# TeliaSonera Root CA v1 root certificate (Telia Company)

> TeliaSonera Root CA v1 is a root CA certificate operated by Telia Company (RSA 4096, valid until 2032-10-18, SHA-256 DD6936FE). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/telia-teliasonera-root-ca-v1/
Last updated: 2026-11-10

TeliaSonera Root CA v1 is a root CA certificate operated by Telia Company (RSA 4096, valid until 2032-10-18, SHA-256 DD6936FE). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Telia Company |
| Subject | CN=TeliaSonera Root CA v1,O=TeliaSonera |
| SHA-256 | DD6936FE21F8F077C123A1A521C12224F72255B73E03A7260693E8A24B0FA389 |
| SPKI SHA-256 | 10BA3485CA8BB6880AB9531A4063E4001555561C7F2E055165F49B2D74FC5F6B |
| Valid from | 2007-10-18 |
| Expires | 2032-10-18 |
| Key | RSA 4096 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 95BE16A0F72E46F17B398272FA8BCD96 |
| SHA-1 (Windows thumbprint) | 4313BB96F1D5869BC14E6A92F6CFF63469878237 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Removed | No | - | - |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email, Time Stamping; Not-before cutoff: 2019-08-01 (Code Signing) |

The CCADB lists no EV policy OID for TeliaSonera Root CA v1.

## Intermediate CAs issued by this root

The CCADB lists 32 intermediate CA certificates signed directly by TeliaSonera Root CA v1: 4 currently valid, 5 expired and 23 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Telia Class 3 CA v3 | Telia Company | 2032-10-17 | Valid | D20E08A8F9E16DF94A4CD7E052B382C339880B47931B78CC7DF404C063E49852 |
| TeliaSonera Class 1 CA v2 | Telia Company | 2032-10-16 | Valid | F6E0D3006465585AA276E40861945102B2660708399879062FD53A2040EB5B31 |
| Telia Root CA v2 | Telia Company | 2032-10-18 | Valid | EF6F29F636F62BDD4753122F41F3419EE7C2877587BE4A9807ADF58946458E7F |
| TeliaSonera Mobile ID CA v2 | Telia Company | 2032-10-17 | Valid | C1245A9A039CC511BCFB3A50BE1D89A989933431F25C0F9665BA977F94F876C1 |
| Ericsson NL Individual CA v3 | Telia Company | 2025-10-27 | Expired | 63ED95B17FFDCB7AE30FEAC6A874653099264E21B268D836D957966F0B04BE43 |
| TeliaSonera Class 1 CA v1 | Telia Company | 2019-10-17 | Expired | 8072F44E162FD430D83C4FFF1C0B7F248258E4ABB2AEA8C4719AA5F3FD23C626 |
| TeliaSonera Server CA v1 | Telia Company | 2019-10-17 | Expired | 209BBEEB6464E945D82A36D9F4469300EDA22B8418E449EDCD3CC1E0B3D43938 |
| TeliaSonera Email CA v3 | Telia Company | 2019-10-17 | Expired | 152D7A4957123BFCE4AD13F7DECCAEB6B8CD80765A08C59F08263C91DF88B65E |
| TeliaSonera Class 2 CA v1 | Telia Company | 2019-10-17 | Expired | 04096545767B1285A0F03A2C9684B0E9FBC7F43A9E2FDFE723687DA7445A3823 |
| Telia Class 3 CA v2 | Telia Company | 2032-10-17 | Revoked | 5E343F2432BBF0ECC7062F4237110581DFFD638CC3689D50D5864174C9DC011D |
| TeliaSonera Email CA v4 | Telia Company | 2032-10-16 | Revoked | 77D82B83905D4465A3EB6B62E42081A7C273632F7D6CDA33A1E366987420AD12 |
| TeliaSonera Class 2 CA v2 | Telia Company | 2032-10-16 | Revoked | 10D081A9541BF0B388818447A2A75465809AA5FB9A3DF375602472E873432AC1 |
| Telia Document Signing CA v2 | Telia Company | 2032-10-18 | Revoked | DF189638D127977DBBE49219F1486B47C2606EA2A2CBC460F57EBE7177809681 |
| Telia Domain Validation CA v2 | Telia Company | 2032-10-18 | Revoked | 5B312B7E11B70D07C14E0AB99F08D00748966098C52AA85A06A0822BBE59A02C |
| TeliaSonera Mobile ID CA v1 | Telia Company | 2032-10-16 | Revoked | 31046C3D7C5E9401707F6817C55AF5B1FC4A4DDC70846B7BED422F96C7CAD6A5 |
| Telia Domain Validation SSL CA v1 | Telia Company | 2032-10-16 | Revoked | D75F8BC0DB4B29382145499A61148659CF29A967E2AE470B498A1799788A8284 |
| Telia Document Signing CA v1 | Telia Company | 2032-10-18 | Revoked | 41931F94B1662FCA06A992E9E02793EF51E97016C7741D4647E8A9FA7746346C |
| Telia Domain Validation SSL CA v1 | Telia Company | 2032-10-16 | Revoked | 5F20CD1B0F7A827DD61B29F390970AAD96F0428219DE9B504A170B56AB68CF8D |
| TeliaSonera Mobile ID CA v2 | Telia Company | 2032-10-17 | Revoked | D9121A35775309EC74B7C888EA126509E9452C35D8B9EE1F252782FF2287A499 |
| TeliaSonera Extended Validation SSL CA v1 | Telia Company | 2032-10-17 | Revoked | 9032A3A421B6735FFB85E604D56179924C7760EDC08E4A1A7750D4D32FBC799B |

## Cross-signed versions

2 certificate(s) in the CCADB have the same subject and public key as TeliaSonera Root CA v1 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not TeliaSonera Root CA v1, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Sonera Class2 CA | Telia Company | 2019-10-17 | Expired | 881DF16CD54E4D89735B7D19811D673D17C0063984EA11E72D6701BF3F41720B |
| Sonera Class2 CA | Telia Company | 2021-04-05 | Expired | E9563581E712B290F23A749346535EB0D981E3D4A39D56D604684CD0B1698C89 |

## What happens when it expires

TeliaSonera Root CA v1 is valid until 2032-10-18, about 5.9 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is TeliaSonera Root CA v1 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does TeliaSonera Root CA v1 expire?**

On 2032-10-18, about 5.9 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has TeliaSonera Root CA v1 issued?**

The CCADB lists 32: 4 valid, 5 expired and 23 revoked. The newest valid one is Telia Class 3 CA v3, valid until 2032-10-17.

**Is TeliaSonera Root CA v1 cross-signed?**

Yes. The CCADB has 2 cross-certificate(s) with its subject and key, signed by Sonera Class2 CA; 0 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).