Trust Directory
Independent public mirror of national PKI trust anchors, not an authority. Certificates are published by each national PKI (e.g., BCCR for Costa Rica); this site mirrors and structures them.

Czech Republic

Published by Digitální a informační agentura (DIA) — Digital and Information Agency, Czech eIDAS supervisory body and national Trusted List scheme operator

Certificates
34
Roots
4
Intermediates
30
did:pki
34
Updated
Model
Accredited CAs (ETSI Trusted List)
Governing law
Reglamento eIDAS (UE) 910/2014 · Zákon č. 297/2016 Sb., o službách vytvářejících důvěru pro elektronické transakce
Key algorithms
RSA-2048, RSA-3072, RSA-4096, EC P-384, EC P-521
Signature standards
CAdESPAdESXAdESASiC
CapabilitiesQualified e-signature & e-seal (eIDAS)Qualified timestampingQualified website authentication (QWAC / PSD2)

The Czech Republic's qualified-signature trust is a federation of accredited QTSPs (První certifikační autorita, a.s. (I.CA), Česká pošta, s.p. / PostSignum, Software602 a.s. / ACAeID, eIdentity a.s., and the Komerční banka root, among others) supervised by the Digitální a informační agentura (DIA), the Digital and Information Agency acting as the Czech eIDAS supervisory body, and published in the Czech national eIDAS Trusted List (TSL_CZ.xtsl, ETSI TS 119 612). The 34 currently-granted CA certificates were promoted wholesale after verifying the Trusted List's XAdES signature through the EU LOTL chain of trust: the LOTL signature was checked against the pinned European Commission signing anchor, and the Czech TSL's signature (signer: G=Filip, SN=Bílek, CN=Filip Bílek, O=Digitální a informační agentura, 2.5.4.97=NTRCZ-17651921, C=CZ; cert SHA-256 553819860388eb5dc4836bf16897a58a0964cd04d1acddfc4b2e36d0908e10ae) against the identity the LOTL declares for the Czech Republic, so the list's single seal vouches for every certificate it contains (eIDAS Art. 22). Only services with a currently-granted status and a CA / qualified-certificate service type were selected; withdrawn, deprecated, and non-CA services were dropped. Verification evidence is in VERIFICATION.md. Key algorithms across the set are mixed: 12 CAs use RSA-2048, 10 use RSA-4096, 6 use RSA-3072, 5 use EC P-521, and 1 uses EC P-384. Fourteen certificates in the set have passed their notAfter and are retained as archived-but-granted entries; they surface under the Expired status filter.

Expired certificates are hidden by default; they remain useful only for validating older signatures.

  • ACAeID2 - Qualified Issuing Certificate (kvalifikovaný systémový certifikát vydávající CA)

    Intermediate CAExpired (3819 days ago)
    Issuer
    ACAeID2 - Qualified Root Certificate (kvalifikovaný systémový certifikát kořenové CA)
    Valid
    to
    Serial
    08d5baaf
    SHA-256
    0af09567ae…23edc47b46

    Issuer "ACAeID2 - Qualified Root Certificate (kvalifikovaný systémový certifikát kořenové CA)" is not present in this mirror, so the chain cannot be fully resolved here.

  • ACAeID2.1 - Qualified Issuing Certificate (kvalifikovaný systémový certifikát vydávající CA)

    Intermediate CAExpired (2013 days ago)
    Issuer
    ACAeID2 - Qualified Root Certificate (kvalifikovaný systémový certifikát kořenové CA)
    Valid
    to
    Serial
    4109a08d
    SHA-256
    caa0258cb1…d21b6d6a2e

    Issuer "ACAeID2 - Qualified Root Certificate (kvalifikovaný systémový certifikát kořenové CA)" is not present in this mirror, so the chain cannot be fully resolved here.

  • ACAeID3.1 - Issuing Certificate

    Intermediate CAExpired (653 days ago)
    Issuer
    ACAeID3 - Root Certificate
    Valid
    to
    Serial
    19f87045
    SHA-256
    b891934ac4…200d1ae6cc

    Issuer "ACAeID3 - Root Certificate" is not present in this mirror, so the chain cannot be fully resolved here.

  • ACAeID3.2 - Issuing Certificate

    Intermediate CAValid (683 days left)
    Issuer
    ACAeID3 - Root Certificate
    Valid
    to
    Serial
    3e665676
    SHA-256
    6d66fc4e8b…509c701d84

    Issuer "ACAeID3 - Root Certificate" is not present in this mirror, so the chain cannot be fully resolved here.

