Managed Federal PKI CA Certificates & Trust Chains

About This Page

Trust-chain reference for the Entrust Managed Federal PKI, covering both the production and test hierarchies. Download individual CA certificates, or the PKCS#7 (.p7c) AIA and SIA bundles where a full certification path is needed. Revocation lists for every chain are in the CRLs section.

Check revocation before you trust. Relying on a revoked certificate can have catastrophic consequences. How often to refresh revocation data is the relying party's decision, weighed against the risk of trusting a certificate whose status cannot be guaranteed.

2026 CA Key Update

The Entrust Managed Services (EMS) Root CA and Federal SSP Issuing CA are being re-keyed to RSA-3072 / SHA-384. Existing certificates remain valid and current CA certificates are not revoked. Relying parties should install the new certificates on receipt and trust both the existing and new chains before cutover, so newly issued certificates validate without interruption.

Schedule updated 2026-10-16 — Entrust Derived Credential SSP CA cutover completed. See Change history.

AIA Bundle — Certificates Issued to the EMS Root CA

The PKCS#7 bundle below contains the certificates issued to the Entrust Managed Services Root CA that establish its Federal PKI certification paths — the Federal Common Policy CA G2 cross-certificates and the key-rollover link certificates. Relying parties can install this single bundle to obtain valid certification paths from the EMS Root up to the Federal Common Policy CA G2 trust anchor.

Download bundle — CertsIssuedToEMSRootCA-20260713.p7c

The FCPCA G2 → EMS Root cross-certificate to the 2026 RSA-3072 key was issued by the Federal PKI on 2026-07-13 and is included in this bundle. The superseded self-signed root and forward-link certificates are intentionally omitted.

SIA Bundle — Certificates Issued by the EMS Root CA

The Subject Information Access (SIA) bundle lists the subordinate CA certificates the Entrust Managed Services Root CA has issued — the Fed SSP Issuing CA, the Derived Credential SSP CA, and the HHS-FPKI Intermediate CA. Relying parties building paths downward from the EMS Root can install this bundle to obtain the current subordinate CAs.

Download bundle — CertsIssuedByEMSRootCA-20260713.p7c

One re-keyed RSA-3072 subordinate CA certificate remains staged in this bundle with its key on hold — Entrust Managed Services SSP CA (cutover 2026-11-06). The re-keyed Entrust Derived Credential SSP CA cut over on 2026-10-16. See the 2026 CA Key Update schedule.

Production Fed EMS Root and SSP CA — 2023 Generation

Live production chain issued 2023-07-11. This chain remains valid and in service after the 2026 key update — it is not revoked; it is simply no longer the latest issuing generation once the 2026 keys cut over.

U.S. Federal PKI Common Policy CA Certificates

Federal Common Policy roots and the cross-certificates that link the EMS Root CA into the Federal PKI. Downloadable copies of the same certificates published by the Federal PKI Management Authority.

Derived Credential SSP CA

Issues PIV-Derived credentials. Re-keyed to RSA-3072 / SHA-384 (key update 2026-07-13) and cut over to the new key on 2026-10-16: new certificates are issued under the 2026 key, and certificates issued under the 2022 key remain valid. AIA bundle for certificates issued by this CA: CertsIssuedtoFedDCSCA.p7c (2022 and 2026 CA certificates). See the 2026 CA Key Update schedule.

HHS CA

The HHS-FPKI-Intermediate-CA-E1 operates under the Entrust Managed Services Root CA and is cross-certified into the Federal PKI through the Federal Common Policy CA G2 trust anchor. Current generation shown first; the superseded certificate is retained for path validation.

Download trust-anchor bundle — CertIssuedToHHSEntrustCA-20260709.p7c

Federal PKI G2 (Entrust Managed PKI)

The Entrust Managed PKI Federal G2 hierarchy — a Federal Root CA G2 cross-certified by Federal Common Policy CA G2, with a subordinate Federal Issuing CA G2.

NFI CA

Non-Federal Issuer (NFI) hierarchy, cross-certified to the Federal Bridge CA G4 and G5. Current generation shown first; superseded certificates are retained for path validation.

The certificates issued by the NFI Root CA (its SIA contents) are the Medium Assurance SSP CA certificates listed above; a standalone NFI Root SIA bundle is not published at this time.

AIA Bundle — Certificates Issued to the NFI Root CA

The PKCS#7 bundle below contains the certificates issued to the Entrust Managed Services NFI Root CA — its Federal Bridge CA cross-certificates and its key-rollover link certificate. It is identical to the bundle published at the NFI Root CA's AIA URL, CertsIssuedToNFIRootCA.p7c.

Download bundle — CertsIssuedToNFIRootCA-20261002.p7c

Bundle updated 2026-10-02: the Federal Bridge CA G5 cross-certificate was added and the expired 2021 Federal Bridge CA G4 cross-certificate (valid to 2024-11-03) was removed. The 2024 G4 cross-certificate is still valid and remains in the bundle until it is revoked as part of the Federal Bridge CA G4-to-G5 transition; the revocation date is not yet confirmed. Serial 4AA96957 is a key-rollover link, not a self-signed root: its authority key identifier matches the current Root (4AA96956) and its subject key identifier matches the prior Root (4AA8A60D). Both self-signed NFI Root CA certificates are listed in the NFI CA section above and are not part of this bundle.

Certificate Revocation Lists (CRLs)

Combined (full-scope) CRLs for each trust chain, published at the URLs referenced in the CRL Distribution Point (CRLDP) extension of the certificates above. Each CRL is signed by its issuing CA key — the Authority Key Identifier (AKI) of the CRL matches the Subject Key Identifier (SKI) of the corresponding CA certificate. Partitioned CRLs (the c### shard files) and expired generations are intentionally omitted; only currently valid generations are listed. Retrieve fresh revocation data at intervals appropriate to your risk posture.

Generations reflect the CA key each CRL is signed under (not the CRL's rolling NextUpdate). Pending rows will be published after the 2026 key-update cutover.

Test / Demo CA Information

Non-production test hierarchy published from the demo directory (dsspdir.managed.entrust.com) for interoperability testing only — not valid for production trust. These CAs mirror the production hierarchy above so relying parties can validate configuration before go-live. Current generation shown first per CA; superseded certificates are retained for path validation.

Change history

Dated record of substantive changes to this repository page — most recent first. The “Last updated” date in the page header reflects the latest entry.