Certificate authority
Buypass: Norwegian CA that stopped issuing TLS certificates
Details
- CCADB CA owner
- Buypass
- Country
- NO
- Country (CCADB)
- Norway
- ACME
- No
- Free certificates
- No
- Roots
- 2
- Roots trusted for TLS
- Chrome 2 · Mozilla 0 · Apple 2 · Microsoft 2
- Intermediates under its roots
- 16 (2 valid)
- Auditor
- Attestic B.V.
- CAA
buypass.com
Buypass was a Norwegian certificate authority best known outside Norway for Buypass Go SSL, its free ACME service. It stopped issuing TLS certificates in October 2025, and by November 2026 every Buypass TLS certificate has expired, so anyone still configured to use it must move to another CA.
Owner and headquarters
Buypass AS is a Norwegian company; its root certificates name "Buypass AS-983163327", the company's Norwegian organization number, and country NO. The company offers other services as well; only its TLS certificate business is covered here.
Root certificates
As of November 2026, CCADB lists two Buypass roots in the TLS report: Buypass Class 2 Root CA and Buypass Class 3 Root CA, both RSA 4096 and valid until 2040-10-26. Mozilla has removed both, while Chrome, Apple and Microsoft still list them as included. With no new certificates being issued, the remaining inclusions no longer matter for websites.
Certificate products
Buypass no longer sells any TLS certificates. Its announcement says that from 2025-10-15 it no longer offers TLS/SSL certificates and that its ACME-based offering is discontinued as well. The products field above is therefore empty.
ACME support
Buypass used to run a public ACME service (Buypass Go SSL). It was discontinued together with the rest of the TLS business, so ACME clients pointing at Buypass can no longer renew.
Free certificates
Buypass Go SSL used to issue free DV certificates via ACME. It has ended; free alternatives include Let's Encrypt, ZeroSSL and Actalis.
Notable incidents and changes
On 2025-08-18 Buypass announced its exit from TLS certificates. In its words, the move from commercial to free certificates for most volumes put pressure on revenue and profitability, alongside the cost of meeting CA/Browser Forum requirements. The schedule was: last order, renewal or replacement on 2025-10-15, last issuance on 2025-10-31, and last expiry on 2026-10-31, after which revocation and status services end. Buypass is an example of how shorter lifetimes and free ACME CAs are consolidating the market.
CAA records
The CCADB lists 2 CAA issuer domain(s) recognized by the currently valid intermediate certificates of Buypass. One issue record with any of them lets Buypass issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.
Copy-ready record(s) for the first 2 domain(s):
example.com. CAA 0 issue "buypass.com"
example.com. CAA 0 issue "buypass.no"| Domain | Valid intermediates |
|---|---|
buypass.com | 2 |
buypass.no | 2 |
For issuewild, iodef or DNS-provider formats, use the CAA record generator: CAA Generator
Root certificates (CCADB)
Buypass has 2 root certificate(s) in the CCADB TLS report. Together they have signed 16 intermediate CA certificates, 2 of them still valid.
Roots this CA owner has in the CCADB TLS Server Authentication report, with current status in each root store.
- trusted for TLS
- included with limits (NotBefore / no TLS bit)
- removed or blocked
- not included
| Root certificate | Key | Expires | Ch | Mo | Ap | MS | Intermediates |
|---|---|---|---|---|---|---|---|
| Buypass Class 2 Root CA | RSA 4096 | 2040-10-26 | Included | Removed | Included | Included | 9 (1) |
| Buypass Class 3 Root CA | RSA 4096 | 2040-10-26 | Included | Removed | Included | Included | 7 (1) |
Audits
Audit data the CCADB records for the TLS roots of Buypass. Auditor(s): Attestic B.V.. The most recent audit period ended on 2025-10-31.
| Audit | Scheme | Period | Statement | Report |
|---|---|---|---|---|
| Standard audit | ETSI EN 319 411 | 2024-11-01 – 2025-10-31 | 2026-01-29 | attestic.eu |
| Network security | ETSI EN 319 411 | 2024-11-01 – 2025-10-31 | 2026-01-29 | attestic.eu |
| TLS Baseline Requirements | ETSI EN 319 411 | 2024-11-01 – 2025-10-31 | 2026-01-29 | attestic.eu |
| TLS EV Guidelines | ETSI EN 319 411 | 2024-11-01 – 2025-10-31 | 2026-01-29 | attestic.eu |
CP/CPS documents
Certificate Policy and Certification Practice Statement links that Buypass has disclosed in the CCADB for its TLS roots, with effective dates:
- CP/CPS: https://repository.buypassca.com/cpsTLS-v2-2.pdf (effective 2026-06-01)
- Document repository: https://www.buypass.com/security/ca-documentation-legal
Report a certificate problem
To report a mis-issued certificate, a compromised private key or other abuse, use the channels Buypass lists in the CCADB (replace [at] and [dot] in addresses):
ca-security[at]buypass[dot]no- https://www.buypass.com/ssl-support/ssl-problem-reporting
Incident reports
CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “Buypass”:
FAQ
My ACME client still points to Buypass. What should I do?
Switch the client to another CA, for example Let's Encrypt, ZeroSSL, Google Trust Services or Actalis, and issue a new certificate. Buypass no longer issues TLS certificates, so renewals against its ACME server fail.
What CAA record allows Buypass to issue certificates?
Publish example.com. CAA 0 issue "buypass.com". The CCADB lists 2 recognized domain(s) for Buypass: buypass.com, buypass.no.
Who audits Buypass?
Attestic B.V., according to the CCADB. The latest TLS Baseline Requirements audit (ETSI EN 319 411) covers 2024-11-01 to 2025-10-31; the statement is dated 2026-01-29.
How do I report a problem certificate to Buypass?
Use the channel(s) listed in the CCADB: ca-security[at]buypass[dot]no, https://www.buypass.com/ssl-support/ssl-problem-reporting.