# SwissSign Gold CA - G2 root certificate (SwissSign AG)

> SwissSign Gold CA - G2 is a root CA certificate operated by SwissSign AG (RSA 4096, valid until 2036-10-25, SHA-256 62DD0BE9). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/swisssign-gold-ca-g2/
Last updated: 2026-11-10

SwissSign Gold CA - G2 is a root CA certificate operated by SwissSign AG (RSA 4096, valid until 2036-10-25, SHA-256 62DD0BE9). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | SwissSign AG |
| Subject | CN=SwissSign Gold CA - G2,O=SwissSign AG,C=CH |
| SHA-256 | 62DD0BE9B9F50A163EA0F8E75C053B1ECA57EA55C8688F647C6881F2C8357B95 |
| SPKI SHA-256 | 40FCFC28875DCCBFEBCBDF6CD7433312DA63C4EFCF3BD7B1B505C22020AE0274 |
| Valid from | 2006-10-25 |
| Expires | 2036-10-25 |
| Key | RSA 4096 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | BB401C43F55E4FB0 |
| SHA-1 (Windows thumbprint) | D8C5388AB7301B1B6ED47AE645253A6F9F1A2761 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | No | - | Trust bits: Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.11.9 / Firefox 2; Inclusion bug: #343756 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email; Not-before cutoff: 2021-08-01 (Code Signing) |

The CCADB lists EV policy OID 2.23.140.1.1, 2.16.756.1.89.1.2.1.1 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 23 intermediate CA certificates signed directly by SwissSign Gold CA - G2: 3 currently valid, 1 expired and 19 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| SwissSign RSA SMIME Root CA 2022 - 1 | SwissSign AG | 2036-09-22 | Valid | 5A84C94054D340D650A29985EF97BB396352E215AED6C0B33CA7FFDD3BD5D2A2 |
| SwissSign RSA TLS Root CA 2022 - 1 | SwissSign AG | 2036-09-22 | Valid | 288B4A9F605B09B999B215850825C81F9B537DBAF23664ACA98BF6BA98EDC379 |
| SwissSign RSA SMIME Root CA 2021 - 1 | SwissSign AG | 2036-10-23 | Valid | BC8BBD7D279D2E5F070BCEF6FAF3AAB1BEF30DA3EB2875424295AD147F2AEF07 |
| Trend Micro Gold CA | SwissSign AG | 2017-11-01 | Expired | 9C6BA9A0922D889935888F257D99BB8BADA6E38F10DA7FC4D55F51F90DEF9BF1 |
| SwissSign RSA TLS Root CA 2021 - 1 | SwissSign AG | 2036-10-23 | Revoked | 4E5666DAC579161CF00B8D87046D074D6C9C0C0E3994C653BE57998736C55D93 |
| SwissSign CH Person Gold CA 2017 - G22 | SwissSign AG | 2032-12-18 | Revoked | 0F406E947393BF050AA59B1B86FC0FBF7BAA6D469176FF52A7B085128280BD40 |
| SwissSign Personal Gold CA 2014 - G22 | SwissSign AG | 2029-09-15 | Revoked | 77D6C2AF5A7B86F63D9918C87533779F2AF08D35CFA14DA4938C803F53DE18A1 |
| SwissSign Server Gold CA 2014 - G22 | SwissSign AG | 2029-09-15 | Revoked | 561DC78351F5E7EE5A464AC6E58A0D164EF2768F98F02E6EE65501120FCD9C5E |
| SwissSign EV Gold CA 2014 - G22 | SwissSign AG | 2035-03-04 | Revoked | A434AAE4E15A5519E9B111FD08EC190FD2ADF13BBE30815C6E1606555CB31450 |
| SwissSign Personal Gold CA 2014 - G22 | SwissSign AG | 2029-09-11 | Revoked | 6A1190BBB7CF20FA9331D2FD385444FCD027181F0E488D5EDA5C67EC567A0392 |
| SwissSign Server Gold CA 2014 - G22 | SwissSign AG | 2029-09-11 | Revoked | 11EF7BA62109144944F15CAD40C3F9FA860683A63551E603395CF05B2298D999 |
| PKI SwissPost EXT Machine CA TEST | SwissSign AG | 2026-04-02 | Revoked | D263F0E43414EB88C4D4D858924B07A4A592654FB99E47BECFC66669BB8E3DB9 |
| PKI SwissPost EXT Machine CA | SwissSign AG | 2026-04-02 | Revoked | 2DF0597BD3395F54116BA21FA397F5AE8916F8E3BA7719B0EDB54F2BA250DB1C |
| Nestle External CA | SwissSign AG | 2018-02-10 | Revoked | B321B97DA80A044609D37C6F9F1071084DF38A599CCA8888097534DCFE4F95F9 |
| AffirmTrust Networking | SwissSign AG | 2019-11-02 | Revoked | F2D15E3A4872DFE9AE9114DC19B1B436614BE08486A61069E6787E81D86A12C4 |
| AffirmTrust Commercial | SwissSign AG | 2019-11-02 | Revoked | B102959F862B71B78EFDC7FA9F43B3AFD7E52312A07493A752835B991D840F4C |
| Trend Micro Gold CA | SwissSign AG | 2019-11-01 | Revoked | 98C967747ED97A1D9E1767A986B796165D9E95EFAD3D68FC5712E4AE97D5F21C |
| Trend Micro Gold CA | SwissSign AG | 2019-11-02 | Revoked | 6608D839E79554E51475124729EBF4A9724EA63D54B430FC0E7E3B60A0C817B2 |
| AffirmTrust Networking | SwissSign AG | 2019-11-01 | Revoked | 3A612C8EE7D827032487A1FC4D7FE8296853595305571B68F94415C3D33E7A35 |
| SwissSign EV Gold CA 2009 - G2 | SwissSign AG | 2024-06-06 | Revoked | F9C26B91A186217860DC5AA1A69874947865AEC156D89FAC9B18660EA829C25E |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as SwissSign Gold CA - G2 with a different issuer, so a client has to carry SwissSign Gold CA - G2 itself in its root store to trust it.


## What happens when it expires

SwissSign Gold CA - G2 is valid until 2036-10-25, about 10.0 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is SwissSign Gold CA - G2 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does SwissSign Gold CA - G2 expire?**

On 2036-10-25, about 10.0 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has SwissSign Gold CA - G2 issued?**

The CCADB lists 23: 3 valid, 1 expired and 19 revoked. The newest valid one is SwissSign RSA SMIME Root CA 2022 - 1, valid until 2036-09-22.

**Is SwissSign Gold CA - G2 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).