CCADB Report - Externally Operated S/MIME Subordinate CAs and Cross-signed Root CAs
62 views
Skip to first unread message
Ben Wilson
Jun 17, 2026, 5:57:10 PM (13 days ago) Jun 17
to SMIME Certificate Working Group
| Certificate Issuer Common Name | Certificate Subject Common Name |
| AAA Certificate Services | Apple Public Client RSA CA 12 - G1 |
| Certum Trusted Network CA | UCA Global G2 Root |
| Certum Trusted Network CA | UCA Global G2 Root |
| DigiCert Trusted Root G4 | Apple Public Client RSA CA 3 - G1 |
| Entrust Enterprise Intermediate CA - ICA1 | Siemens Intermediate CA 2021 |
| GlobalSign Root CA | GTS Root R1 |
| GlobalSign Root CA | GTS Root R4 |
| IdenTrust Public Sector Root CA 1 | TrustID CA A14 |
| IdenTrust Public Sector Root CA 1 | TrustID SAIC Public Email Issuing CA 2 |
| IdenTrust Public Sector Root CA 1 | TrustID SAIC Public Email Issuing CA |
| IdenTrust Public Sector Root CA 1 | TrustID CA A13 |
| Saudi National Root CA | BTC Licensed CA |
| Saudi National Root CA | STCS Intermediary CA |
| Saudi National Root CA | Tamkeen Intermediate CA G1 |
| SecureTrust CA | SSL.com Root Certification Authority RSA |
| SecureTrust CA | SSL.com EV Root Certification Authority RSA R2 |
| SecureTrust CA | SSL.com Root Certification Authority ECC |
| SecureTrust CA | SSL.com EV Root Certification Authority ECC |
| Security Communication RootCA2 | Cybertrust Japan SureMail CA G4 |
| Security Communication RootCA2 | Cybertrust Japan SureMail CA G5 |
| Staat der Nederlanden Burger CA - G3 | Cleverbase ID PKIoverheid Burger CA - G3 |
| Staat der Nederlanden Burger CA - G3 | Digidentity BV PKIoverheid Burger CA - 2021 |
| Staat der Nederlanden Burger CA - G3 | DigiCert QuoVadis PKIoverheid Burger CA - 2023 |
| Staat der Nederlanden Organisatie Persoon CA - G3 | Digidentity BV PKIoverheid Organisatie Persoon CA - G3 |
| Staat der Nederlanden Organisatie Persoon CA - G3 | UZI-register Medewerker op naam CA G3 |
| Staat der Nederlanden Organisatie Persoon CA - G3 | UZI-register Zorgverlener CA G3 |
| Staat der Nederlanden Organisatie Persoon CA - G3 | Ministerie van Defensie PKIoverheid Organisatie Persoon CA - G3 |
| Staat der Nederlanden Organisatie Persoon CA - G3 | DigiCert QuoVadis PKIoverheid Organisatie Persoon CA - 2023 |
| Staat der Nederlanden Organisatie Persoon CA - G3 | QuoVadis PKIoverheid Organisatie Persoon CA - G3 |
| Staat der Nederlanden Organisatie Persoon CA - G3 | KPN BV PKIoverheid Organisatie Persoon CA - G3 |
| Staat der Nederlanden Organisatie Persoon CA - G3 | UZI-register Medewerker op naam CA G3 |
| Staat der Nederlanden Organisatie Persoon CA - G3 | UZI-register Zorgverlener CA G3 |
| Staat der Nederlanden Organisatie Services CA - G3 | UZI-register Medewerker niet op naam CA G3 |
| Staat der Nederlanden Organisatie Services CA - G3 | Digidentity BV PKIoverheid Organisatie Services CA - 2021 |
| Staat der Nederlanden Organisatie Services CA - G3 | QuoVadis PKIoverheid Organisatie Services CA - 2022 |
| Staat der Nederlanden Organisatie Services CA - G3 | DigiCert QuoVadis PKIoverheid Organisatie Services CA - 2023 |
| Staat der Nederlanden Organisatie Services CA - G3 | QuoVadis PKIoverheid Organisatie Services CA - G3 |
| Staat der Nederlanden Organisatie Services CA - G3 | KPN BV PKIoverheid Organisatie Services CA - G3 |
| Staat der Nederlanden Organisatie Services CA - G3 | UZI-register Medewerker niet op naam CA G3 |
| Tamkeen Intermediate CA G1 | Tamkeen Natural Person CA G1 |
| Tamkeen Intermediate CA G1 | Tamkeen Legal Person CA G1 |
| Thailand National Root Certification Authority - G1 | INET CA - G1 |
| Thailand National Root Certification Authority - G1 | Thai Digital ID CA G3 |
| T-TeleSec GlobalRoot Class 2 | DFN-Verein Certification Authority 2 |
| USERTrust ECC Certification Authority | Apple Public Client ECC CA 50 - G1 |
| USERTrust RSA Certification Authority | Apple Public Client RSA CA 50 - G1 |
| USERTrust RSA Certification Authority | Apple Public Client RSA CA 14 - G1 |
| XRamp Global Certification Authority | SSL.com Root Certification Authority ECC |
| XRamp Global Certification Authority | SSL.com Root Certification Authority RSA |
| XRamp Global Certification Authority | SSL.com EV Root Certification Authority ECC |
| XRamp Global Certification Authority | SSL.com EV Root Certification Authority RSA R2 |
Earlier today during our S/MIME WG meeting, Stephen asked how many cross-signed S/MIME CA certificates there were. Above is a list of 51 Intermediate CAs "cross-signed" (i.e. I ran a filter selecting those where the "Audits Same as Parent" was not checked), or what are also called Externally Operated Third Party S/MIME CAs or "Unconstrained SubCAs".
