# T-TeleSec GlobalRoot Class 3 root certificate (Deutsche Telekom Security)

> T-TeleSec GlobalRoot Class 3 is a root CA certificate operated by Deutsche Telekom Security (RSA 2048, valid until 2033-10-01, SHA-256 FD73DAD3). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/telekom-security-t-telesec-globalroot-class-3/
Last updated: 2026-11-10

T-TeleSec GlobalRoot Class 3 is a root CA certificate operated by Deutsche Telekom Security (RSA 2048, valid until 2033-10-01, SHA-256 FD73DAD3). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Deutsche Telekom Security |
| Subject | CN=T-TeleSec GlobalRoot Class 3,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE |
| SHA-256 | FD73DAD31C644FF1B43BEF0CCDDA96710B9CD9875ECA7E31707AF3E96D522BBD |
| SPKI SHA-256 | 8D767764B3CBDA08929D072A22A561F4DCDD1BC57D3CBDDC948C47D2B47F9122 |
| Valid from | 2008-10-01 |
| Expires | 2033-10-01 |
| Key | RSA 2048 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 1 |
| SHA-1 (Windows thumbprint) | 55A6723ECBF2ECCDC3237470199D2ABE11E381D1 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2026-05-28 | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 1.3.6.1.4.1.7879.13.24.1; First included in: NSS 3.14 / Firefox 18; Inclusion bug: #669849 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth; Allowed policies: Server Authentication, Client Authentication, Code Signing, Timestamp Signing |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, OCSP Signing, Secure Email; Not-before cutoff: 2025-09-15 (OCSP Signing, Secure Email); Disallowed EKUs: OCSP Signing |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2026-05-28 (sct_not_after). Mozilla treats it as an EV root for policy OID 1.3.6.1.4.1.7879.13.24.1.

## Intermediate CAs issued by this root

The CCADB lists 9 intermediate CA certificates signed directly by T-TeleSec GlobalRoot Class 3: 4 currently valid, 2 expired and 3 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Telekom Security TLS RSA Root 2023 | Deutsche Telekom Security GmbH | 2033-09-30 | Valid | 6306C491F9D1CECEDEF46420E028601922C0106DD0B48A61A7454F9ED38CD649 |
| Telekom Security TLS ECC Root 2020 | Deutsche Telekom Security GmbH | 2033-09-30 | Valid | 4DCE5A017BB3D81ACF823E815AABCB83752AD3E2883B359DF42935DFBD497075 |
| Telekom Security EV RSA CA 23A | Deutsche Telekom Security GmbH | 2033-06-19 | Valid | 82FBE865DA22D1F25ADF94BBD809D3F516125849E792DB7BB18452304C2ECC43 |
| Telekom Security ServerID EV Class 3 CA | Deutsche Telekom Security GmbH | 2027-08-02 | Valid | 5092CE0E3F70F2FD9561C34623B546F7D333EF1B633C147D1290E28DE986A230 |
| TeleSec ServerPass Extended Validation Class 3 CA | Deutsche Telekom Security GmbH | 2024-02-11 | Expired | 8A0ADDAE4F2CF9D2C24D7A49EED5C86C8B1DF1C85BA73DE5C477CB14FA0D13E9 |
| T-TeleSec Extended Validation SSL CA Class 3 | Deutsche Telekom Security GmbH | 2018-10-01 | Expired | 36630D4A3C5A19FA82C303E97A5BD6E33FC7595DCE6AAA0C10B349418E1D7821 |
| Telekom Security EV RSA CA 22 | Deutsche Telekom Security GmbH | 2032-06-21 | Revoked | 86DB1D597419BC0FDDF2A6129DE46AF537752683A49CB9435C855F53637CFE13 |
| TeleSec GlobalRoot Class 3 G2 | Deutsche Telekom Security GmbH | 2029-02-12 | Revoked | 89C82431C45C730113CF570FAF37FA4E62F9A57C8232A98CEDC7E6FF89326C43 |
| TeleSec GlobalRoot Class 3 G2 | Deutsche Telekom Security GmbH | 2026-02-23 | Revoked | C6A0F8195346E7F8A7CC0E1525BBF8C55A220CBF742DD11C5CAF49F871C53310 |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as T-TeleSec GlobalRoot Class 3 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not T-TeleSec GlobalRoot Class 3, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Deutsche Telekom Root CA 2 | Deutsche Telekom Security GmbH | 2018-10-01 | Expired | 558891E5602788A105293035CF5DA0E0A74550A9F68124B4C2B7D3CDF4E7D5D6 |

## What happens when it expires

T-TeleSec GlobalRoot Class 3 is valid until 2033-10-01, about 6.9 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2026-05-28.

## FAQ

**Is T-TeleSec GlobalRoot Class 3 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. Distrust-after dates already set: Chrome 2026-05-28.

**When does T-TeleSec GlobalRoot Class 3 expire?**

On 2033-10-01, about 6.9 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has T-TeleSec GlobalRoot Class 3 issued?**

The CCADB lists 9: 4 valid, 2 expired and 3 revoked. The newest valid one is Telekom Security TLS RSA Root 2023, valid until 2033-09-30.

**Is T-TeleSec GlobalRoot Class 3 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by Deutsche Telekom Root CA 2; 0 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).