# CA Disig Root R2 root certificate (Disig, a.s.)

> CA Disig Root R2 is a root CA certificate operated by Disig, a.s. (RSA 4096, valid until 2042-07-19, SHA-256 E23D4A03). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/disig-ca-disig-root-r2/
Last updated: 2026-11-10

CA Disig Root R2 is a root CA certificate operated by Disig, a.s. (RSA 4096, valid until 2042-07-19, SHA-256 E23D4A03). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Disig, a.s. |
| Subject | CN=CA Disig Root R2,O=Disig a.s.,L=Bratislava,C=SK |
| SHA-256 | E23D4A036D7B70E9F595B1422079D2B91EDFBB1FB651A0633EAA8A9DC5F80703 |
| SPKI SHA-256 | 702116CCD8BF23E16466F0E0DBA0ED6A239A9C1CD6A8F5A66B39AF3595020385 |
| Valid from | 2012-07-19 |
| Expires | 2042-07-19 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 92B888DBB08AC163 |
| SHA-1 (Windows thumbprint) | B561EBEAA4DEE4254B691A98A55747C234C7D971 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.15 / Firefox 23; Inclusion bug: #792377 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, Secure Email, Time Stamping; Not-before cutoff: 2020-06-01 (Code Signing) |

The CCADB lists no EV policy OID for CA Disig Root R2.

## Intermediate CAs issued by this root

The CCADB lists 5 intermediate CA certificates signed directly by CA Disig Root R2: 3 currently valid, 0 expired and 2 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| CA Disig TLS Root R3 | Disig, a.s. | 2029-04-12 | Valid | 1E4CF8FA6ADA4DB81C33BB8E4BF73B8D29E99C119FF0B7A42D58032366F56509 |
| CA Disig R2I5 Certification Service | Disig, a.s. | 2033-04-20 | Valid | 90BA720B376FB9FDCF8A1037A5316FB493B5ACF656AD79C6839008BD43343FDD |
| CA Disig R2I2 Certification Service | Disig, a.s. | 2029-09-28 | Valid | C96F24C45113FD91AE2F9E40E106653BFA0FFBCFA07E209524C844E7C8DA4148 |
| CA Disig R2I3 Certification Service | Disig, a.s. | 2029-09-28 | Revoked | 239FFA86D71033BA255914782057D87E8421AEDD5910B786928B6A1248C3E341 |
| CA Disig R2I1 Certification Service | Disig, a.s. | 2027-09-08 | Revoked | AC6E48D14A31D62CB8C1522D006AAD585A892636D9CD2D798CB61EA13B4957BD |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as CA Disig Root R2 with a different issuer, so a client has to carry CA Disig Root R2 itself in its root store to trust it.


## What happens when it expires

CA Disig Root R2 is valid until 2042-07-19, about 15.7 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is CA Disig Root R2 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does CA Disig Root R2 expire?**

On 2042-07-19, about 15.7 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has CA Disig Root R2 issued?**

The CCADB lists 5: 3 valid, 0 expired and 2 revoked. The newest valid one is CA Disig TLS Root R3, valid until 2029-04-12.

**Is CA Disig Root R2 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).