Menu

GlobalSign Root Certificates

Jul 7, 2025

OVERVIEW: This page contains the list of GlobalSign's Root Certificates by Product Type and everything you need to about our Root Certificates. Our Root Certificates are grouped into different has algorithms: SHA-256 RSA, SHA-384 ECC and SHA-1 RSA (Legacy). If you are looking for GlobalSign Intermediate Certificate and to find out which products are using what roots, please refer to this page. 

GlobalSign's Root Certificates

Our root certificates are some of the most trusted root certificates in the PKI ecosystem. Since our inception, we have generated future-proof root certificates that exceed current industry best practices. We work diligently to protect the security of our root certificates, providing end users with trust anchors that secure all types of organization and individual authentication. Our Root Certifi­cates can be found in every popular machine, device, application and platform that uses the trust of Public Key Infrastructure, see list here.

The major Browsers and Root programs have set requirements in place to create and use "single-purpose" roots, so different use-cases and applications will use their respective roots. Starting in 2019 and continuing into 2020, GlobalSign created new single-purpose roots, which are listed below.

For Root & Intermediate Certificate bundles, please refer to this page. To update GlobalSign Root Certificate in Windows XP & Windows 2000, follow this guide.

ADVISORY: Mozilla has announced their plans to start removing the TLS and Secure Mail trust bits from all of the older Roots in their root program. To learn more about this change, please refer to this page.

Multi-Purpose Roots

R1 GlobalSign Root Certificate

GlobalSign Root R1
SHA1 • RSA • 2048

Valid until: 28 January 2028
Serial #: 04:00:00:00:00:01:15:4b:5a:c3:94
Thumbprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c

Root R1 was GlobalSign’s first root certificate embedded in browsers (back in 1999, Netscape and Windows 98), making Root R1 GlobalSign’s oldest and most ubiquitous root certificate. The original use case was for personal certificates, but this quickly expanded as GlobalSign’s business and expertise broadened. Due to its hash algorithm, GlobalSign will begin scaling back Root R1 use.

Certificate Test links:

Download Certificate (Binary/DER Encoded) View in Base64

R3 GlobalSign Root Certificate

GlobalSign Root R3
SHA256 • RSA • 2048

Valid until: 18 March 2029
Serial #: 04:00:00:00:00:01:21:58:53:08:a2
Thumbprint: d6:9b:56:11:48:f0:1c:77:c5:45:78:c1:09:26:df:5b:85:69:76:ad

Root R3 is GlobalSign’s second oldest root, and as ubiquitous as Root R1. Its hash algorithm is more secure than R1, and therefore all of GlobalSign’s business (TLS, code signing, timestamping document signing) chains to this root.

Certificate Test links:

Download Certificate (Binary/DER Encoded) View in Base64

R5 GlobalSign Root Certificate

GlobalSign ECC Root R5
SHA384 • ECC • 384

Valid until: 19 January 2038
Serial #: 60:59:49:e0:26:2e:bb:55:f9:0a:77:8a:71:f9:4a:d8:6c
Thumbprint: 1f:24:c6:30:cd:a4:18:ef:20:69:ff:ad:4f:dd:5f:46:3a:1b:69:aa

Root R5 is GlobalSign’s first ECC root, providing customers a pure ECC hierarchy. It features a SHA-384 hash with a 384-bit key length, making it one of GlobalSign’s most secure roots in the PKI ecosystem. It has been embedded in every major browser and security trust list.

Certificate Test links:

Download Certificate (Binary/DER Encoded) View in Base64

R6 GlobalSign Root Certificate

GlobalSign Root R6
SHA384 • RSA • 4096

Valid until: 10 December 2034
Serial #: 45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Thumbprint: 80:94:64:0e:b5:a7:a1:ca:11:9c:1f:dd:d5:9f:81:02:63:a7:fb:d1

Root R6 is GlobalSign’s most secure, robust RSA root. At SHA-384 with a 4096-bit key length, it is poised to take on most of GlobalSign’s core business, especially as Root R3 retires. It has been embedded in every major browser and security trust list.

Certificate Test links:

Download Certificate (Binary/DER Encoded) View in Base64

TLS Root Certificates

TLS Root R46 Root Certificate

GlobalSign Root R46
SHA384 • RSA • 4096

Valid until: 20 March 2046
Serial #: 11:d2:bb:b9:d7:23:18:9e:40:5f:0a:9d:2d:d0:df:25:67:d1
Thumbprint: 53:a2:b0:4b:ca:6b:d6:45:e6:39:8a:8e:c4:0d:d2:bf:77:c3:a2:90

Root R46 is GlobalSign’s newest RSA root, and was submitted to the Mozilla Root Store late 2019. It will serve to replace Root R6 when R6 expires.

