# TWCA Root Certification Authority root certificate (TWCA)

> TWCA Root Certification Authority is a root CA certificate operated by TWCA (RSA 2048, valid until 2030-12-31, SHA-256 BFD88FE1). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/twca-root-ca/
Last updated: 2026-11-10

TWCA Root Certification Authority is a root CA certificate operated by TWCA (RSA 2048, valid until 2030-12-31, SHA-256 BFD88FE1). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | TWCA |
| Subject | CN=TWCA Root Certification Authority,OU=Root CA,O=TAIWAN-CA,C=TW |
| SHA-256 | BFD88FE1101C41AE3E801BF8BE56350EE9BAD1A6B9BD515EDC5C6D5B8711AC44 |
| SPKI SHA-256 | 92C46879626EF2CC1ECEA50C72FB5E385844095F21CBF3B283CB82E6B9FC6A58 |
| Valid from | 2008-08-28 |
| Expires | 2030-12-31 |
| Key | RSA 2048 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 1 |
| SHA-1 (Windows thumbprint) | CF9E876DD3EBFC422697A3B5A37AA076A9062348 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: 1.3.6.1.4.1.40869.1.1.22.3; First included in: NSS 3.12.11 / Firefox 6.0.2; Inclusion bug: #518503 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping; Not-before cutoff: 2020-06-01 (Code Signing) |

Mozilla treats it as an EV root for policy OID 1.3.6.1.4.1.40869.1.1.22.3.

## Intermediate CAs issued by this root

The CCADB lists 7 intermediate CA certificates signed directly by TWCA Root Certification Authority: 1 currently valid, 3 expired and 3 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| TWCA Global Root CA | Taiwan-CA Inc. (TWCA) | 2030-10-28 | Valid | 8AD47F6D70A44FA80AF0F931125FFE3A76876FFAD219A4D40A13C038DC85E69E |
| TWCA InfoSec User CA | Taiwan-CA Inc. (TWCA) | 2024-10-28 | Expired | 074840E3A67DCD2600B6B004E1187AC80BDFE896CAF493DF94CC3D9A3CA68814 |
| TWCA InfoSec User CA | Taiwan-CA Inc. (TWCA) | 2022-06-08 | Expired | A97CA1375B91953E536A55476B0AC444C7086A951E490A3A3D13630A19F40CD4 |
| TaiCA Information Policy CA | Taiwan-CA Inc. (TWCA) | 2018-10-25 | Expired | 9A78623905B9D8E1C43D4D0C3BEE47A21A221F2E8843AC2E0A27633465F14C36 |
| TWCA InfoSec User CA | Taiwan-CA Inc. (TWCA) | 2028-10-12 | Revoked | C00A8183C9865A0847C01158F785A5F35DCB8B596C7BF46FD6497F72F02E5E32 |
| TWCA EVSSL Certification Authority | Taiwan-CA Inc. (TWCA) | 2021-06-10 | Revoked | 7F1229B48517F2A66BAE4E2E342500F33B273A5CFCB625481C3783CA1F5366BC |
| TaiCA Secure CA | Taiwan-CA Inc. (TWCA) | 2020-06-08 | Revoked | C983B2634C725D70B946451B83404ACAD6DF5CB28BA8C5FB821A34EC53B792E4 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as TWCA Root Certification Authority with a different issuer, so a client has to carry TWCA Root Certification Authority itself in its root store to trust it.


## What happens when it expires

TWCA Root Certification Authority is valid until 2030-12-31, about 4.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is TWCA Root Certification Authority trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Mozilla, Apple, Microsoft trust it for TLS server authentication; Chrome do not.

**When does TWCA Root Certification Authority expire?**

On 2030-12-31, about 4.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has TWCA Root Certification Authority issued?**

The CCADB lists 7: 1 valid, 3 expired and 3 revoked. The newest valid one is TWCA Global Root CA, valid until 2030-10-28.

**Is TWCA Root Certification Authority cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).