Bridge SSL
GlobalSign root certificates: names, keys and how to find the one in your chain
GlobalSign keeps its root certificates in a public repository and groups them by purpose. This page covers the first two groups: the multi-purpose roots R1, R3, R5 and R6, and the TLS roots R46 and E46. It tells them apart and shows how to find the GlobalSign root in a site's chain. Which root your own SSL certificate ends at depends on the certificate authority (CA) that issued it. For roots in general, see what a root certificate is.
- Where they are listed
- GlobalSign's root certificate repository, in lists by purpose: multi-purpose, TLS, secure mail, code signing and others
- Multi-purpose roots
- R1, R3, R5 and R6
- TLS roots
- GlobalSign Root R46 and GlobalSign Root E46
- Key types
- RSA with 2048 bits (R1, R3), RSA with 4096 bits (R6, R46), ECC with 384 bits (R5, E46)
- Cross certificates
- GlobalSign Root R46 has a cross certificate back to R3, and GlobalSign Root E46 one back to ECC Root R5
- Identifier
- each of the six has a serial number and a thumbprint on the list
- Trust
- decided by each trust store; this page does not list which stores include which root
The six roots at a glance
GlobalSign's list gives every root a label, a hash, a key type and a key size. The table puts those beside the name you will find inside the certificate. The next section explains why the two differ.
| Listed as | Group | Key | Hash | Name inside the certificate |
|---|---|---|---|---|
| GlobalSign Root R1 | Multi-purpose | RSA, 2048-bit | SHA-1 | CN GlobalSign Root CA, OU Root CA |
| GlobalSign Root R3 | Multi-purpose | RSA, 2048-bit | SHA-256 | OU GlobalSign Root CA - R3, CN GlobalSign |
| GlobalSign ECC Root R5 | Multi-purpose | ECC, 384-bit | SHA-384 | OU GlobalSign ECC Root CA - R5, CN GlobalSign |
| GlobalSign Root R6 | Multi-purpose | RSA, 4096-bit | SHA-384 | OU GlobalSign Root CA - R6, CN GlobalSign |
| GlobalSign Root R46 | TLS | RSA, 4096-bit | SHA-384 | CN GlobalSign Root R46 |
| GlobalSign Root E46 | TLS | ECC, 384-bit | SHA-384 | CN GlobalSign Root E46 |
The repository page notes that the major browsers and root programs have set requirements for single-purpose roots, and the TLS roots sit in a group of their own, apart from the multi-purpose ones. Which browser or operating system trusts which root is decided by each trust store, and this page does not list that.
Why the list and the certificate use different names
The label on GlobalSign's page is written for people. The certificate has its own subject, and for four of the six roots the two do not match. R3, R5 and R6 carry only "GlobalSign" as their common name (CN). Their label, for example "GlobalSign Root CA - R3", sits in the organizational unit (OU). R1 is the other way round: its CN is "GlobalSign Root CA" and its OU says only "Root CA". Only R46 and E46 put the label into the CN, as "GlobalSign Root R46" and "GlobalSign Root E46".
The practical result: an issuer line that reads CN = GlobalSign does not say which root you are looking at. Read the OU as well. Mozilla's list of included CA certificates shows the same names, so you can check them against a second source.
Find the GlobalSign root in a chain
Print what the server sends:
openssl s_client -connect example.com:443 -servername example.com -showcerts. The OpenSSL manual says this lists the certificates in the order the server sent them and that it is not a verified chain.Copy the last certificate in that list into a file,
top.pem, and print its names:openssl x509 -in top.pem -noout -subject -issuer.Read the issuer line against the table. An issuer of CN = GlobalSign Root R46 or CN = GlobalSign Root E46 names a TLS root directly. An issuer with the OU GlobalSign Root CA - R3, GlobalSign ECC Root CA - R5 or GlobalSign Root CA - R6 names a multi-purpose root.
To be certain, take the root file from GlobalSign's repository, or from your trust store, and print its thumbprint:
openssl x509 -in root.pem -noout -fingerprint -sha1. It must equal the thumbprint on GlobalSign's list.
If the last certificate is an intermediate certificate, its issuer is the root, or another intermediate when the path is longer. The server may also have left the root out and sent only intermediates; the certificate chain guide shows what a complete chain looks like, and OpenSSL commands to check a certificate has further checks.
Thumbprints of the six roots
These are the thumbprints GlobalSign lists for each root certificate. Run on each published file, openssl prints the same value, so the same check compares a root in your trust store with the repository.
| Root | Thumbprint |
|---|---|
| GlobalSign Root R1 | b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c |
| GlobalSign Root R3 | d6:9b:56:11:48:f0:1c:77:c5:45:78:c1:09:26:df:5b:85:69:76:ad |
| GlobalSign ECC Root R5 | 1f:24:c6:30:cd:a4:18:ef:20:69:ff:ad:4f:dd:5f:46:3a:1b:69:aa |
| GlobalSign Root R6 | 80:94:64:0e:b5:a7:a1:ca:11:9c:1f:dd:d5:9f:81:02:63:a7:fb:d1 |
| GlobalSign Root R46 | 53:a2:b0:4b:ca:6b:d6:45:e6:39:8a:8e:c4:0d:d2:bf:77:c3:a2:90 |
| GlobalSign Root E46 | 39:b4:6c:d5:fe:80:06:eb:e2:2f:4a:bb:08:33:a0:af:db:b9:dd:84 |
Cross certificates for R46 and E46
GlobalSign's list marks the R46 entry "Valid with Cross Certificate back to Root R3" and the E46 entry "Valid with Cross Certificate back to ECC Root R5". A cross certificate carries the name and public key of one root but is signed by a different root. So the name GlobalSign Root R46 can appear with two issuers: R46 itself, or R3.
When step 3 shows R3 as the issuer of a certificate named GlobalSign Root R46, you are looking at the cross certificate, not the self-issued root. Its thumbprint will not match the one in the table above. The same reading applies to E46 and R5.
Sources
GlobalSign Support, GlobalSign Root Certificates (CA certificates repository).
Mozilla CCADB, Included CA Certificate Report (CSV).
OpenSSL 3.0 manual pages: openssl-s_client(1), openssl-x509(1).
Our run: openssl x509 -fingerprint -sha1 on each root file published in source 1; the output matched the listed thumbprints.