# BJCA Global Root CA2 root certificate (BJCA)

> BJCA Global Root CA2 is a root CA certificate operated by BJCA (ECDSA P-384, valid until 2044-12-12, SHA-256 574DF693). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Mozilla.

Source: https://ssl.sh/roots/bjca-global-root-ca2/
Last updated: 2026-11-10

BJCA Global Root CA2 is a root CA certificate operated by BJCA (ECDSA P-384, valid until 2044-12-12, SHA-256 574DF693). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Mozilla.

| Field | Value |
|---|---|
| CA owner | BJCA |
| Subject | CN=BJCA Global Root CA2,O=BEIJING CERTIFICATE AUTHORITY,C=CN |
| SHA-256 | 574DF6931E278039667B720AFDC1600FC27EB66DD3092979FB73856487212882 |
| SPKI SHA-256 | CC94A5A0319FF77A4CCADD821C4C59674E44D52816CBD1DFE2C761370AD4D21C |
| Valid from | 2019-12-19 |
| Expires | 2044-12-12 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | 2C17087D642AC0FE85185906CFB44AEB |
| SHA-1 (Windows thumbprint) | F42786EB6EB86D88316702FBBA66A45300AA7AA6 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Not included | No | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: NSS 3.89.1 / Firefox 114; Inclusion bug: #1647181 |
| Apple | Not included | No | - | - |
| Microsoft | Not included | No | - | - |

Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 17 intermediate CA certificates signed directly by BJCA Global Root CA2: 4 currently valid, 0 expired and 13 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| BJCA EV SSL CA2 G3 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2036-11-03 | Valid | BBD93E1C3EBF149E8CC713B79B0AF4DE7AF3D233F323E48DE3C02FF62A9CA30B |
| BJCA OV SSL CA2 G3 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2036-11-03 | Valid | A26CE3138AE1A67BC55B6950D8994B859D5B298046C5E6FABF5781CD61E582CB |
| BJCA DV SSL CA2 G3 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2036-11-03 | Valid | 5B6DA3601BD3C1A509BBFC191622E498E67739268F845933B60C0D500AD33AF8 |
| BJCA IV SSL CA2 G3 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2036-11-03 | Valid | 20ACFAC2D4426F5DA7EE1DA413C3AC7EC73AFB78909FC3C6EBB3D6D0C66B43F0 |
| BJCA EV SSL CA2 G2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2040-05-24 | Revoked | D8AC54FAFBFBDB6CE68B1BC9953675339660DD98D425DD72876E2CA29D2491AB |
| BJCA IV SSL CA2 G2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2040-05-24 | Revoked | D6F102443308694774D3AAD38AEBFA382BC4346BDAF6AE7F36C69E19B8446895 |
| BJCA OV SSL CA2 G2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2040-05-24 | Revoked | 9FCC416118949C311A5A48B44278F4FDCC45A650222A656DF0F9EDE2AEC34F04 |
| BJCA DV SSL CA2 G2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2040-05-24 | Revoked | 95E29D525032825922A58B03C56E3B9741237BBE2E6CDCA456DF8CC1E56BE4A1 |
| BJCA SMIME CA2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2038-07-03 | Revoked | 3FFD98A80B3954360394D7A7FD7B510BB121C1C788FA6C3032F9029B3A7D05CB |
| BJCA Code Signing CA2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2034-12-15 | Revoked | FC6C124D84F7EDFF00F0EEF6FE54E832114A74D131E075932A6FF03D6E575AAB |
| BJCA EV Code Signing CA2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2034-12-15 | Revoked | E97960A1A1740CAD61D0ED6A5BDBE4E946D11E6EBDB093D668AB9BB004F78BB3 |
| BJCA EV SSL CA2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2034-12-15 | Revoked | E601477705341270FD120066BBDF26223E6953C4DB8FA7EA197EAF5BF8343B25 |
| BJCA Generic CA2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2034-12-15 | Revoked | B4CDCF2F4A1141CFE604F7D50627C96F882AAB95C1D3B7A4ABB24615DB157D17 |
| BJCA DV SSL CA2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2034-12-15 | Revoked | 3F5CB1531CB1223AABFB70872DC43D2DD6CC3D2823E96B458A9F8A7EC0265946 |
| BJCA OV SSL CA2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2034-12-15 | Revoked | 3A1A4BD6A62468578DBC91DC24705B276A837CC18B6BEF1FF3F6ED0FE6326302 |
| BJCA TimeStamp CA2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2034-12-15 | Revoked | 353D175D25D53E850FF336271E1A7C0DC072AF8E0092BCAB6B9BC39E0FABAE09 |
| BJCA IV SSL CA2 | BEIJING CERTIFICATE AUTHORITY Co., Ltd. | 2034-12-15 | Revoked | 2F9F41114DCADC30784E40FEF7D6EE063A9BE7A363DE5737E88FA1118671505E |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as BJCA Global Root CA2 with a different issuer, so a client has to carry BJCA Global Root CA2 itself in its root store to trust it.


## What happens when it expires

BJCA Global Root CA2 is valid until 2044-12-12, about 18.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is BJCA Global Root CA2 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Mozilla trust it for TLS server authentication; Chrome, Apple, Microsoft do not.

**When does BJCA Global Root CA2 expire?**

On 2044-12-12, about 18.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has BJCA Global Root CA2 issued?**

The CCADB lists 17: 4 valid, 0 expired and 13 revoked. The newest valid one is BJCA EV SSL CA2 G3, valid until 2036-11-03.

**Is BJCA Global Root CA2 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).