  • ACAeID3.3 - Issuing Certificate

    Intermediate CAValid (2016 days left)
    Issuer
    ACAeID3 - Root Certificate
    Valid
    to
    Serial
    77237e30
    SHA-256
    922b74719e…433ab6cce9

    Issuer "ACAeID3 - Root Certificate" is not present in this mirror, so the chain cannot be fully resolved here.

  • I.CA EU Qualified CA2/ECC 06/2022

    Intermediate CAValid (2140 days left)
    Issuer
    I.CA Root CA/ECC 05/2022
    Valid
    to
    Serial
    05f5e52c
    SHA-256
    a7cdf7f580…537b2034c8

    Issuer "I.CA Root CA/ECC 05/2022" is not present in this mirror, so the chain cannot be fully resolved here.

  • I.CA EU Qualified CA2/RSA 06/2022

    Intermediate CAValid (2140 days left)
    Issuer
    I.CA Root CA/RSA 05/2022
    Valid
    to
    Serial
    05f5e52a
    SHA-256
    5f91478242…901a347c66

    Issuer "I.CA Root CA/RSA 05/2022" is not present in this mirror, so the chain cannot be fully resolved here.

  • I.CA Qualified 2 CA/ECC 06/2019

    Intermediate CAValid (1043 days left)
    Issuer
    I.CA Root CA/ECC 12/2016
    Valid
    to
    Serial
    05f5e509
    SHA-256
    b7fac27aa6…cac9b5a545

    Issuer "I.CA Root CA/ECC 12/2016" is not present in this mirror, so the chain cannot be fully resolved here.

  • I.CA Qualified 2 CA/RSA 02/2016

    Intermediate CAExpired (181 days ago)
    Issuer
    I.CA Root CA/RSA
    Valid
    to
    Serial
    05f5e4ee
    SHA-256
    076abc2269…e17036aa3a

    Issuer "I.CA Root CA/RSA" is not present in this mirror, so the chain cannot be fully resolved here.

  • I.CA Qualified CA/RSA 07/2015

    Intermediate CAExpired (399 days ago)
    Issuer
    I.CA Root CA/RSA
    Valid
    to
    Serial
    05f5e4ec
    SHA-256
    de2ea05839…b1e611da7e

    Issuer "I.CA Root CA/RSA" is not present in this mirror, so the chain cannot be fully resolved here.

  • I.CA SSL EV CA/RSA 10/2017

    Intermediate CAValid (442 days left)
    Issuer
    I.CA Root CA/RSA
    Valid
    to
    Serial
    05f5e4fe
    SHA-256
    75f5c8db96…9d359c3b09

    Issuer "I.CA Root CA/RSA" is not present in this mirror, so the chain cannot be fully resolved here.

  • I.CA TLS EV CA/RSA 06/2022

    Intermediate CAValid (2142 days left)
    Issuer
    I.CA TLS Root CA/RSA 05/2022
    Valid
    to
    Serial
    05f5e52f
    SHA-256
    b9ef51a5f6…ea88aef4ed

    Issuer "I.CA TLS Root CA/RSA 05/2022" is not present in this mirror, so the chain cannot be fully resolved here.

  • I.CA TSA CA/RSA 06/2022

    Intermediate CAValid (2140 days left)
    Issuer
    I.CA Root CA/RSA 05/2022
    Valid
    to
    Serial
    05f5e52b
    SHA-256
    52b27152bd…d12ff6f9e1

    Issuer "I.CA Root CA/RSA 05/2022" is not present in this mirror, so the chain cannot be fully resolved here.

  • I.CA TSACA/RSA 03/2022

    Intermediate CAValid (2045 days left)
    Issuer
    I.CA Root CA/RSA
    Valid
    to
    Serial
    05f5e522
    SHA-256
    6ab6349834…081997f27f

    Issuer "I.CA Root CA/RSA" is not present in this mirror, so the chain cannot be fully resolved here.

  • I.CA TSACA/RSA 05/2017

    Intermediate CAValid (267 days left)
    Issuer
    I.CA Root CA/RSA
    Valid
    to
    Serial
    05f5e4f4
    SHA-256
    4ab8bc6061…64c791f768

    Issuer "I.CA Root CA/RSA" is not present in this mirror, so the chain cannot be fully resolved here.

  • Komerční banka Qualified CA/RSA

    Intermediate CAValid (2388 days left)
    Issuer
    KB Root 3 CA
    Valid
    to
    Serial
    1800000005…000005
    SHA-256
    163eea7a8d…8077ca7775

    Issuer "KB Root 3 CA" is not present in this mirror, so the chain cannot be fully resolved here.

