# TrustAsia TLS RSA Root CA root certificate (TrustAsia)

> TrustAsia TLS RSA Root CA is a root CA certificate operated by TrustAsia (RSA 4096, valid until 2044-05-15, SHA-256 06C08D7D). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Chrome, Mozilla.

Source: https://ssl.sh/roots/trustasia-tls-rsa-root-ca/
Last updated: 2026-11-10

TrustAsia TLS RSA Root CA is a root CA certificate operated by TrustAsia (RSA 4096, valid until 2044-05-15, SHA-256 06C08D7D). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Chrome, Mozilla.

| Field | Value |
|---|---|
| CA owner | TrustAsia |
| Subject | CN=TrustAsia TLS RSA Root CA,O=TrustAsia Technologies\, Inc.,C=CN |
| SHA-256 | 06C08D7DAFD876971EB1124FE67F847EC0C7A158D3EA53CBE940E2EA9791F4C3 |
| SPKI SHA-256 | 5628872E245FE66148B80BADEAC9C40F6252E642FA9595AECE4B3E8A58B8FD46 |
| Valid from | 2024-05-15 |
| Expires | 2044-05-15 |
| Key | RSA 4096 |
| Signature algorithm | sha384WithRSAEncryption |
| Serial number | 1C18D8CFE5533F2235465354243C6C47D15C4A9C |
| SHA-1 (Windows thumbprint) | A54650C562EA959A1AA7046F1758C729533D03FA |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: 3.114 / 142 |
| Apple | Not included | No | - | - |
| Microsoft | Not included | No | - | - |

Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 17 intermediate CA certificates signed directly by TrustAsia TLS RSA Root CA: 16 currently valid, 0 expired and 1 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| iTrust TLS RSA CA 2026 | TrustAsia Technologies, Inc. | 2029-09-18 | Valid | 85676EFCC0B077BAA73A96BD64ADE5B9B3B23030853BE58111DFADC215BD0833 |
| AutoCert TLS RSA CA 2026 | TrustAsia Technologies, Inc. | 2029-09-18 | Valid | 08A7AB3D9648891BFE763DE5DCB0197CF26AA11A97C7D73C43877CD6C16CB704 |
| DNSPod TLS RSA CA 2026 | TrustAsia Technologies, Inc. | 2029-04-28 | Valid | FD73D219CF20DA8B236FA8B8F181E584EC17D91DA4FEF6FA0B51ED7B107A666A |
| Unicom TLS RSA CA 2026 | TrustAsia Technologies, Inc. | 2029-04-28 | Valid | 6FF5FB96C87E5A384D61B25A5BDAE087F804DE20DDA876050CE10AC5018A5415 |
| Unicom DV TLS RSA CA 2026 | TrustAsia Technologies, Inc. | 2029-04-28 | Valid | 6DFF56CFA823978CB9AFF815C3C6986DFB360C63B324A2CB48F5B36335F6F344 |
| DNSPod DV TLS RSA CA 2026 | TrustAsia Technologies, Inc. | 2029-04-28 | Valid | 6B899E85B85932C3BDE04CD2B35365B7BD1950F318B0C32079373EF98B62422E |
| 宝塔 DV TLS RSA CA 2025 | TrustAsia Technologies, Inc. | 2030-10-21 | Valid | E85A05DE3274CEAB9F2BA4CE9297CABD81674F6DC62CF385E40BFE0A408630D7 |
| LiteSSL RSA CA 2025 | TrustAsia Technologies, Inc. | 2030-10-21 | Valid | AD4DF1416B387E6ABBF8612B5807C2A2B404F6AA3AA50EAB360FDE30EB6F0F11 |
| 宝塔 TLS RSA CA 2025 | TrustAsia Technologies, Inc. | 2030-10-21 | Valid | A38B6509D5EEC4E7C91DABAC460D30A75D2B408C86D2BBC7D45463815844CD40 |
| XinNet EV TLS RSA CA 2025 | TrustAsia Technologies, Inc. | 2030-10-21 | Valid | 8F2EE5A96CCD83A2B7FA82582A52B49AEFB1164B928F5E39A041288A6103DFD4 |
| XinNet DV TLS RSA CA 2025 | TrustAsia Technologies, Inc. | 2030-10-21 | Valid | 6B44BD0934E37E144307D5DE3591344C81482DCA70D7D8D6ECB4F59802FC0F85 |
| XinNet OV TLS RSA CA 2025 | TrustAsia Technologies, Inc. | 2030-10-21 | Valid | 5F8E084A637F101975F29272DC35EEB0AFDE0F857B519FB558319DE700CA5EC2 |
| LiteSSL Pro RSA CA 2025 | TrustAsia Technologies, Inc. | 2030-10-21 | Valid | 493582B1DEE123195F9C50B17697C56AC468747D5FE60E6C25AC739DBE5C2A97 |
| TrustAsia EV TLS RSA CA 2024 V2 | TrustAsia Technologies, Inc. | 2034-07-18 | Valid | D886C235FAFADD2E4734924CF58B4D8F0CB7065F0F5451B3E1C308F92EF7B2EB |
| TrustAsia OV TLS RSA CA 2024 | TrustAsia Technologies, Inc. | 2034-05-15 | Valid | D0B626C8AD93962296B3920106ED7FB3818FCB98E0B73E799141B42521335B0F |
| TrustAsia DV TLS RSA CA 2024 | TrustAsia Technologies, Inc. | 2034-05-15 | Valid | 5EB0217B928C2DE1170FCE110CACC3C89A42492E4F97F5AE1EB8CD54F8A68EEB |
| TrustAsia EV TLS RSA CA 2024 | TrustAsia Technologies, Inc. | 2034-05-15 | Revoked | 7584878B5216BA52A36978FE728356525BD7E07F3D39B50C49C394C02542C58C |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as TrustAsia TLS RSA Root CA but a different issuer. A server can send one of them so that clients which trust the issuing root, but not TrustAsia TLS RSA Root CA, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Certum Trusted Network CA | Asseco Data Systems S.A. | 2029-01-14 | Valid | CE0DF856EA6CC0EBE068F55C4CC4DE77DEF45CACB2D4E946D8ADE706666F5887 |

## What happens when it expires

TrustAsia TLS RSA Root CA is valid until 2044-05-15, about 17.5 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is TrustAsia TLS RSA Root CA trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Chrome, Mozilla trust it for TLS server authentication; Apple, Microsoft do not.

**When does TrustAsia TLS RSA Root CA expire?**

On 2044-05-15, about 17.5 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has TrustAsia TLS RSA Root CA issued?**

The CCADB lists 17: 16 valid, 0 expired and 1 revoked. The newest valid one is iTrust TLS RSA CA 2026, valid until 2029-09-18.

**Is TrustAsia TLS RSA Root CA cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by Certum Trusted Network CA; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).