# Buypass: Norwegian CA that stopped issuing TLS certificates

> Buypass, the Norwegian CA behind the free Buypass Go SSL ACME service, stopped issuing TLS certificates in October 2025; the last ones expired in October 2026.

Source: https://ssl.sh/cas/buypass/
Last updated: 2026-11-10

Buypass was a Norwegian certificate authority best known outside Norway for Buypass Go SSL, its free ACME service. It stopped issuing TLS certificates in October 2025, and by November 2026 every Buypass TLS certificate has expired, so anyone still configured to use it must move to another CA.

## Owner and headquarters

Buypass AS is a Norwegian company; its root certificates name "Buypass AS-983163327", the company's Norwegian organization number, and country NO. The company offers other services as well; only its TLS certificate business is covered here.

## Root certificates

As of November 2026, CCADB lists two Buypass roots in the TLS report: Buypass Class 2 Root CA and Buypass Class 3 Root CA, both RSA 4096 and valid until 2040-10-26. Mozilla has removed both, while Chrome, Apple and Microsoft still list them as included. With no new certificates being issued, the remaining inclusions no longer matter for websites.

## Certificate products

Buypass no longer sells any TLS certificates. Its announcement says that from 2025-10-15 it no longer offers TLS/SSL certificates and that its ACME-based offering is discontinued as well. The products field above is therefore empty.

## ACME support

Buypass used to run a public ACME service (Buypass Go SSL). It was discontinued together with the rest of the TLS business, so ACME clients pointing at Buypass can no longer renew.

## Free certificates

Buypass Go SSL used to issue free DV certificates via ACME. It has ended; free alternatives include [Let's Encrypt](https://ssl.sh/cas/lets-encrypt/), [ZeroSSL](https://ssl.sh/cas/zerossl/) and [Actalis](https://ssl.sh/cas/actalis/).

## Notable incidents and changes

On 2025-08-18 Buypass announced its exit from TLS certificates. In its words, the move from commercial to free certificates for most volumes put pressure on revenue and profitability, alongside the cost of meeting CA/Browser Forum requirements. The schedule was: last order, renewal or replacement on 2025-10-15, last issuance on 2025-10-31, and last expiry on 2026-10-31, after which revocation and status services end. Buypass is an example of how shorter lifetimes and free ACME CAs are consolidating the market.


## Root certificates (CCADB)

Buypass has 2 root certificate(s) in the CCADB TLS report. Together they have signed 16 intermediate CA certificates, 2 of them still valid.

| Root certificate | Key | Expires | Chrome | Mozilla | Apple | Microsoft | Intermediates | SHA-256 |
|---|---|---|---|---|---|---|---|---|
| Buypass Class 2 Root CA | RSA 4096 | 2040-10-26 | Included | Removed | Included | Included | 9 | 9A114025197C5BB95D94E63D55CD43790847B646B23CDF11ADA4A00EFF15FB48 |
| Buypass Class 3 Root CA | RSA 4096 | 2040-10-26 | Included | Removed | Included | Included | 7 | EDF7EBBCA27A2A384D387B7D4010C666E2EDB4843E4C29B4AE1D5B9332E6B24D |

## CAA records

The CCADB lists 2 CAA issuer domain(s) recognized by the currently valid intermediate certificates of Buypass. One issue record with any of them lets Buypass issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.

```
example.com. CAA 0 issue "buypass.com"
example.com. CAA 0 issue "buypass.no"
```

## Audits

Audit data the CCADB records for the TLS roots of Buypass. Auditor(s): Attestic B.V.. The most recent audit period ended on 2025-10-31.

- Standard audit: ETSI EN 319 411 2024-11-01 – 2025-10-31 (https://attestic.eu/wp-content/uploads/2026/02/Attestic-AAL-CT016-2500902-STD.pdf)
- Network security: ETSI EN 319 411 2024-11-01 – 2025-10-31 (https://attestic.eu/wp-content/uploads/2026/02/Attestic-AAL-CT016-2500902-STD.pdf)
- TLS Baseline Requirements: ETSI EN 319 411 2024-11-01 – 2025-10-31 (https://attestic.eu/wp-content/uploads/2026/02/Attestic-AAL-CT016-2500902-TLS-BR.pdf)
- TLS EV Guidelines: ETSI EN 319 411 2024-11-01 – 2025-10-31 (https://attestic.eu/wp-content/uploads/2026/02/Attestic-AAL-CT016-2500902-TLS-EV.pdf)

## CP/CPS documents

Certificate Policy and Certification Practice Statement links that Buypass has disclosed in the CCADB for its TLS roots, with effective dates:

- CP/CPS: https://repository.buypassca.com/cpsTLS-v2-2.pdf

## Report a certificate problem

To report a mis-issued certificate, a compromised private key or other abuse, use the channels Buypass lists in the CCADB (replace [at] and [dot] in addresses):

- ca-security[at]buypass[dot]no
- https://www.buypass.com/ssl-support/ssl-problem-reporting

## Incident reports

CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “Buypass”: https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&product=CA+Program&component=CA+Certificate+Compliance&short_desc_type=allwords&short_desc=Buypass&order=changeddate+DESC

## FAQ

**My ACME client still points to Buypass. What should I do?**

Switch the client to another CA, for example Let's Encrypt, ZeroSSL, Google Trust Services or Actalis, and issue a new certificate. Buypass no longer issues TLS certificates, so renewals against its ACME server fail.

**What CAA record allows Buypass to issue certificates?**

Publish example.com. CAA 0 issue "buypass.com". The CCADB lists 2 recognized domain(s) for Buypass: buypass.com, buypass.no.

**Who audits Buypass?**

Attestic B.V., according to the CCADB. The latest TLS Baseline Requirements audit (ETSI EN 319 411) covers 2024-11-01 to 2025-10-31; the statement is dated 2026-01-29.

**How do I report a problem certificate to Buypass?**

Use the channel(s) listed in the CCADB: ca-security[at]buypass[dot]no, https://www.buypass.com/ssl-support/ssl-problem-reporting.

Sources: CCADB All Certificate Information (V5), List of CAA Identifiers, List of CA problem reporting mechanisms and TLS Server Authentication report (ccadb.org/resources).