# T-TeleSec GlobalRoot Class 2 root certificate (Deutsche Telekom Security)

> T-TeleSec GlobalRoot Class 2 is a root CA certificate operated by Deutsche Telekom Security (RSA 2048, valid until 2033-10-01, SHA-256 91E2F578). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/telekom-security-t-telesec-globalroot-class-2/
Last updated: 2026-11-10

T-TeleSec GlobalRoot Class 2 is a root CA certificate operated by Deutsche Telekom Security (RSA 2048, valid until 2033-10-01, SHA-256 91E2F578). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Deutsche Telekom Security |
| Subject | CN=T-TeleSec GlobalRoot Class 2,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE |
| SHA-256 | 91E2F5788D5810EBA7BA58737DE1548A8ECACD014598BC0B143E041B17052552 |
| SPKI SHA-256 | 6106C0E3A0A299831875127BD7D3CC1859803D511CAC11EB6E0840DD166FC10E |
| Valid from | 2008-10-01 |
| Expires | 2033-10-01 |
| Key | RSA 2048 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 1 |
| SHA-1 (Windows thumbprint) | 590D2D7D884F402E617EA562321765CF17D894E9 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2026-05-28 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.16 / Firefox 29; Inclusion bug: #892390 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Secure Email |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2026-05-28 (sct_not_after). The CCADB lists no EV policy OID for T-TeleSec GlobalRoot Class 2.

## Intermediate CAs issued by this root

The CCADB lists 32 intermediate CA certificates signed directly by T-TeleSec GlobalRoot Class 2: 14 currently valid, 3 expired and 15 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Telekom Security SMIME ECC Root 2021 | Deutsche Telekom Security GmbH | 2033-09-30 | Valid | 827C9A5F1250930AAF6B7D0AC5780618F4FA0C44F5A85F1BF976A8F1139FDFDF |
| Telekom Security SMIME RSA Root 2023 | Deutsche Telekom Security GmbH | 2033-09-30 | Valid | 56E7ED2FCBA30AC36C1D39AC336A33A8655D4656E453B3E9C9E5BACF4BF346A4 |
| Deutsche Telekom SMIME qualified CA 25 | Deutsche Telekom Security GmbH | 2033-09-30 | Valid | E84F2DBEA23690D8B850805B335454B0E773AD4C6992C7EF9DD005088CBEF2E1 |
| Telekom Security OV qualified CA 25 | Deutsche Telekom Security GmbH | 2033-09-30 | Valid | AC2930B9D77A3F0D253374FA01CD3F44E80184D60C5693637DFA2CC427C3E92B |
| Telekom Security SMIME CA 25 | Deutsche Telekom Security GmbH | 2033-09-30 | Valid | BE096522370C4BABCA86876B3060A94FC3D157613C3500606A9E5691DA7D11E7 |
| Deutsche Telekom AG secure email CA E05 | Deutsche Telekom Security GmbH | 2028-08-08 | Valid | 1AB8A68FCBBA644D5C6D2627FE6D943CE4FD3E58619B3B087F3CF4EFA838C46A |
| Telekom Security BusinessID SMIME CA 2023 | Deutsche Telekom Security GmbH | 2033-06-19 | Valid | 6F25BD0E9E7492D15375089EB97C1C0747537336BB0FA82543BD2A485BE61A00 |
| Telekom Security ServerID OV Class 2 CA | Deutsche Telekom Security GmbH | 2027-08-02 | Valid | 944ACE961DB316BEB694E01C302C46FED40DC0291729E7DAF58550C3CB55E791 |
| Telekom Security OV RSA CA 22 | Deutsche Telekom Security GmbH | 2032-06-21 | Valid | D5D9445EEAA5576081DDF2E6C0904091BBC79BA10915E5215C8A2A7D87915FFD |
| TeleSec Business TLS-CA 2022 | Deutsche Telekom Security GmbH | 2032-06-21 | Valid | A3F2A10A366AFF774CBB4E6EC4C8A8EF707C03E932B4C46E5078767AACF1ED60 |
| Telekom Security DV RSA CA 22 | Deutsche Telekom Security GmbH | 2032-02-22 | Valid | 938E52642501DD16E23D8AEBFB97EB3C3B2562F50C324144C390946B29684A7E |
| TeleSec Business CA 21 | Deutsche Telekom Security GmbH | 2031-11-17 | Valid | 06B58F124B45E9417708F60CDDAEB6F39B72206FE4BD40EE2E20E628DDFDD33D |
| Deutsche Telekom AG secure email CA E03 | Deutsche Telekom Security GmbH | 2030-07-09 | Valid | 38CBC81860C904BDF18046CD0FB7754E44D569398DD14FBF09F72AA20FC35CCF |
| DFN-Verein Certification Authority 2 | DFN-Verein | 2031-02-22 | Valid | F660B0C256481CB2BFC67661C1EA8FEEE395B7141BCAC36C36E04D08CD9E1582 |
| TeleSec ServerPass Class 2 CA | Deutsche Telekom Security GmbH | 2024-02-11 | Expired | AC1EC556318E3EA70F8F04E03A0F2633BFE73992359A810145FFDF1A427396EE |
| TeleSec Business CA 1 | Deutsche Telekom Security GmbH | 2024-11-29 | Expired | 44EBF0123E27FF1DB0497BD2DAE18155B2A414E6BCD9C6C8FB8F48398449B9E9 |
| T-TeleSec GlobalCA Class 2 | Deutsche Telekom Security GmbH | 2018-10-01 | Expired | 5DB6C9F86D2C135E79E5AC72A7087A4DABBA101BAD42D577DF68C74C204B9BEC |
| Telekom Security OV qCA 25 | Deutsche Telekom Security GmbH | 2033-09-30 | Revoked | 9805946CD46CD2F22276D463F582D4E811EE24025D8C17D6ED0ACE38F736674C |
| Telekom Security SMIME qCA 25 | Deutsche Telekom Security GmbH | 2033-09-30 | Revoked | 83EA688E78ECCC5D2CEA19ABD680DA6341F50CD1470D9F9BFAF7F5E147E40FDB |
| Deutsche Telekom AG secure email CA E04 | Deutsche Telekom Security GmbH | 2028-06-19 | Revoked | 651656EDA8A9765470C57B3692A4FF62D9B05AB5CE1179E866B70F4DAFD754FD |

