# UCA Global G2 Root root certificate (SHECA)

> UCA Global G2 Root is a root CA certificate operated by SHECA (RSA 4096, valid until 2040-12-31, SHA-256 9BEA11C9). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Mozilla, Microsoft.

Source: https://ssl.sh/roots/sheca-uca-global-g2-root/
Last updated: 2026-11-10

UCA Global G2 Root is a root CA certificate operated by SHECA (RSA 4096, valid until 2040-12-31, SHA-256 9BEA11C9). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Mozilla, Microsoft.

| Field | Value |
|---|---|
| CA owner | SHECA |
| Subject | CN=UCA Global G2 Root,O=UniTrust,C=CN |
| SHA-256 | 9BEA11C976FE014764C1BE56A6F914B5A560317ABD9988393382E5161AA0493C |
| SPKI SHA-256 | 1255CABE8152FA64DF942F7A47417E29F96C1CE11BF8C84ECBE2815CC1280810 |
| Valid from | 2016-03-11 |
| Expires | 2040-12-31 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 5DDFB1DA5AA3ED5DBE5A6520650390EF |
| SHA-1 (Windows thumbprint) | 28F97816197AFF182518AA44FEC1A0CE5CB64C8A |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.41 / Firefox 65; Inclusion bug: #1309797 |
| Apple | Not included | No | - | - |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Document Signing, Secure Email, Time Stamping |

The CCADB lists no EV policy OID for UCA Global G2 Root.

## Intermediate CAs issued by this root

The CCADB lists 71 intermediate CA certificates signed directly by UCA Global G2 Root: 54 currently valid, 0 expired and 17 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| HUAWEI DV TLS RSA CA 2026 | Shanghai Electronic Certification Authority Co., Ltd. | 2029-04-22 | Valid | A0B472CBA2F1C2AFB4A162526E3D14A6475981E84C8E16051B45F43D329C9DE5 |
| CHINA UNICOM OV TLS RSA CA 2026 | Shanghai Electronic Certification Authority Co., Ltd. | 2029-04-22 | Valid | 9F883607914160EB4D2C216D10F9086F1E5B4D0CB215251D0B7E6EA47B9FF3EA |
| CHINA UNICOM OV TLS ECC CA 2026 | Shanghai Electronic Certification Authority Co., Ltd. | 2029-04-22 | Valid | 8EFB702407B9B2800D68F4456B9ECD6F2807BBE83D46B6D7FFCB9CFF919F0460 |
| HUAWEI DV TLS ECC CA 2026 | Shanghai Electronic Certification Authority Co., Ltd. | 2029-04-22 | Valid | 8577470BEBF1D26E4C254AE9B93A06F984EB3778B5FFFA3239F366A274A64D55 |
| HUAWEI OV TLS ECC CA 2026 | Shanghai Electronic Certification Authority Co., Ltd. | 2029-04-22 | Valid | 6DDEF9228F189B6EEC284AFAC3204B77F0AC9B655BD56571C108E9B70D82385A |
| CHINA UNICOM DV TLS ECC CA 2026 | Shanghai Electronic Certification Authority Co., Ltd. | 2029-04-22 | Valid | 6811F3CB2C6D24D32BE074ED6D2288C6546FD179E222E4B948DF20384246982F |
| CHINA UNICOM DV TLS RSA CA 2026 | Shanghai Electronic Certification Authority Co., Ltd. | 2029-04-22 | Valid | 34113CD6536053410ED51951F6C9EBBC85EE47C3D6524F50EF5A671317E46ED6 |
| HUAWEI OV TLS RSA CA 2026 | Shanghai Electronic Certification Authority Co., Ltd. | 2029-04-22 | Valid | 070E55A0FCFB5F882D30921125C3B5C3B15DC890E3B08577A69FF264B7B3C4E7 |
| UniTrust Global TLS ECC Root CA R2 | Shanghai Electronic Certification Authority Co., Ltd. | 2029-02-04 | Valid | F2384371C93EB284166FD07A34F211FAA697B6FC20D4D31F7A8E4A3283CA3FF1 |
| SanFront DV TLS RSA CA G2 | Shanghai Electronic Certification Authority Co., Ltd. | 2030-11-11 | Valid | 7C7DA4E281AF24FEF35A6711ECA55DBFF1C6333709DFC679470F325D1CBD9460 |
| SanFront OV TLS RSA CA G2 | Shanghai Electronic Certification Authority Co., Ltd. | 2030-11-11 | Valid | 37A7BCAF399CA6C24F3ABB6E0AF9DDE32AEEEBA1D36AECC958C7631609FE01A9 |
| SanFront OV TLS RSA CA G1 | Shanghai Electronic Certification Authority Co., Ltd. | 2030-09-17 | Valid | E1C893A5658D63E2BA78CAFF160B81F9836B6A851F1A3CAA48B3B4E287F0092F |
| SanFront DV TLS RSA CA G1 | Shanghai Electronic Certification Authority Co., Ltd. | 2030-09-17 | Valid | 7D7702A277CFEBC283F6F24A2C17CA0EBA7600096105244AD1913E7BE2E56A29 |
| SNCA OV TLS RSA CA G1 | Shanghai Electronic Certification Authority Co., Ltd. | 2035-04-27 | Valid | F077E1AF11CFE1E8A12871F9080B69EFB8B41E8B4A4B95AB513CDF650C76B2C2 |
| SHECA OV TLS RSA CA A1 | Shanghai Electronic Certification Authority Co., Ltd. | 2035-04-27 | Valid | E7B1C6B04B6C9A3A2960D3888F8081880AC214ABBD01BF9E0362A8354CFCA720 |
| Xinnet OV TLS RSA CA G2 | Shanghai Electronic Certification Authority Co., Ltd. | 2035-04-27 | Valid | D0AEB66EF3649A73FA1F8A0317DB54C61257A7F4A14D1112BE742B5EB63F6622 |
| Xinnet DV TLS RSA CA G2 | Shanghai Electronic Certification Authority Co., Ltd. | 2035-04-27 | Valid | CC379B3FC6555754C11696364926F828A1FAFED714C9AD9203227174E7603BBA |
| SHECA DV TLS RSA CA A1 | Shanghai Electronic Certification Authority Co., Ltd. | 2035-04-27 | Valid | 7CD13B8B9E51BD6EAE0116D7F89E3F21EAA3ABA2A20997B2606A3DCC578E7295 |
| CT2 DV TLS RSA CA G2 | Shanghai Electronic Certification Authority Co., Ltd. | 2035-04-27 | Valid | 474EE178BCCBDD652115707CDC9251FDF48441C9002229C2AE0DE0E33750FBEA |
| CT2 OV TLS RSA CA G2 | Shanghai Electronic Certification Authority Co., Ltd. | 2035-04-27 | Valid | 062884FAEA204C09D10E90FB0069E7BC4E4D93D0316D9F7EFE4E2AFE34226123 |