Certificate Test links:

Download Certificate (Binary/DER Encoded) View in Base64

GlobalSign Root E46

GlobalSign Root E46
SHA384 • ECC • 384

Valid until: 20 March 2046
Serial #: 11:d2:bb:ba:33:6e:d4:bc:e6:24:68:c5:0d:84:1d:98:e8:43
Thumbprint: 39:b4:6c:d5:fe:80:06:eb:e2:2f:4a:bb:08:33:a0:af:db:b9:dd:84

Root E46 is GlobalSign’s newest ECC root, and was submitted to the Mozilla Root Store late 2019. It will serve to replace Root R5 when R5 expires.

Certificate Test links:

Download Certificate (Binary/DER Encoded) View in Base64

Secure Mail Root Certificates

GlobalSign Secure Mail Root R45 

GlobalSign Secure Mail Root R45 
SHA384 • RSA • 4096 

Valid until: March 18 2045 
Serial #: 76:53:fe:a8:4c:50:ab:9f:8d:32:b5:1d:03:8f:57:dc
Thumbprint: 76:18:d1:f3:80:24:3d:52:40:c6:11:6a:ad:57:77:09:7d:81:30:a0

Download Certificate (Binary/DER Encoded) View in Base64

GlobalSign Secure Mail Root E45 

GlobalSign Secure Mail Root E45 
SHA384 • ECC • 384 

Valid until: March 18 2045 
Serial #: 76:53:fe:aa:27:1d:95:46:5d:d6:f1:9e:e5:b8:90:0a
Thumbprint: 18:2e:1f:32:4f:89:df:be:fe:88:89:f0:93:c2:c4:a0:2b:67:75:21

Download Certificate (Binary/DER Encoded) View in Base64

Code Signing Root Certificates

GlobalSign Code Signing Root R45

GlobalSign Code Signing Root R45 
SHA384 • RSA • 4096 

Valid until: March 18 2045 
Serial #: 76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Thumbprint: 4e:fc:31:46:0c:61:9e:ca:e5:9c:1b:ce:2c:00:80:36:d9:4c:84:b8

Download Certificate (Binary/DER Encoded) View in Base64

GlobalSign Code Signing Root E45

GlobalSign Code Signing Root E45 
SHA384 • ECC • 384 

Valid until: March 18 2045 
Serial #: 76:53:fe:ae:18:26:43:6f:69:f5:1c:c2:77:16:f2:5e
Thumbprint: 79:aa:50:5e:dd:09:b3:21:e3:6d:57:91:0a:5d:f5:a9:fb:85:cc:57

Download Certificate (Binary/DER Encoded) View in Base64

Time Stamping Root Certificates

GlobalSign Timestamping Root R45

GlobalSign Timestamping Root R45 
SHA384 • RSA • 4096 

Valid until: March 18 2045 
Serial #: 76:53:fe:b9:3d:d9:e7:e9:26:32:ac:d6:0a:be:ac:38
Thumbprint: 13:9b:1c:71:2f:d1:7c:3c:a5:da:6e:57:01:af:ba:01:58:f9:d4:5d

Download Certificate (Binary/DER Encoded) View in Base64

GlobalSign Timestamping Root E46

GlobalSign Timestamping Root E46
SHA256 • ECC • 256

Valid until: March 24 2046
Serial #: 79:29:9b:2b:d2:95:fd:60:5c:36:f4:87:ad:9e:a2:9e
Thumbprint: 3a:cc:40:d9:b9:dc:16:fe:a0:c1:06:13:47:67:d0:f6:83:b2:27:93

Download Certificate (Binary/DER Encoded) View in Base64

Client Authentication Root Certificates

GlobalSign Client Authentication Root R45 

GlobalSign Client Authentication Root R45 
SHA384 • RSA • 4096 

Valid until: March 18 2045 
Serial #: 76:53:fe:b9:f5:c7:db:ea:8b:a4:78:d4:3e:3d:6b:f6
Thumbprint: dc:77:5c:1c:87:4f:1b:bf:51:09:9f:6f:b1:29:db:99:ff:08:eb:52

Download Certificate (Binary/DER Encoded) View in Base64

GlobalSign Client Authentication Root E45 

GlobalSign Client Authentication Root E45 
SHA384 • ECC • 384 

Valid until: March 18 2045 
Serial #: 76:53:fe:ba:b2:1d:d8:27:e9:69:16:a2:eb:81:be:58
Thumbprint: a2:be:e4:ad:03:27:13:ad:ce:0a:0e:9b:19:b6:b8:5f:c2:4e:ca:8d