## Cross-signed versions

2 certificate(s) in the CCADB have the same subject and public key as T-TeleSec GlobalRoot Class 2 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not T-TeleSec GlobalRoot Class 2, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Deutsche Telekom Root CA 2 | Deutsche Telekom Security GmbH | 2018-10-01 | Expired | A89C6829CE2AAD87813B39955ECB23C2EF5F70376ED6C48CCED856F620EB9C6D |
| Deutsche Telekom Root CA 2 | Deutsche Telekom Security GmbH | 2019-07-09 | Expired | 09BC51517A97F66339E24D77E9CABE4E46695C2EC1B42A239E1EFBA7B72F328F |

## What happens when it expires

T-TeleSec GlobalRoot Class 2 is valid until 2033-10-01, about 6.9 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2026-05-28.

## FAQ

**Is T-TeleSec GlobalRoot Class 2 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2026-05-28.

**When does T-TeleSec GlobalRoot Class 2 expire?**

On 2033-10-01, about 6.9 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has T-TeleSec GlobalRoot Class 2 issued?**

The CCADB lists 32: 14 valid, 3 expired and 15 revoked. The newest valid one is Telekom Security SMIME ECC Root 2021, valid until 2033-09-30.

**Is T-TeleSec GlobalRoot Class 2 cross-signed?**

Yes. The CCADB has 2 cross-certificate(s) with its subject and key, signed by Deutsche Telekom Root CA 2; 0 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).