中文

Root certificate · Buypass

Buypass Class 3 Root CA

Buypass Class 3 Root CA is a root CA certificate operated by Buypass (RSA 4096, valid until 2040-10-26, SHA-256 EDF7EBBC). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Apple, Microsoft.

Data updated

Root store status

Root storeStatusTrusted for TLSDistrust for TLS afterConstrained
ChromeIncluded IncludedYes2025-10-31Yes
MozillaRemoved RemovedNo—No
AppleIncluded IncludedYes—No
MicrosoftIncluded IncludedYes—Yes

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2025-10-31 (sct_not_after). The CCADB lists EV policy OID 2.23.140.1.1, 2.16.578.1.26.1.3.3 for this root, but Mozilla does not mark it as EV-enabled.

Included Chrome

Status
Included
Distrust for TLS after
2025-10-31

Removed Mozilla

Status
Removed

Included Apple

Status
Included
Trust bits
serverAuth, clientAuth

Included Microsoft

Status
Included
Trusted EKUs
Server Authentication, Client Authentication, OCSP Signing, Secure Email, Time Stamping
Not-before cutoff
2025-09-15 (OCSP Signing, Secure Email)

"Trusted for TLS" means the store includes the root with the server-authentication trust bit (Mozilla "Websites", Apple serverAuth, Microsoft Server Authentication EKU). Microsoft "NotBefore" means only certificates issued before a cutoff date are still trusted. "Constrained" means the store applies extra restrictions.

Details

CA owner
Buypass
Subject
CN=Buypass Class 3 Root CA,O=Buypass AS-983163327,C=NO
SHA-256
EDF7EBBCA27A2A384D387B7D4010C666E2EDB4843E4C29B4AE1D5B9332E6B24D
SHA-1 (Windows thumbprint)
DAFAF7FA6684EC068F1450BDC7C281A5BCA96457
SPKI SHA-256
B03D87B056D08CC9D4E675EF19CA83AB53532168A8258598BE72E6D85C7DD7C1
Valid from
2010-10-26
Expires
2040-10-26
Key
RSA 4096
Signature algorithm
sha256WithRSAEncryption
Serial number
2
Country
NO
Trust bits (CCADB)
Server Authentication, Client Authentication, Time Stamping
EV policy OIDs (CCADB)
2.23.140.1.1, 2.16.578.1.26.1.3.3 · TLS EV capable: Yes
Test websites
valid: https://valid.evident.ca23.ssl.buypass.no · expired: https://expired.evident.ca23.ssl.buypass.no · revoked: https://revoked.evident.ca23.ssl.buypass.no
CCADB record
A000092
PEM
buypass-class-3-root-ca.pem

Look up this certificate on crt.sh

Intermediate CAs issued by this root

The CCADB lists 7 intermediate CA certificates signed directly by Buypass Class 3 Root CA: 1 currently valid, 0 expired and 6 revoked (revoked includes those whose parent was revoked).

Showing 7 of 7: valid certificates first, newest first. Each name links to its crt.sh entry by SHA-256; an arrow marks a cross-certificate for another root on this site.

IntermediateOperated byExpiresStatus
Buypass Class 3 CA 2 Buypass2030-10-26Valid
Buypass Class 3 CA 2 Buypass2030-10-26Revoked
Buypass Class 3 CA 3 Buypass2032-09-25Revoked
Buypass Class 3 CA 2 Buypass2031-10-21Revoked
Buypass Class 3 CA 2 Buypass2030-10-26Revoked
Buypass Class 3 CA 2 Buypass2030-10-26Revoked
Buypass Class 3 CA 2 Buypass2030-10-26Revoked

Cross-signed versions

No certificate in the CCADB has the same subject and public key as Buypass Class 3 Root CA with a different issuer, so a client has to carry Buypass Class 3 Root CA itself in its root store to trust it.

CRL and OCSP addresses

In the root certificate

Buypass Class 3 Root CA itself contains no CRL Distribution Points and no OCSP (Authority Information Access) extension. That is normal for a root: clients trust it directly and do not check its own revocation status.

Full CRL this CA publishes (CCADB)

  • http://crl.buypass.no/crl/BPClass3RootCA.crl

Used by the intermediates it issued

Addresses found in the CRL Distribution Points and OCSP fields of the 1 valid intermediates signed by Buypass Class 3 Root CA; the number in brackets is how many of them use each address.