## Cross-signed versions

4 certificate(s) in the CCADB have the same subject and public key as UCA Global G2 Root but a different issuer. A server can send one of them so that clients which trust the issuing root, but not UCA Global G2 Root, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Certum Trusted Network CA | Asseco Data Systems S.A. | 2029-01-06 | Valid | BB61408AED9F530B2EC0545E53BA2C8EBEAA57D9976447DB1663CED4600CD6B7 |
| Certum Trusted Network CA | Asseco Data Systems S.A. | 2029-01-06 | Valid | BFA95C5DF164B659FA32F6D10564D7170DDE661A853A782E6AB63639433BCB41 |
| Certum Trusted Network CA | Asseco Data Systems S.A. | 2025-02-21 | Revoked | C1AFC65B1E813B0E6146E6AA5341681272ABE9A38D59F7BD1B27B729834A0D9C |
| Certum Trusted Network CA | Asseco Data Systems S.A. | 2025-02-21 | Expired | 3DD69C5BE170F943F804D1D31FE8F916C0C0226CDDD7AEA9AA9A0CDFD3474361 |

## What happens when it expires

UCA Global G2 Root is valid until 2040-12-31, about 14.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is UCA Global G2 Root trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Chrome, Mozilla, Microsoft trust it for TLS server authentication; Apple do not.

**When does UCA Global G2 Root expire?**

On 2040-12-31, about 14.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has UCA Global G2 Root issued?**

The CCADB lists 71: 54 valid, 0 expired and 17 revoked. The newest valid one is HUAWEI DV TLS RSA CA 2026, valid until 2029-04-22.

**Is UCA Global G2 Root cross-signed?**

Yes. The CCADB has 4 cross-certificate(s) with its subject and key, signed by Certum Trusted Network CA; 2 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).