Federal SSP CA Certificates & Trust Chains

About This Page

Trust-chain reference for the Entrust Managed Services Federal Shared Service Provider (SSP) PKI, covering both the production and test hierarchies. Download individual CA certificates, or the PKCS#7 (.p7c) AIA and SIA bundles where a full certification path is needed. Revocation lists for every chain are in the CRLs section.

Check revocation before you trust. Relying on a revoked certificate can have catastrophic consequences. How often to refresh revocation data is the relying party's decision, weighed against the risk of trusting a certificate whose status cannot be guaranteed.

2026 CA Key Update

The Entrust Managed Services (EMS) Root CA and Federal SSP Issuing CA are being re-keyed to RSA-3072 / SHA-384. Existing certificates remain valid and current CA certificates are not revoked. Relying parties should install the new certificates on receipt and trust both the existing and new chains before cutover, so newly issued certificates validate without interruption.

AIA Bundle — Certificates Issued to the EMS Root CA

The PKCS#7 bundle below contains the certificates issued to the Entrust Managed Services Root CA that establish its Federal PKI certification paths — the Federal Common Policy CA G2 cross-certificates and the key-rollover link certificates. Relying parties can install this single bundle to obtain valid certification paths from the EMS Root up to the Federal Common Policy CA G2 trust anchor.

Download bundle — CertsIssuedToEMSRootCA-20260713.p7c

The FCPCA G2 → EMS Root cross-certificate to the 2026 RSA-3072 key was issued by the Federal PKI on 2026-07-13 and is included in this bundle. The superseded self-signed root and forward-link certificates are intentionally omitted.

SIA Bundle — Certificates Issued by the EMS Root CA

The Subject Information Access (SIA) bundle lists the subordinate CA certificates the Entrust Managed Services Root CA has issued — the Fed SSP Issuing CA, the Derived Credential SSP CA, and the HHS-FPKI Intermediate CA. Relying parties building paths downward from the EMS Root can install this bundle to obtain the current subordinate CAs.

Download bundle — CertsIssuedByEMSRootCA-20260713.p7c

Two re-keyed RSA-3072 subordinate CA certificates are staged in this bundle with their keys on hold until their scheduled cutovers — Entrust Managed Services SSP CA (cutover TBD, pending validation) and Entrust Derived Credential SSP CA (cutover 2026-10-02). See the 2026 CA Key Update schedule.

Production Fed EMS Root and SSP CA — 2023 Generation

Live production chain issued 2023-07-11. This chain remains valid and in service after the 2026 key update — it is not revoked; it is simply no longer the latest issuing generation once the 2026 keys cut over.

U.S. Federal PKI Common Policy CA Certificates

Federal Common Policy roots and the cross-certificates that link the EMS Root CA into the Federal PKI. Downloadable copies of the same certificates published by the Federal PKI Management Authority.

Derived Credential SSP CA

Issues PIV-Derived credentials. A 2026 key update is scheduled for 2026-07-13 (cutover 2026-10-02) — see the 2026 CA Key Update schedule.

HHS CA

The HHS-FPKI-Intermediate-CA-E1 operates under the Entrust Managed Services Root CA and is cross-certified into the Federal PKI through the Federal Common Policy CA G2 trust anchor. Current generation shown first; the superseded certificate is retained for path validation.

Download trust-anchor bundle — CertIssuedToHHSEntrustCA-20260709.p7c

Federal PKI G2 (Entrust Managed PKI)

The Entrust Managed PKI Federal G2 hierarchy — a Federal Root CA G2 cross-certified by Federal Common Policy CA G2, with a subordinate Federal Issuing CA G2.

NFI CA

Non-Federal Issuer (NFI) hierarchy, cross-certified to the Federal Bridge CA G4. Current generation shown first; superseded certificates are retained for path validation.

The certificates issued by the NFI Root CA (its SIA contents) are the Medium Assurance SSP CA certificates listed above; a standalone NFI Root SIA bundle is not published at this time.

Certificate Revocation Lists (CRLs)

Combined (full-scope) CRLs for each trust chain, published at the URLs referenced in the CRL Distribution Point (CRLDP) extension of the certificates above. Each CRL is signed by its issuing CA key — the Authority Key Identifier (AKI) of the CRL matches the Subject Key Identifier (SKI) of the corresponding CA certificate. Partitioned CRLs (the c### shard files) and expired generations are intentionally omitted; only currently valid generations are listed. Retrieve fresh revocation data at intervals appropriate to your risk posture.

Generations reflect the CA key each CRL is signed under (not the CRL's rolling NextUpdate). Pending rows will be published after the 2026 key-update cutover.

Test / Demo CA Information

Non-production test hierarchy published from the demo directory (dsspdir.managed.entrust.com) for interoperability testing only — not valid for production trust. These CAs mirror the production hierarchy above so relying parties can validate configuration before go-live. Current generation shown first per CA; superseded certificates are retained for path validation.