Below is a list of sixty (60) S/MIME roots where the CA Owner has indicated the root is either cross-signed by another CA owner/operator, cross-signed by another root certificate, or has issued an externally operated sub CA. (Additional information is not collected in the CCADB.)
| Root Certificate Name | Valid To (GMT) | Cross Signed by Another CA Operator? | Cross Signed by Another Root Cert? | Has Externally Operated SubCAs? |
| AAA Certificate Services | 12/31/2028 | No | No | Yes |
| Amazon Root CA 1 | 1/17/2038 | No | Yes | Yes |
| Amazon Root CA 2 | 5/26/2040 | No | Yes | Yes |
| Amazon Root CA 3 | 5/26/2040 | No | Yes | Yes |
| Amazon Root CA 4 | 5/26/2040 | No | Yes | Yes |
| Autoridade Certificadora Raiz Brasileira v5 | 3/2/2029 | No | No | Yes |
| CCA India 2022 | 2/2/2042 | No | No | Yes |
| Certum Trusted Network CA | 12/31/2029 | No | Yes | No |
| Certum Trusted Network CA 2 | 10/6/2046 | No | Yes | No |
| COMODO ECC Certification Authority | 1/18/2038 | No | Yes | Yes |
| COMODO RSA Certification Authority | 1/18/2038 | No | Yes | No |
| DigiCert Global Root CA | 11/10/2031 | No | Yes | No |
| DigiCert Global Root G2 | 1/15/2038 | No | No | Yes |
| DigiCert Global Root G3 | 1/15/2038 | No | Yes | Yes |
| DigiCert High Assurance EV Root CA | 11/10/2031 | No | Yes | Yes |
| DigiCert Trusted Root G4 | 1/15/2038 | No | Yes | No |
| D-Trust SBR Root CA 2 2022 | 7/7/2037 | No | Yes | No |
| EC-ACC | 1/7/2031 | No | No | Yes |
| Entrust Root Certification Authority | 11/27/2026 | No | Yes | Yes |
| Entrust Root Certification Authority - EC1 | 12/18/2037 | No | Yes | No |
| Entrust Root Certification Authority - G2 | 12/7/2030 | No | Yes | Yes |
| Entrust SMIME Root CA - 2022 | 12/7/2047 | No | Yes | No |
| Entrust.net Certification Authority (2048) | 7/24/2029 | No | Yes | Yes |
| Global Chambersign Root - 2008 | 7/31/2038 | No | No | Yes |
| GLOBAL CHAMBERSIGN ROOT - 2016 | 4/8/2040 | No | No | Yes |
| GlobalSign | 12/10/2034 | Yes | Yes | No |
| GlobalSign | 1/19/2038 | Yes | Yes | No |
| GlobalSign | 3/18/2029 | Yes | Yes | Yes |
| GlobalSign Root CA | 1/28/2028 | No | No | Yes |
| GlobalSign Secure Mail Root E45 | 3/18/2045 | No | Yes | No |
| GlobalSign Secure Mail Root R45 | 3/18/2045 | No | Yes | No |
| Go Daddy Class 2 Certification Authority | 6/29/2034 | No | Yes | No |
| Go Daddy Root Certificate Authority - G2 | 12/31/2037 | No | Yes | No |
| GTS Root R1 | 6/22/2036 | Yes | Yes | No |
| GTS Root R1 | 6/22/2036 | Yes | Yes | No |
| Hellenic Academic and Research Institutions ECC RootCA 2015 | 6/30/2040 | No | Yes | No |
| Hellenic Academic and Research Institutions RootCA 2015 | 6/30/2040 | No | Yes | No |
| IdenTrust Commercial Root CA 1 | 1/16/2034 | Yes | No | No |
| Saudi National Root CA | 11/29/2029 | No | No | Yes |
| Sectigo Public Email Protection Root E46 | 3/21/2046 | No | Yes | No |
| Sectigo Public Email Protection Root R46 | 3/21/2046 | No | Yes | No |
| Security Communication RootCA2 | 5/29/2029 | No | No | Yes |
| SSL.com Client ECC Root CA 2022 | 8/19/2046 | Yes | No | No |
| SSL.com Client RSA Root CA 2022 | 8/19/2046 | Yes | No | No |
| SSL.com Root Certification Authority ECC | 2/12/2041 | No | Yes | No |
| SSL.com Root Certification Authority RSA | 2/12/2041 | Yes | Yes | No |
| Staat der Nederlanden Root CA - G3 | 11/13/2028 | No | No | Yes |
| Starfield Class 2 Certification Authority | 6/29/2034 | No | Yes | Yes |
| Starfield Root Certificate Authority - G2 | 12/31/2037 | No | Yes | Yes |
| Starfield Services Root Certificate Authority - G2 | 12/31/2037 | Yes | Yes | No |
| Symantec Class 1 Public Primary Certification Authority - G4 | 1/18/2038 | No | Yes | No |
| Telia EC Email Root CA v3 | 5/23/2048 | No | Yes | No |
| Telia RSA Email Root CA v3 | 5/23/2048 | No | Yes | No |
| Thailand National Root Certification Authority - G1 | 3/27/2036 | No | No | Yes |
| T-TeleSec GlobalRoot Class 2 | 10/1/2033 | No | Yes | Yes |
| TWCA Global Root CA | 12/31/2030 | No | Yes | No |
| TWCA Global Root CA G2 | 11/22/2047 | No | Yes | No |
| UCA Global G2 Root | 12/31/2040 | Yes | No | No |
| USERTrust ECC Certification Authority | 1/18/2038 | No | Yes | Yes |
| USERTrust RSA Certification Authority | 1/18/2038 | No | Yes | Yes |
Reply all
Reply to author
Forward
0 new messages