  • NCA SubCA1/ECC 07/2022

    Intermediate CAValid (2151 days left)
    Issuer
    NCA Root CA/ECC 06/2022
    Valid
    to
    Serial
    03fa
    SHA-256
    f1878ab758…463b0af92d

    Issuer "NCA Root CA/ECC 06/2022" is not present in this mirror, so the chain cannot be fully resolved here.

  • NCA SubCA1/ECC 10/2023

    Intermediate CAValid (2630 days left)
    Issuer
    NCA Root CA/ECC 10/2023
    Valid
    to
    Serial
    0401
    SHA-256
    acb2150bff…d695933587

    Issuer "NCA Root CA/ECC 10/2023" is not present in this mirror, so the chain cannot be fully resolved here.

  • NCA SubCA1/RSA 05/2022

    Intermediate CAValid (2101 days left)
    Issuer
    NCA Root CA/RSA 04/2022
    Valid
    to
    Serial
    03f2
    SHA-256
    60fb6c64b6…66e6c57b4e

    Issuer "NCA Root CA/RSA 04/2022" is not present in this mirror, so the chain cannot be fully resolved here.

  • NCA SubCA1/RSA 10/2023

    Intermediate CAValid (2630 days left)
    Issuer
    NCA Root CA/RSA 10/2023
    Valid
    to
    Serial
    0400
    SHA-256
    a442ec1e44…0a7c53324a

    Issuer "NCA Root CA/RSA 10/2023" is not present in this mirror, so the chain cannot be fully resolved here.

  • NCA SubCA1/RSA 12/2018

    Intermediate CAValid (853 days left)
    Issuer
    NCA Root CA/RSA 12/2018
    Valid
    to
    Serial
    03e9
    SHA-256
    eb0944c491…2729bd28a5

    Issuer "NCA Root CA/RSA 12/2018" is not present in this mirror, so the chain cannot be fully resolved here.

  • PostSignum Qualified CA

    Intermediate CAExpired (2314 days ago)
    Issuer
    PostSignum Root QCA
    Valid
    to
    Serial
    1c
    SHA-256
    6e7923e286…a467df96c3

    Issuer "PostSignum Root QCA" is not present in this mirror, so the chain cannot be fully resolved here.

  • PostSignum Qualified CA 2

    Intermediate CAExpired (2393 days ago)
    Issuer
    PostSignum Root QCA 2
    Valid
    to
    Serial
    71
    SHA-256
    3ae4f4de5f…6cadff2cac

    Issuer "PostSignum Root QCA 2" is not present in this mirror, so the chain cannot be fully resolved here.

  • PostSignum Qualified CA 3

    Intermediate CAExpired (865 days ago)
    Issuer
    PostSignum Root QCA 2
    Valid
    to
    Serial
    00a4
    SHA-256
    d35e250cb0…b54e3b1f02

    Issuer "PostSignum Root QCA 2" is not present in this mirror, so the chain cannot be fully resolved here.

  • PostSignum Qualified CA 3-TSA

    Intermediate CAExpired (566 days ago)
    Issuer
    PostSignum Root QCA 2
    Valid
    to
    Serial
    00d5
    SHA-256
    270b33efcd…c33f8ddb07

    Issuer "PostSignum Root QCA 2" is not present in this mirror, so the chain cannot be fully resolved here.

  • PostSignum Qualified CA 4

    Intermediate CAValid (2607 days left)
    Issuer
    PostSignum Root QCA 4
    Valid
    to
    Serial
    1011
    SHA-256
    4779ba66c7…78b34dff2b

    Issuer "PostSignum Root QCA 4" is not present in this mirror, so the chain cannot be fully resolved here.

  • PostSignum Qualified CA 5

    Intermediate CAValid (2613 days left)
    Issuer
    PostSignum Root QCA 4
    Valid
    to
    Serial
    106b
    SHA-256
    bd0636abc7…b1e7e2a2ea

    Issuer "PostSignum Root QCA 4" is not present in this mirror, so the chain cannot be fully resolved here.

  • PostSignum Qualified ECC R1 CA1

    Intermediate CAValid (2732 days left)
    Issuer
    PostSignum Root QCA ECC R1
    Valid
    to
    Serial
    7f0250247b…8a465b
    SHA-256
    e4d6cdf6bd…0ae7a8a23b

    Issuer "PostSignum Root QCA ECC R1" is not present in this mirror, so the chain cannot be fully resolved here.

  • PostSignum Qualified ECC R1 CA3

    Intermediate CAValid (2732 days left)
    Issuer
    PostSignum Root QCA ECC R1
    Valid
    to
    Serial
    274a71e0a6…e9475a
    SHA-256
    ebf8d157ab…d9c938ef3a

    Issuer "PostSignum Root QCA ECC R1" is not present in this mirror, so the chain cannot be fully resolved here.