Information about distrusting Symantec certificate authorities

Find out about the actions Apple is taking to distrust Symantec certificate authorities.

As of 1 August 2018, Apple partially distrusted Symantec Certificate Authorities (CAs).

Website operators, system administrators and software developers using Symantec certificates need to transition to a certificate issued by an Apple-trusted CA.¹

For site operators using Symantec Transport Layer Security (TLS) server certificates that were issued between 1 June 2016 and 1 December 2017, these certificates were trusted until the full distrust of Symantec CAs on 25 February 2020.

All other TLS server certificates issued by Symantec are distrusted.

Timeline

Starting 1 August 2018: Partial distrust of Symantec CAs

• TLS server certificates issued before 1 June 2016 or after 1 December 2017 are distrusted.

• TLS server certificates issued between 1 June 2016 and 1 December 2017 are trusted if they have been published to a trusted CT log.²

25 February 2020: Full distrust of Symantec CAs

• TLS server certificates issued from Symantec CAs listed below are fully distrusted.

13 September 2021: Ongoing distrust of Symantec CAs

• All certificates issued from Symantec CAs listed below are fully distrusted. The exemption list has been updated.

November 2021

• The exemption list has been updated.

February 2022

• The exemption list has been updated.

Symantec Root CAs with these constraints applied

The following Symantec Root CAs have these constraints applied:

• GeoTrust Global CA (FF:85:6A:2D:25:1D:CD:88:D3:66:56:F4:50:12:67:98:CF:AB:AA:DE:40:79:9C:72:2D:E4:D2:B5:DB:36:A7:3A)

• VeriSign Class 1 Public Primary Certification Authority — G3 (CB:B5:AF:18:5E:94:2A:24:02:F9:EA:CB:C0:ED:5B:B8:76:EE:A3:C1:22:36:23:D0:04:47:E4:F3:BA:55:4B:65)

• VeriSign Class 2 Public Primary Certification Authority — G3 (92:A9:D9:83:3F:E1:94:4D:B3:66:E8:BF:AE:7A:95:B6:48:0C:2D:6C:6C:2A:1B:E6:5D:42:36:B6:08:FC:A1:BB)

• VeriSign Class 3 Public Primary Certification Authority — G3 (EB:04:CF:5E:B1:F3:9A:FA:76:2F:2B:B1:20:F2:96:CB:A5:20:C1:B9:7D:B1:58:95:65:B8:1C:B9:A1:7B:72:44)

• VeriSign Class 3 Public Primary Certification Authority — G4 (69:DD:D7:EA:90:BB:57:C9:3E:13:5D:C8:5E:A6:FC:D5:48:0B:60:32:39:BD:C4:54:FC:75:8B:2A:26:CF:7F:79)

• VeriSign Class 3 Public Primary Certification Authority — G5 (9A:CF:AB:7E:43:C8:D8:80:D0:6B:26:2A:94:DE:EE:E4:B4:65:99:89:C3:D0:CA:F1:9B:AF:64:05:E4:1A:B7:DF)

• VeriSign Universal Root Certification Authority (23:99:56:11:27:A5:71:25:DE:8C:EF:EA:61:0D:DF:2F:A0:78:B5:C8:06:7F:4E:82:82:90:BF:B8:60:E8:4B:3C)

• thawte Primary Root CA (8D:72:2F:81:A9:C1:13:C0:79:1D:F1:36:A2:96:6D:B2:6C:95:0A:97:1D:B4:6B:41:99:F4:EA:54:B7:8B:FB:9F)

• GeoTrust Primary Certification Authority (37:D5:10:06:C5:12:EA:AB:62:64:21:F1:EC:8C:92:01:3F:C5:F8:2A:E9:8E:E5:33:EB:46:19:B8:DE:B4:D0:6C)

• thawte Primary Root CA — G2 (A4:31:0D:50:AF:18:A6:44:71:90:37:2A:86:AF:AF:8B:95:1F:FB:43:1D:83:7F:1E:56:88:B4:59:71:ED:15:57)

• thawte Primary Root CA — G3 (4B:03:F4:58:07:AD:70:F2:1B:FC:2C:AE:71:C9:FD:E4:60:4C:06:4C:F5:FF:B6:86:BA:E5:DB:AA:D7:FD:D3:4C)

• GeoTrust Primary Certification Authority — G2 (5E:DB:7A:C4:3B:82:A0:6A:87:61:E8:D7:BE:49:79:EB:F2:61:1F:7D:D7:9B:F9:1C:1C:6B:56:6A:21:9E:D7:66)

• GeoTrust Primary Certification Authority — G3 (B4:78:B8:12:25:0D:F8:78:63:5C:2A:A7:EC:7D:15:5E:AA:62:5E:E8:29:16:E2:CD:29:43:61:88:6C:D1:FB:D4)

• Symantec Class 1 Public Primary Certification Authority — G4 (36:3F:3C:84:9E:AB:03:B0:A2:A0:F6:36:D7:B8:6D:04:D3:AC:7F:CF:E2:6A:0A:91:21:AB:97:95:F6:E1:76:DF)

• Symantec Class 3 Public Primary Certification Authority — G4 (53:DF:DF:A4:E2:97:FC:FE:07:59:4E:8C:62:D5:B8:AB:06:B3:2C:75:49:F3:8A:16:30:94:FD:64:29:D5:DA:43)

• Symantec Class 1 Public Primary Certification Authority — G6 (9D:19:0B:2E:31:45:66:68:5B:E8:A8:89:E2:7A:A8:C7:D7:AE:1D:8A:AD:DB:A3:C1:EC:F9:D2:48:63:CD:34:B9)

• Symantec Class 2 Public Primary Certification Authority — G4 (FE:86:3D:08:22:FE:7A:23:53:FA:48:4D:59:24:E8:75:65:6D:3D:C9:FB:58:77:1F:6F:61:6F:9D:57:1B:C5:92)

• Symantec Class 3 Public Primary Certification Authority — G6 (B3:23:96:74:64:53:44:2F:35:3E:61:62:92:BB:20:BB:AA:5D:23:B5:46:45:0F:DB:9C:54:B8:38:61:67:D5:29)

• Symantec Class 2 Public Primary Certification Authority — G6 (CB:62:7D:18:B5:8A:D5:6D:DE:33:1A:30:45:6B:C6:5C:60:1A:4E:9B:18:DE:DC:EA:08:E7:DA:AA:07:81:5F:F0)

Symantec customer-operated CAs exempt from these constraints

[ { "DN": "CN=Apple IST CA 2 - G1, OU=Certification Authority, O=Apple Inc., C=US", "SHA256FP": "ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b" }, { "DN": "CN=Apple IST CA 8 - G1, OU=Certification Authority, O=Apple Inc., C=US", "SHA256FP": "a4fe7c7f15155f3f0aef7aaa83cf6e06deb97ca3f909df920ac1490882d488ed" }, { "DN": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2", "SHA256FP": "2d4fad3455ab61397401abbb518922f84336b67e02fc8d2db283825c4ab981bb" }, { "DN": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2", "SHA256FP": "aadadd5a879d2eb8c41a89597291292709d42052f5b6399541c694c3b7353cd1" } ]