# BJCA Global Root CA1 root certificate (BJCA)

> BJCA Global Root CA1 is a root CA certificate operated by BJCA (RSA 4096, valid until 2044-12-12, SHA-256 F3896F88). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Mozilla.

Source: https://ssl.sh/roots/bjca-global-root-ca1/
Last updated: 2026-11-10

BJCA Global Root CA1 is a root CA certificate operated by BJCA (RSA 4096, valid until 2044-12-12, SHA-256 F3896F88). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Mozilla.

| Field | Value |
|---|---|
| CA owner | BJCA |
| Subject | CN=BJCA Global Root CA1,O=BEIJING CERTIFICATE AUTHORITY,C=CN |
| SHA-256 | F3896F88FE7C0A882766A7FA6AD2749FB57A7F3E98FB769C1FA7B09C2C44D5AE |
| SPKI SHA-256 | EBC55F21E88D49EDE81C0075AB08B3C73B81F0F33E37D7641A1D01B6E602DC9D |
| Valid from | 2019-12-19 |
| Expires | 2044-12-12 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 556F65E3B4D9906A1B09D16C3EC06C20 |
| SHA-1 (Windows thumbprint) | D5EC8D7B4CBA79F4E7E8CB9D6BAE77831003216A |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Not included | No | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: NSS 3.89.1 / Firefox 114; Inclusion bug: #1647181 |
| Apple | Not included | No | - | - |
| Microsoft | Not included | No | - | - |

Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 20 intermediate CA certificates signed directly by BJCA Global Root CA1: 5 currently valid, 0 expired and 15 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| BJCA OV SSL CA1 G3 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2036-11-03 | Valid | 7B2659B104B679DC93026309DD731B2A066DF07FA87B62BD0E15AF8430E4BAC4 |
| BJCA EV SSL CA1 G3 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2036-11-03 | Valid | 75829A63A0E96570BC8563D76593409A0C8C879E196C76925F813B31ABC755D3 |
| BJCA IV SSL CA1 G3 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2036-11-03 | Valid | 3DC63B64AD5BB852167FB2EAFCDC1F12DDB721776BC2C5E62FE2C230E478277B |
| BJCA DV SSL CA1 G3 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2036-11-03 | Valid | 050CCCBF7B257D7F58D77302E59C031B2F31650CF55F03CB182383EDD91398D3 |
| BJCA TimeStamp CA1 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2034-12-15 | Valid | 245B753A631DD7A5A5B0D3E6DFECA4599C7A1C93D71CBA04ED7BC81D3986303F |
| BJCA EV SSL CA1 G2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2040-05-25 | Revoked | DC7FC62ADA41A93A98CE432459CD7E40D1C037B1DE27F2C5BCB6289A53984348 |
| BJCA IV SSL CA1 G2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2040-05-25 | Revoked | 33B5B7C21E66504FD3EE65B0FE0D12C3175BA2A616441B7133DB3C1236B55DF7 |
| BJCA OV SSL CA1 G2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2040-05-25 | Revoked | 321FB5BD2625F809CEC9773B3395B4520D1FA9311D43D494E618DEAC0C02B343 |
| BJCA DV SSL CA1 G2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2040-05-25 | Revoked | 07F80FD793BEE4C881A901105657696A237509BBE4DFDB0BA752B4F4F6D42019 |
| BJCA SMIME CA1 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2038-07-03 | Revoked | 82AD1A6C8848B68FC5153E0B72E15DE430CFB93CBB98403F49C73DB3C2DD9966 |
| BJCA Code Signing CA1 G2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2037-01-16 | Revoked | 9677A7E2ACB3F5BA75AD9BCEE3C18A4C484DAF891B817F0AC713923E4337EA56 |
| BJCA TimeStamp CA1 G2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2037-01-16 | Revoked | 64FF2BFC836D5980F58605FD80029F499B805610E10467B9DCCC0D327E0AF561 |
| BJCA EV Code Signing CA1 G2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2037-01-16 | Revoked | 418D2B75C8B44B3A20FC93F55D7006158CC8C0F1A9C1A8C5E8C902AACF36B308 |
| BJCA IV SSL CA1 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2034-12-15 | Revoked | D70C597009AF3A3A37BDFABEA0C64108C7B83CD6C2042E8FF178A3EE8FE0CAE8 |
| BJCA EV Code Signing CA1 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2034-12-15 | Revoked | B6352ACC11ECCCFE449023D88C3C038082DE78829CB7C33DD5017FE95852AECA |
| BJCA DV SSL CA1 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2034-12-15 | Revoked | B408D6C82097121694B9B6548C5B4944594C081134F36C5BE88D74FA34759D91 |
| BJCA Code Signing CA1 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2034-12-15 | Revoked | 47D98649B0ABE9F8C8596BEBD95AF3316300506E156C1968E39C95AE83BD70D5 |
| BJCA Generic CA1 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2034-12-15 | Revoked | 19D0FE660DBC0FA948CF45918E48DEFB8396C4026903BC19FE4F91552DFF4DC9 |
| BJCA EV SSL CA1 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2034-12-15 | Revoked | 115A2A45DB520361A2CDF0A395C4A4BD8A18902EAA4036792825F846BBD76917 |
| BJCA OV SSL CA1 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2034-12-15 | Revoked | 0A6BC3E2024AC462F5D72BE436AE61D033978EA8DDB63D4C5D6214915E69049B |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as BJCA Global Root CA1 with a different issuer, so a client has to carry BJCA Global Root CA1 itself in its root store to trust it.


## What happens when it expires

BJCA Global Root CA1 is valid until 2044-12-12, about 18.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is BJCA Global Root CA1 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Mozilla trust it for TLS server authentication; Chrome, Apple, Microsoft do not.

**When does BJCA Global Root CA1 expire?**

On 2044-12-12, about 18.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has BJCA Global Root CA1 issued?**

The CCADB lists 20: 5 valid, 0 expired and 15 revoked. The newest valid one is BJCA OV SSL CA1 G3, valid until 2036-11-03.

**Is BJCA Global Root CA1 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).