  • CRL: http://crl.buypass.no/crl/BPClass3RootCA.crl (1)
  • OCSP: http://ocsp.buypass.com (1)

What happens when it expires

Buypass Class 3 Root CA is valid until 2040-10-26, about 14.0 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2025-10-31.

Check whether your device trusts it

Each platform keeps its own root store. The commands below look up Buypass Class 3 Root CA by common name (Buypass Class 3 Root CA) or fingerprint. The store status in each heading comes from the CCADB snapshot; your device can differ if it is out of date or managed by an administrator.

macOS (Apple store: Included · Trusted for TLS)

Search the system roots keychain by common name. -Z prints the SHA-256 hash, which must match the fingerprint on the last line.

security find-certificate -a -c "Buypass Class 3 Root CA" -Z \
  /System/Library/Keychains/SystemRootCertificates.keychain | grep "SHA-256"
# SHA-256 hash: EDF7EBBCA27A2A384D387B7D4010C666E2EDB4843E4C29B4AE1D5B9332E6B24D

Windows (Microsoft store: Included · Trusted for TLS)

Windows identifies roots by SHA-1 thumbprint. It installs third-party roots on demand through Automatic Root Certificates Update, so "not found" can also mean the root has not been needed yet; certutil -generateSSTFromWU roots.sst downloads Microsoft's full list.

certutil -verifystore Root DAFAF7FA6684EC068F1450BDC7C281A5BCA96457

Linux (ca-certificates follows Mozilla: Removed)

Debian, Ubuntu, Fedora and RHEL build their ca-certificates package from Mozilla's root store. Use trust list on p11-kit systems, or search the PEM bundle on Debian and Ubuntu.

# Fedora / RHEL / Arch (p11-kit)
trust list --filter=ca-anchors | grep -iF -A2 "Buypass Class 3 Root CA"
# Debian / Ubuntu (ca-certificates)
openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt \
  | openssl pkcs7 -print_certs -noout | grep -iF "Buypass Class 3 Root CA"

Java

Java ships its own cacerts keystore; JDK 9 and later accept -cacerts and the default store password is changeit. Search for the SHA-256 fingerprint in colon form.

keytool -list -cacerts -storepass changeit | grep -i "ED:F7:EB:BC:A2:7A:2A:38:4D:38:7B:7D:40:10:C6:66:E2:ED:B4:84:3E:4C:29:B4:AE:1D:5B:93:32:E6:B2:4D"

Android

Android's system store is maintained by Google separately from the four CCADB stores above. Open Settings → Security & privacy → More security settings → Encryption & credentials → Trusted credentials → System (menu names vary by vendor and version) and look for Buypass AS-983163327 → Buypass Class 3 Root CA.

Which root does my site chain to?

List the chain your server sends and compare the last issuer with this root; the fingerprint check confirms a local copy.

Download PEM

# show subject (s:) and issuer (i:) of every certificate the server sends
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null \
  | grep -E '^ *[0-9]+ s:|^ *i:'
# subject and SHA-256 fingerprint of the downloaded PEM file
openssl x509 -in buypass-class-3-root-ca.pem -noout -subject -fingerprint -sha256
# sha256 Fingerprint=ED:F7:EB:BC:A2:7A:2A:38:4D:38:7B:7D:40:10:C6:66:E2:ED:B4:84:3E:4C:29:B4:AE:1D:5B:93:32:E6:B2:4D

FAQ

Is Buypass Class 3 Root CA trusted by Chrome, Firefox, Safari and Windows?

As of 2026-11-10, Chrome, Apple, Microsoft trust it for TLS server authentication; Mozilla do not. Distrust-after dates already set: Chrome 2025-10-31.

When does Buypass Class 3 Root CA expire?

On 2040-10-26, about 14.0 years after the 2026-11-10 data snapshot.

How many intermediate certificates has Buypass Class 3 Root CA issued?

The CCADB lists 7: 1 valid, 0 expired and 6 revoked. The newest valid one is Buypass Class 3 CA 2, valid until 2030-10-26.

Is Buypass Class 3 Root CA cross-signed?

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Other roots from Buypass

Sources

  1. CCADB — Resources (TLS Server Authentication report, All Included Root Certificate Trust Bit Settings)
  2. CCADB — All Certificate Information (root and intermediate), CSV V5
  3. CCADB — Mozilla Included CA Certificate Report
  4. CCADB — Chrome / Mozilla / Apple / Microsoft TLS Server Authentication CSV