# Telia Root CA v2 root certificate (Telia Company)

> Telia Root CA v2 is a root CA certificate operated by Telia Company (RSA 4096, valid until 2043-11-29, SHA-256 242B6974). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/telia-root-ca-v2/
Last updated: 2026-11-10

Telia Root CA v2 is a root CA certificate operated by Telia Company (RSA 4096, valid until 2043-11-29, SHA-256 242B6974). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Telia Company |
| Subject | CN=Telia Root CA v2,O=Telia Finland Oyj,C=FI |
| SHA-256 | 242B69742FCB1E5B2ABF98898B94572187544E5B4D9911786573621F6A74B82C |
| SPKI SHA-256 | C2B3C31A4A29850AA8F3CF472A1169FF71B416579F6A4482EC7744B83DF988AC |
| Valid from | 2018-11-29 |
| Expires | 2043-11-29 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 1675F27D6FE7AE3E4ACBE095B059E |
| SHA-1 (Windows thumbprint) | B999CDD173508AC44705089C8C88FBBEA02B40CD |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: Not Applicable; First included in: NSS 3.77 / Firefox 100; Inclusion bug: #1664161 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Document Signing, Secure Email |

Mozilla treats it as an EV root for policy OID Not Applicable.

## Intermediate CAs issued by this root

The CCADB lists 25 intermediate CA certificates signed directly by Telia Root CA v2: 15 currently valid, 0 expired and 10 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Telia EC TLS Root CA v3 | Telia Company | 2043-11-28 | Valid | 70F84634C3246A43E9722CB1E0ABC5BB9BCA62FFFB70EB7EA73F4BB706C853C1 |
| Telia RSA TLS Root CA v3 | Telia Company | 2043-11-28 | Valid | 5573DFB5C894B95B85D26F9C57591257561A09CD37726D13835ECAC28A1E9C7C |
| Telia RSA Email Root CA v3 | Telia Company | 2043-11-28 | Valid | D46F8990078A9B2AE08F3C50E9CB1A07373D574003A66BB72EC3A99CBE2A3382 |
| Telia RSA Signing Root CA v3 | Telia Company | 2043-11-28 | Valid | 8CEF3433AB3C3F4A3C5D395B82B4EAA250E9BF647BC6095ECF0B57620F5DA9BF |
| Telia RSA Client Root CA v3 | Telia Company | 2043-11-28 | Valid | 81B837B929D1E854DFE8A368F264C6E7D928CA1E4A205BA258E17A0C7516E2F1 |
| Telia EC Client Root CA v3 | Telia Company | 2043-11-28 | Valid | 708E7E73BC638B90F14BAAB634B5CBFBF8FFE1BD1B24B1744612E49167CA7731 |
| Telia EC Signing Root CA v3 | Telia Company | 2043-11-28 | Valid | 622F1C188A0E818C222E9A5674980D6E77197E580FC476C6F741DC0606FF538A |
| Telia EC Email Root CA v3 | Telia Company | 2043-11-28 | Valid | 18C2FC38AFD8E668A89A6FC1E8A924C8D5C6BD1A70089FDDE56361CDA92EF445 |
| Ericsson NL Individual CA v4 | Telia Company | 2043-11-29 | Valid | EE0343093DF71E364606100164C62A4FB8C4A0F32B1EB47860FFD6C17E94CA54 |
| Telia Class 1 CA v3 | Telia Company | 2043-11-28 | Valid | E85BA26F89FEB670A2638E1E293054DE1A955DD1909A0AFD508B1F87F06104A9 |
| Telia Email CA v5 | Telia Company | 2043-11-28 | Valid | E26BA792CDF9E21B6402044DD9A61E2E1537D5FFD22EE2478979408E3233310A |
| Telia Class 2 CA v3 | Telia Company | 2043-11-28 | Valid | 96FD4A9ED8E28B901D5E93E265992A9D411D49DC2280B5CF89398A862B7E26EC |
| Telia Document Signing CA v3 | Telia Company | 2043-11-29 | Valid | 6924A4DD82948DA53F6FB933E895A0F6581C8DBDEBABB36FC11CAC25E9C0335A |
| Telia Domain Validation CA v3 | Telia Company | 2043-11-29 | Valid | A7E83056E9B3D9DDB1816B95518F6A5E5A1DFDFA28F60533B1C850855EAA4263 |
| Telia Server CA v3 | Telia Company | 2043-11-29 | Valid | 1281AD8FABE883F209E9636448D1A80C373DAA7686C813A270FAD48F5F5E589A |
| Telia EC TLS Root CA v3 | Telia Company | 2043-11-28 | Revoked | 607FD06E4C56534DC47A22565B9AE0859C61915858BF43BC42D8628212936DEA |
| Telia EC TLS Root CA v3 | Telia Company | 2043-11-28 | Revoked | 9DBD8D9A36695D6A3727F2BE8FE7B4275A62A9F8DC7927A32C476F7DECE27E28 |
| Telia RSA TLS Root CA v3 | Telia Company | 2043-11-28 | Revoked | 6DD4E12B751849BA3E1AD90AC48674C2474C772182F3500C85C2DF4DB7F48866 |
| Telia EC TLS Root CA v3 | Telia Company | 2043-11-28 | Revoked | 07E5866107E24AE69A9679668F916AA1B3B39DC3554781E3AE9ABAA44B5A7BC4 |
| Ericsson NL Individual CA v4 | Telia Company | 2043-11-29 | Revoked | 800707B1F57FCDF95CFB047B387C6F48142DA885B7DC1FED28C5F87F0C712AD4 |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as Telia Root CA v2 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Telia Root CA v2, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| TeliaSonera Root CA v1 | Telia Company | 2032-10-18 | Valid | EF6F29F636F62BDD4753122F41F3419EE7C2877587BE4A9807ADF58946458E7F |

## What happens when it expires

Telia Root CA v2 is valid until 2043-11-29, about 17.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Telia Root CA v2 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does Telia Root CA v2 expire?**

On 2043-11-29, about 17.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Telia Root CA v2 issued?**

The CCADB lists 25: 15 valid, 0 expired and 10 revoked. The newest valid one is Telia EC TLS Root CA v3, valid until 2043-11-28.

**Is Telia Root CA v2 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by TeliaSonera Root CA v1; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).