A08A622E5D535B331DCD71E49C |
| Trustwave Global Certification Authority | SSL.com | 2029-12-17 | Revoked | C6B3C6DE45BC8AB925536A1DF0BECDE9C422BE1A06BA39142758C1ECC558680E |
| Viking Cloud Domain Validation CA, Level 1 | SSL.com | 2029-12-15 | Revoked | 386AD965DA24812016ED3F011F2112DFD591693DABEB3D0E61B1145F5F9D1217 |
| Viking Cloud Client Authentication CA, Level 1 | SSL.com | 2029-12-15 | Revoked | 115B4CCB4B7A8D2733085363311A3EE5A2603A4198483814E727181F0D45BB89 |
| Viking Cloud Extended Validation CA, Level 1 | SSL.com | 2029-12-15 | Revoked | 10B608E53E0F3F44432A32B906CD753001736AC8BFE90ED3A0847DF285E2D977 |
| Viking Cloud Organization Validation CA, Level 1 | SSL.com | 2029-12-15 | Revoked | 0EEF05BDA7842EA85D1D9812495EFC561283BAA90D1431C579DD61F7ED9269A1 |
| SecureTrust Extended Validation CA, Level 1 | SSL.com | 2029-01-29 | Revoked | DD23355C61D59970423004729795CAEF77AFDB39767A795740D4E04CB6158A99 |
| SecureTrust Domain Validation CA, Level 1 | SSL.com | 2029-01-29 | Revoked | 5E60965804461930AC27B6DBE3445679EAE4131C22AFB88AF7ACF6A1917B5ABA |
| SecureTrust Code Signing CA, Level 1 | SSL.com | 2029-01-29 | Revoked | 5E4FF34628DABED6859BACF2E128A807A08F49B0C259D9BE2E33FEE066AC7AF7 |
| SecureTrust Client Authentication CA, Level 1 | SSL.com | 2029-01-29 | Revoked | 2F50860F968053A7DBA17851341759B0D5C0412F857A2CD19F3731DD3BED1B6B |
| SecureTrust Organization Validation CA, Level 1 | SSL.com | 2029-01-29 | Revoked | 11D9330D1A2398508DD50D3094EB28B1B44900D9928F8C22B25EF7A781BDB403 |
| Trustwave Domain Validation SHA256 CA, Level 1 | SSL.com | 2024-09-29 | Revoked | 74F56E1AB339D83E80F2F6E264F894775B426C89B44703DF4FA8A3231163A2BD |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as SecureTrust CA with a different issuer, so a client has to carry SecureTrust CA itself in its root store to trust it.


## What happens when it expires

SecureTrust CA is valid until 2029-12-31, about 3.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is SecureTrust CA trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does SecureTrust CA expire?**

On 2029-12-31, about 3.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has SecureTrust CA issued?**

The CCADB lists 33: 7 valid, 1 expired and 25 revoked. The newest valid one is SSL.com SecureTrust TLS OV Issuing RSA CA R2, valid until 2029-12-28.

**Is SecureTrust CA cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).