1992971 - Add Actalis TLS Root CAs 2025 and Actalis SMIME Root CAs 2025

Status: ASSIGNED

(CA Program :: CA Certificate Root Program, task, P1)

Description

[Adriano Santoni]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:143.0) Gecko/20100101 Firefox/143.0

Steps to reproduce:

We kindly ask for the inclusion of four new Root CAs for ACTALIS, which are intended to progressively replace our current hierarchy in accordance with present-day requirements, including the use of up-to-date key material and the separation of TLS and S/MIME hierarchies. Specifically, these consist of two new Root CAs for TLS certificates (one RSA and one ECC) and two new Root CAs for S/MIME certificates (one RSA and one ECC), as described below.

The CCADB Case is 00002732

Names and details of the new Root CAs:

Root 1:

Subject: C=IT, O=Actalis S.p.A., CN=Actalis TLS Server RSA Root CA 2025
SHA-256 Fingerprint: 6D0E47DFDE7CF48308CD4C6C1517DD1AF033DCC72BB0501C04268B03B58A9085
Download link: https://crt.sh/?q=6D0E47DFDE7CF48308CD4C6C1517DD1AF033DCC72BB0501C04268B03B58A9085
Test websites:
* DV: https://active.ssltest-dv-rsa-2025.actalis.it/
* OV: https://active.ssltest-ov-rsa-2025.actalis.it/
* EV: https://active.ssltest-ev-rsa-2025.actalis.it/

For this Root, we ask for EV-enablement.
EV policy OID: 2.23.140.1.1 (CABF EV)

Root 2:

Subject: C=IT, O=Actalis S.p.A., CN=Actalis TLS Server ECC Root CA 2025
SHA-256 Fingerprint: 4EFAADA2543E1E02666998574B3BAD96AE264088FA5917F75D32E7A609D1869C
Download link: https://crt.sh/?q=4EFAADA2543E1E02666998574B3BAD96AE264088FA5917F75D32E7A609D1869C
Test websites:
* DV: https://active.ssltest-dv-ecc-2025.actalis.it/
* OV: https://active.ssltest-ov-ecc-2025.actalis.it/
* EV: https://active.ssltest-ev-ecc-2025.actalis.it/

For this Root, we ask for EV-enablement.
EV policy OID: 2.23.140.1.1 (CABF EV)

Root 3:

Subject: C=IT, O=Actalis S.p.A., CN=Actalis SMIME RSA Root CA 2025
SHA-256 Fingerprint: F1B7C8A8F447B395786E325AF0A7571203F3812400FF1905FCA7726B858FC44A
Download link: https://crt.sh/?q=F1B7C8A8F447B395786E325AF0A7571203F3812400FF1905FCA7726B858FC44A
Test websites: N/A

Root 4:

Subject: C=IT, O=Actalis S.p.A., CN=Actalis SMIME ECC Root CA 2025
SHA-256 Fingerprint: 3347EEA8149CD3F6B7796CCAAD234ADA294372F7B1EA49F87F5ADB11C8581624
Download link: https://crt.sh/?q=3347EEA8149CD3F6B7796CCAAD234ADA294372F7B1EA49F87F5ADB11C8581624
Test websites: N/A

The attestation letter from our CAB related to root key generation can be found at:

https://cdn1-www.bureauveritas.it/sites/g/files/zypfnx256/files/media/document/CAB-Forum_AAL_Actalis_Key_Ceremony_Audit_E_V1.0_25.pdf

Our current CPS and CPs can be found at https://www.actalis.com/legal-repository

We remain available for any additional information that may be required.

Comment 1

[Adriano Santoni]

Attachment: demo_smime_mv_rsa_2026.pem

Comment 2

[Adriano Santoni]

Attachment: demo_smime_mv_ecc_2026.pem

Comment 3

[Adriano Santoni]

Find attached two demo S/MIME certificates issued by our new S/MIME SubCAs (new hierarchy), respectively with RSA and ECC keys.