# NAVER Global Root Certification Authority root certificate (NAVER Cloud Trust Services)

> NAVER Global Root Certification Authority is a root CA certificate operated by NAVER Cloud Trust Services (RSA 4096, valid until 2037-08-18, SHA-256 88F438DC). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/naver-cloud-trust-naver-global-root-ca/
Last updated: 2026-11-10

NAVER Global Root Certification Authority is a root CA certificate operated by NAVER Cloud Trust Services (RSA 4096, valid until 2037-08-18, SHA-256 88F438DC). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | NAVER Cloud Trust Services |
| Subject | CN=NAVER Global Root Certification Authority,O=NAVER BUSINESS PLATFORM Corp.,C=KR |
| SHA-256 | 88F438DCF8FFD1FA8F429115FFE5F82AE1E06E0C70C375FAAD717B34A49E7265 |
| SPKI SHA-256 | 786FFA578618C3B9A311175E50816F4DDA0605C3869F296EBC5943BF09F4E904 |
| Valid from | 2017-08-18 |
| Expires | 2037-08-18 |
| Key | RSA 4096 |
| Signature algorithm | sha384WithRSAEncryption |
| Serial number | 194301EA20BDDF5C5332AB1434471F8D6504D0D |
| SHA-1 (Windows thumbprint) | 8F6BF2A9274ADA14A0C4F48E6127F9C01E785DD1 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.60 / Firefox 85; Inclusion bug: #1404221 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Document Signing, Secure Email; Not-before cutoff: 2026-05-19 (Secure Email) |

The CCADB lists no EV policy OID for NAVER Global Root Certification Authority.

## Intermediate CAs issued by this root

The CCADB lists 8 intermediate CA certificates signed directly by NAVER Global Root Certification Authority: 3 currently valid, 0 expired and 5 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| NAVER Cloud Trust Services RSA Root G1 | NAVER Cloud Trust Services | 2036-05-13 | Valid | 6450194DDCAECF1585DC305420CBB335BD32396F798AD8DB3B79B53324DAD28A |
| NAVER Secure Certification Authority 3 | NAVER Cloud Trust Services | 2029-09-13 | Valid | 5265926E169BBEE7E2233A573DD258FE00AC1A151BE454548A2021CD4D12C1A3 |
| NAVER Cloud Trust Services ECC Root G1 | NAVER Cloud Trust Services | 2036-06-04 | Valid | 9C6D1D29072CEB7E12F436D6EC27EFE9F9D7A132968A4B2AAB955654CE8D2004 |
| NAVER Cloud Trust Services RSA Root G1 | NAVER Cloud Trust Services | 2036-06-04 | Revoked | 5BC2A8B50804AE2B2EC487B58902CC05ACA1C2F56E98C5B97113FF958016694A |
| NAVER Secure Certification Authority 2 | NAVER Cloud Trust Services | 2035-11-19 | Revoked | 571E521E5E22810D33BB1A39991143E9E64CD8DAE97D65931B194E19AEE81E86 |
| NAVER Cloud Trust Services RSA Root G1 | NAVER Cloud Trust Services | 2038-12-09 | Revoked | 67F9DA159B4AEB3B55E2C37C402E91CEFE87D784D81CE949FA532184620C3CFD |
| NAVER Cloud Trust Services ECC Root G1 | NAVER Cloud Trust Services | 2038-12-09 | Revoked | 355CD125F93CE5BF268F958C1D1F8AAD289FDBD41BAFAA856691DB7260F2ACAB |
| NAVER Secure Certification Authority 1 | NAVER Cloud Trust Services | 2027-08-18 | Revoked | C5EB1A7639B9D8D70B4F82ADD80794175EE4B6A3DB1861B38717C96FC1914927 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as NAVER Global Root Certification Authority with a different issuer, so a client has to carry NAVER Global Root Certification Authority itself in its root store to trust it.


## What happens when it expires

NAVER Global Root Certification Authority is valid until 2037-08-18, about 10.8 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is NAVER Global Root Certification Authority trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does NAVER Global Root Certification Authority expire?**

On 2037-08-18, about 10.8 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has NAVER Global Root Certification Authority issued?**

The CCADB lists 8: 3 valid, 0 expired and 5 revoked. The newest valid one is NAVER Cloud Trust Services RSA Root G1, valid until 2036-05-13.

**Is NAVER Global Root Certification Authority cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).