Download Certificate (Binary/DER Encoded) View in Base64

Document Signing Root Certificates

GlobalSign Document Signing Root R45

GlobalSign Document Signing Root R45 
SHA384 • RSA • 4096 

Valid until: March 18 2045 
Serial #: 76:53:fe:b0:4c:a0:d5:71:f2:14:b3:8e:2c:7f:17:41
Thumbprint: 4f:79:df:63:55:10:27:69:69:e8:23:c4:b8:7f:79:3b:97:48:d3:ea

Download Certificate (Binary/DER Encoded) View in Base64

GlobalSign Document Signing Root E45

GlobalSign Document Signing Root E45 
SHA384 • ECC • 384 
Valid until: March 18 2045 
Serial #: 76:53:fe:b0:af:4b:75:90:a2:1a:e4:a2:d5:f2:76:b5
Thumbprint: ce:71:31:5d:c0:98:61:1f:60:8c:6c:de:cc:ed:c3:5d:18:d0:85:48

Download Certificate (Binary/DER Encoded) View in Base64

IoT Root Certificates

GlobalSign IoT Root R60

GlobalSign IoT Root R60 
SHA384 • RSA • 4096 

Valid until: March 18 2060 
Serial #: 76:53:fe:b3:ea:3b:ca:64:6a:eb:5d:6c:7d:ce:fb:b6
Thumbprint: 48:46:37:05:74:8c:cf:3e:60:87:50:3c:60:2b:d0:ee:c7:c1:dd:cf

Download Certificate (Binary/DER Encoded) View in Base64

GlobalSign IoT Root E60

GlobalSign IoT Root E60 
SHA384 • ECC • 384 

Valid until: March 18 2060 
Serial #: 76:53:fe:b5:6a:c8:ee:4e:8a:c6:fe:5e:9e:38:f5:eb
Thumbprint: 2a:5e:c5:2b:75:1d:85:65:51:2d:a7:f7:de:93:fd:95:f3:d4:18:b6

Download Certificate (Binary/DER Encoded) View in Base64

GlobalSign Verified Mark Certificates

GlobalSign Verified Mark Root R42

GlobalSign Verified Mark Root R42
SHA384 • RSA • 4096

Valid until: 15 November 2042
Serial #: 7f:e5:30:03:81:98:a7:5f:7d:17:c0:0f:24:2c:ab:f3
Thumbprint: 37:eb:5e:fe:12:99:47:7c:f8:c4:e8:94:64:4e:56:d1:da:d7:69:96

Download Certificate (Binary/DER Encoded) View in Base64

Related Articles

Trusted Root Intermediate Certificates

Feb 27, 2020, 2:11 AM

This support article is all about Trusted Root Intermediate Certificates, a select service with strict requirements. PKI hierarchies allow you to control the chain of trust in your ecosystem, whether you’re implementing client authentication within an enterprise or deploying secure device identities within a supply chain. GlobalSign supports multiple hierarchy options for more flexible trust management and isolation of control, including dedicated or shared and public or private models. GlobalSign Root Certificates are already distributed in all operating systems, browsers, and mobile devices, meaning that all certificates issued from hierarchies beneath these roots are transparently trusted. For closed ecosystems, where public trust isn’t wanted or allowed, private and dedicated customer roots and intermediates are issued.

Read More

Root & Intermediate Certificate Bundles

Mar 9, 2020, 2:50 PM

Some Apache and Java based applications require the Root & Intermediate certificates to be bundled in a single file. You can create a certificate bundle by opening a plain text editor (notepad, gedit, etc) and pasting in the text of the root certificate and the text of the intermediate certificate. The order they go in depends on the type of server you are running. Nginx for example concatenates all certificates in one file beginning with the server certificate.

Read More

GlobalSign Qualified Production and Sample Certificates

Mar 10, 2020, 10:24 AM

This support article lists down the Qualified Production Certificate and Qualified Sample Certificate. Qualified certificates can only be issued by a Qualified Trust Service Provider (QTSP) recognized under eIDAS. GlobalSign is recognized across all EU and EEA countries as a QTSP and has undergone the appropriate eIDAS conformity assessments in order to be able to provide qualified certificates for website authentication and electronic seals. All certificates, signatures, and seals are compliant with EU regulations and local signing standards.

Read More

GlobalSign System Alerts

View recent system alerts.

View Alerts

Atlas Discovery

Scan your endpoints to locate all of your Certificates.

Sign Up

SSL Configuration Test

Check your certificate installation for SSL issues and vulnerabilities.

Contact Support