# ePKI Root Certification Authority root certificate (Chunghwa Telecom)

> ePKI Root Certification Authority is a root CA certificate operated by Chunghwa Telecom (RSA 4096, valid until 2034-12-20, SHA-256 C0A6F4DC). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/chunghwa-telecom-epki-root-ca/
Last updated: 2026-11-10

ePKI Root Certification Authority is a root CA certificate operated by Chunghwa Telecom (RSA 4096, valid until 2034-12-20, SHA-256 C0A6F4DC). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Chunghwa Telecom |
| Subject | OU=ePKI Root Certification Authority,O=Chunghwa Telecom Co.\, Ltd.,C=TW |
| SHA-256 | C0A6F4DC63A24BFDCF54EF2A6A082A0A72DE35803E2FF5FF527AE5D87206DFD5 |
| SPKI SHA-256 | 62554C17005543B237215F04268DCD2FD1C470240AD3C8660E25AE2C59630F55 |
| Valid from | 2004-12-20 |
| Expires | 2034-12-20 |
| Key | RSA 4096 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 15C8BD65475CAFB897005EE406D2BC9D |
| SHA-1 (Windows thumbprint) | 67650DF17E8E7E5B8240A4F4564BCFE23D69C6F0 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Removed | No | - | - |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection, timeStamping, codeSigning |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security IKE Intermediate, IP Security Tunnel Termination, IP Security User, OCSP Signing, Secure Email, Time Stamping |

The CCADB lists no EV policy OID for ePKI Root Certification Authority.

## Intermediate CAs issued by this root

The CCADB lists 10 intermediate CA certificates signed directly by ePKI Root Certification Authority: 2 currently valid, 0 expired and 8 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Public Certification Authority - G2 | Chunghwa Telecom | 2034-12-11 | Valid | DAE3434F696FC9F0F652E1B2A6F69B5E9273D09F43BD3BDD4717D6141F8CD2C2 |
| Public Certification Authority - G2 | Chunghwa Telecom | 2034-12-11 | Valid | 609930EB807AD420AFDA2A8AA61B67483039168CD766E09942A48BFE7F3BDC10 |
| HiPKI Root CA - G1 | Chunghwa Telecom | 2034-12-19 | Revoked | 6807C97235C5EC6090269A4B5FEDFAB46986E42F4D67D2EDDDCF6E45CF0DFA80 |
| ePKI Root Certification Authority - G2 | Chunghwa Telecom | 2034-12-20 | Revoked | 72D716F7BB6BD105704F42B9524923510DCB85B2D870C0E9ADA5AEB9C969051A |
| ePKI Root Certification Authority - G2 | Chunghwa Telecom | 2034-12-20 | Revoked | 64717250AF8B028DD8E5C0BAE4C9142C8B103532612BC487085FD3C319F9C067 |
| ePKI Root Certification Authority - G2 | Chunghwa Telecom | 2034-12-20 | Revoked | 44A157D9348860A7D4CE7C92E1A389E4CC0CA5967F9DBBBD126639F9B98046B7 |
| ePKI Root Certification Authority - G2 | Chunghwa Telecom | 2034-12-20 | Revoked | 18467C4E64D586C844A44466DE5BA7A6D5969C7A92859A511C5FDAD75B03CDCE |
| Public Certification Authority | Chunghwa Telecom | 2027-05-16 | Revoked | 4BD16F4955F3F3C9C8EA48EF9995324DA5121724F89915D5F2C91EB0BAEF2337 |
| Public Certification Authority | Chunghwa Telecom | 2027-05-16 | Revoked | 464B0EC0A602F0193DB5F33911885A3A61921AD16D2664E25BEFAB10CFA6ED25 |
| 中華電信憑證管理中心 | Chunghwa Telecom | 2025-08-30 | Revoked | C3CED6B757269BCBFD6613C4349F2821D3449CB550E9C3CA16D7D391FF71FE5C |

## Cross-signed versions

3 certificate(s) in the CCADB have the same subject and public key as ePKI Root Certification Authority but a different issuer. A server can send one of them so that clients which trust the issuing root, but not ePKI Root Certification Authority, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| ePKI Root Certification Authority - G2 | Chunghwa Telecom | 2034-12-20 | Revoked | 979E5FF7DD258545F1D1D737F9408F3A55AE77C8FC6E61DC474250D2C979B051 |
| ePKI Root Certification Authority - G2 | Chunghwa Telecom | 2034-12-20 | Revoked | B9C974DE139F6308D74CCC423C3BC0BDED5E7AB4AD738B304B50D429C42C3D66 |
| ePKI Root Certification Authority - G2 | Chunghwa Telecom | 2034-12-20 | Revoked | D108C34A58C0E4A616449F8C48318023A229C86CD3DDD5D5FE6041A401C16A14 |

## What happens when it expires

ePKI Root Certification Authority is valid until 2034-12-20, about 8.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is ePKI Root Certification Authority trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does ePKI Root Certification Authority expire?**

On 2034-12-20, about 8.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has ePKI Root Certification Authority issued?**

The CCADB lists 10: 2 valid, 0 expired and 8 revoked. The newest valid one is Public Certification Authority - G2, valid until 2034-12-11.

**Is ePKI Root Certification Authority cross-signed?**

Yes. The CCADB has 3 cross-certificate(s) with its subject and key, signed by ePKI Root Certification Authority - G2; 0 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).