How to Select Intermediate and Root Certificates for Thawte SSL
You may select different intermediate and root certificates (ICAs) when generating your Thawte SSL certificate on TheSSLStore.com.
The majority of users should keep the default Intermediate option.
If you need to select a specific intermediate and root certificate for your Thawte SSL, please use these tables as a reference to pick the correct chain on your SSL generation form.
(Note: the certificate menu may only show the name of the intermediate certificate – the tables indicate which root will be provided for each intermediate selection).
Thawte EV SSL ICAs
| Intermediate | Root | Info |
| Thawte EV RSA CA G2 (SHA2-256) | DigiCert Global Root G2 (SHA2-256) | G2 root |
| Thawte TLS ECC CA G1 (SHA256ECDSA) | DigiCert Global Root G3 (SHA384ECDSA) | G3 root |
| Thawte EV ECC CA 2018 (SHA2-256) | DigiCert High Assurance EV Root CA (SHA1) | NOT RECOMMENDED: This root will be removed from trust stores on April 14, 2026 |
| Thawte EV ECC CA 2018 (SHA2-256) | DigiCert High Assurance EV Root CA (SHA1) | NOT RECOMMENDED: This root will be removed from trust stores on April 14, 2026 |
| Thawte G5 TLS RSA4096 SHA384 2022 CA1 (SHA2-384) | DigiCert TLS RSA4096 Root G5 | The G5 root is not widely trusted and requires a cross-signed intermediate. |
Thawte OV SSL ICAs
| Intermediate | Root | Info |
| Thawte TLS RSA CA G1 (SHA2-256) |
DigiCert Global Root G2 (SHA2-256) |
G2 root |
| Thawte TLS ECC CA G1 (SHA256ECDSA) | DigiCert Global Root G3 (SHA384ECDSA) | G3 root |
| Thawte RSA CA 2018 (SHA2-256) | DigiCert Global Root CA (SHA1) | NOT RECOMMENDED: This root will be removed from trust stores on April 14, 2026 |
| Thawte ECC CA 2018 (SHA2-256) | DigiCert Global Root CA (SHA1) | NOT RECOMMENDED: This root will be removed from trust stores on April 14, 2026 |
| Thawte G5 TLS RSA4096 SHA384 2022 CA1 (SHA2-384) | DigiCert TLS RSA4096 Root G5 (SHA2-384) | The G5 root is not widely trusted and requires a cross-signed intermediate. |
| Thawte G5 TLS ECC P-384 SHA384 2022 CA2 (SHA384ECDSA) | DigiCert TLS ECC P384 Root G5 (SHA384ECDSA) | The G5 root is not widely trusted and requires a cross-signed intermediate. |
Thawte DV SSL ICAs
At this time, Domain Validation (DV) level SSL cannot change intermediate or root certificates during enrollment or re-issue.
The default root for Thawte DV SSL is DigiCert Global Root G2.
If you need help with the intermediate and root chain for your DV SSL certificate, please open a support ticket from your account email address for best assistance.