# Trustwave Global Certification Authority root certificate (SSL.com)

> Trustwave Global Certification Authority is a root CA certificate operated by SSL.com (RSA 4096, valid until 2042-08-23, SHA-256 97552015). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/ssl-com-trustwave-global-ca/
Last updated: 2026-11-10

Trustwave Global Certification Authority is a root CA certificate operated by SSL.com (RSA 4096, valid until 2042-08-23, SHA-256 97552015). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | SSL.com |
| Subject | CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US |
| SHA-256 | 97552015F5DDFC3C8788C006944555408894450084F100867086BC1A2BB58DC8 |
| SPKI SHA-256 | 2E06CAE1FC20B200E6FB748557A4444BEC9317DFFF2E4151669E0F7944F0A9E0 |
| Valid from | 2017-08-23 |
| Expires | 2042-08-23 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 5F70E86DA49F346352EBAB2 |
| SHA-1 (Windows thumbprint) | 2F8F364FE1589744215987A52A9AD06995267FB5 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Removed | No | - | - |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email, Time Stamping; Not-before cutoff: 2025-09-15 (Code Signing) |

The CCADB lists EV policy OID 2.23.140.1.1, 2.16.840.1.114404.1.1.2.4.1 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 18 intermediate CA certificates signed directly by Trustwave Global Certification Authority: 1 currently valid, 0 expired and 17 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| SSL.com TLS RSA Root CA 2022 | SSL.com | 2042-08-21 | Valid | DC1E4EDF2B35CC811E967444FB5D13BC017DC7E86527EF8A5A35109EC14A1CF3 |
| VikingCloud TWG TLS OV CA, Level 1 | SSL.com | 2035-02-24 | Revoked | B126AAD1C17CEE9EEF0F2CEDC06BC6786F19E48A079929F93C13AB48CA30EC60 |
| VikingCloud TWG TLS EV CA, Level 1 | SSL.com | 2035-02-24 | Revoked | 545AACD57FC0F24E92181853F8AD8E511D92624FDA83593B89E931FCEE82ED6A |
| VikingCloud TWG TLS IV CA, Level 1 | SSL.com | 2035-02-24 | Revoked | 4F879353F698CE839CB57B6F315BD227817B12AAEDF8FAC571F26AFCE01BE4EC |
| VikingCloud TWG TLS DV CA, Level 2 | SSL.com | 2035-02-24 | Revoked | 2FCA9DE7A0656B9F2655C8C903064B7EEA4785A40FB2707E1D6394682EB76998 |
| VikingCloud TWG TLS DV CA, Level 1 | SSL.com | 2034-08-28 | Revoked | 94B949699B74368B27FAD14D1EEF1F2AA2AD6AC24399A24399398B013FFB9601 |
| Viking Cloud TWG Timestamping CA, Level 1 | SSL.com | 2037-08-10 | Revoked | FA623A8BA0D6C69590593A62A67484EACCD1D3A7B19DCA78139DC3E30AC0B68A |
| Viking Cloud TWG Code Signing CA, Level 1 | SSL.com | 2032-08-10 | Revoked | E7EADE07201F519CC43A51D3F33D4EC3112D5A72D83EFB4104CBC1B306DAB762 |
| SecureTrust TWG Secure Email CA, Level 2 | SSL.com | 2030-10-08 | Revoked | ACCCAAF77372FFD2BD7BB21861B224EE1DAE8FE640D03A8FDE7518EC9B32508B |
| SecureTrust TWG Client CA, Level 3 | SSL.com | 2030-10-08 | Revoked | 5B78E6B05F0739429C50CDDEF3DBDC8813A456AB9619E82CF591392A9D0D3B26 |
| SecureTrust TWG Client CA, Level 2 | SSL.com | 2030-09-21 | Revoked | 729C7C2819CA196EC3C7E197C32FD930E8FE8B2FF8C78734A03B79535813E186 |
| SecureTrust TWG Secure Email CA, Level 1 | SSL.com | 2030-09-21 | Revoked | 15166E3B071EC2E2D28B8571E298D89B2426F2A904EBFA0835585FFD924585C1 |
| Trustwave Global Client CA, Level 1 | SSL.com | 2028-02-24 | Revoked | 95811E24BEC41B5F2BCCCAFEEADA7711404EDF6604B8FF119C2E433500990BEB |
| Trustwave Global Domain Validation CA, Level 1 | SSL.com | 2028-02-24 | Revoked | 6782C6E9ADBF9216E268306D46333FBC674BDEDF86B67BE777079E2C0E36888E |
| Trustwave Global Timestamping CA, Level 1 | SSL.com | 2042-08-21 | Revoked | 643B81C90B3505BFAFF80EAAC9EE28C9F406362A8F56DD26ECFA29335958C856 |
| Trustwave Global Code Signing CA, Level 1 | SSL.com | 2042-08-21 | Revoked | 4D10A086866731C0E16174192114C6076C7995DD5493006DD2054EFBD169AE2B |
| Trustwave Global Organization Validation CA, Level 1 | SSL.com | 2028-02-24 | Revoked | 2E63DC1BECF427F9902B49DE6330FD3E8EEBF88B14E653B3BA2E37D4E4880965 |
| Trustwave Global Extended Validation CA, Level 1 | SSL.com | 2028-02-24 | Revoked | 18626A3B7211128D563469C654557D13C9366D7FCEC8B94DB4F0AA7E05944041 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as Trustwave Global Certification Authority with a different issuer, so a client has to carry Trustwave Global Certification Authority itself in its root store to trust it.


## What happens when it expires

Trustwave Global Certification Authority is valid until 2042-08-23, about 15.8 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Trustwave Global Certification Authority trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does Trustwave Global Certification Authority expire?**

On 2042-08-23, about 15.8 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Trustwave Global Certification Authority issued?**

The CCADB lists 18: 1 valid, 0 expired and 17 revoked. The newest valid one is SSL.com TLS RSA Root CA 2022, valid until 2042-08-21.

**Is Trustwave Global Certification Authority cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).