# Buypass Class 2 Root CA root certificate (Buypass)

> Buypass Class 2 Root CA is a root CA certificate operated by Buypass (RSA 4096, valid until 2040-10-26, SHA-256 9A114025). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Apple, Microsoft.

Source: https://ssl.sh/roots/buypass-class-2-root-ca/
Last updated: 2026-11-10

Buypass Class 2 Root CA is a root CA certificate operated by Buypass (RSA 4096, valid until 2040-10-26, SHA-256 9A114025). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Buypass |
| Subject | CN=Buypass Class 2 Root CA,O=Buypass AS-983163327,C=NO |
| SHA-256 | 9A114025197C5BB95D94E63D55CD43790847B646B23CDF11ADA4A00EFF15FB48 |
| SPKI SHA-256 | 5955AE291574A931342CF7450E16652EDE1E0FB3097E1571DFAC11C915601564 |
| Valid from | 2010-10-26 |
| Expires | 2040-10-26 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 2 |
| SHA-1 (Windows thumbprint) | 490A7574DE870A47FE58EEF6C76BEBC60B124099 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2025-10-31 | - |
| Mozilla | Removed | No | - | - |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Encrypting File System, IP Security Tunnel Termination, IP Security User, OCSP Signing, Secure Email, Time Stamping; Not-before cutoff: 2025-09-15 (Encrypting File System, IP Security Tunnel Termination, IP Security User, OCSP Signing, Secure Email) |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2025-10-31 (sct_not_after). The CCADB lists no EV policy OID for Buypass Class 2 Root CA.

## Intermediate CAs issued by this root

The CCADB lists 9 intermediate CA certificates signed directly by Buypass Class 2 Root CA: 1 currently valid, 1 expired and 7 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Buypass Class 2 CA 2 | Buypass | 2030-10-26 | Valid | 54A89ECB989A1DCCF4013639F38974A0BC0742C2993DFB6BD0CBF1F462964501 |
| Buypass Class 2 CA 4 | Buypass | 2026-01-18 | Expired | A400BA552ED3A6C24FB4D5F385965C6606132B050477BF62D09D2CC65604DF9E |
| Buypass Class 2 CA 5 | Buypass | 2027-05-23 | Revoked | 3062918D9DD617925271BC7F8080B8A6A5D2185BBD880F7862FD4C043B194191 |
| Buypass Class 2 CA 2 | Buypass | 2030-10-26 | Revoked | 8ACD454C36E2F873C90AE6C00DF75928DAA414A43BE745E866E8172344178824 |
| Buypass Class 2 CA 4 | Buypass | 2026-01-18 | Revoked | D39C637B26D254BF0E607AA98FF93F2E6FC67F5A7D4FDE02CE2DEACDC9F3E810 |
| Buypass Class 2 CA 2 | Buypass | 2031-10-21 | Revoked | 7AC99C1E48E7E935ADA22488ADAC80BFE6E6503CFC54077B9547FF20F3E5CCD5 |
| Buypass Class 2 CA 2 | Buypass | 2030-10-26 | Revoked | FF7462796EB657215B6EEFA9D821F4BEB808E52041CC84DC81B28CA8265BB74F |
| Buypass Class 2 CA 2 | Buypass | 2030-10-26 | Revoked | F66FB7A934E56ECACC65CCB73E6C2BE75EC58B8DFE35564B3D6741032AF8AAF6 |
| Buypass Class 2 CA 2 | Buypass | 2030-10-26 | Revoked | F543633A628E37EFFC6DA952593657BCC5B24B1D590C35B61469027754460DD7 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as Buypass Class 2 Root CA with a different issuer, so a client has to carry Buypass Class 2 Root CA itself in its root store to trust it.


## What happens when it expires

Buypass Class 2 Root CA is valid until 2040-10-26, about 14.0 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2025-10-31.

## FAQ

**Is Buypass Class 2 Root CA trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Chrome, Apple, Microsoft trust it for TLS server authentication; Mozilla do not. Distrust-after dates already set: Chrome 2025-10-31.

**When does Buypass Class 2 Root CA expire?**

On 2040-10-26, about 14.0 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Buypass Class 2 Root CA issued?**

The CCADB lists 9: 1 valid, 1 expired and 7 revoked. The newest valid one is Buypass Class 2 CA 2, valid until 2030-10-26.

**Is Buypass Class 2 Root CA cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).