# Buypass Class 3 Root CA root certificate (Buypass)

> Buypass Class 3 Root CA is a root CA certificate operated by Buypass (RSA 4096, valid until 2040-10-26, SHA-256 EDF7EBBC). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Apple, Microsoft.

Source: https://ssl.sh/roots/buypass-class-3-root-ca/
Last updated: 2026-11-10

Buypass Class 3 Root CA is a root CA certificate operated by Buypass (RSA 4096, valid until 2040-10-26, SHA-256 EDF7EBBC). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Buypass |
| Subject | CN=Buypass Class 3 Root CA,O=Buypass AS-983163327,C=NO |
| SHA-256 | EDF7EBBCA27A2A384D387B7D4010C666E2EDB4843E4C29B4AE1D5B9332E6B24D |
| SPKI SHA-256 | B03D87B056D08CC9D4E675EF19CA83AB53532168A8258598BE72E6D85C7DD7C1 |
| Valid from | 2010-10-26 |
| Expires | 2040-10-26 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 2 |
| SHA-1 (Windows thumbprint) | DAFAF7FA6684EC068F1450BDC7C281A5BCA96457 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | 2025-10-31 | - |
| Mozilla | Removed | No | - | - |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, OCSP Signing, Secure Email, Time Stamping; Not-before cutoff: 2025-09-15 (OCSP Signing, Secure Email) |

Chrome stops trusting TLS certificates under this root whose SCTs are dated after 2025-10-31 (sct_not_after). The CCADB lists EV policy OID 2.23.140.1.1, 2.16.578.1.26.1.3.3 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 7 intermediate CA certificates signed directly by Buypass Class 3 Root CA: 1 currently valid, 0 expired and 6 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Buypass Class 3 CA 2 | Buypass | 2030-10-26 | Valid | DAA0435407FA44C28AB939E6823813605779093873A96649AD6E03B05D28626C |
| Buypass Class 3 CA 2 | Buypass | 2030-10-26 | Revoked | EBDBB3944B2C0C58A1AE4AC058231CDA849AA7BEC97A9E27AD5D515B47A59CD2 |
| Buypass Class 3 CA 3 | Buypass | 2032-09-25 | Revoked | C49C350E5A8205E063E74C554A994335B8435C996527D4EF1A2B0C7B51584B2D |
| Buypass Class 3 CA 2 | Buypass | 2031-10-21 | Revoked | A047C5D423D9C0A6C020B624C3BDD4B5689113605E956C3EF0EBA4AE5E82363D |
| Buypass Class 3 CA 2 | Buypass | 2030-10-26 | Revoked | D2D1DA9C14F62D97465F337D26788C079EE5450A42D3DADB00AD0EB20F18EC49 |
| Buypass Class 3 CA 2 | Buypass | 2030-10-26 | Revoked | C651AAF5290C2F028246AFD39A13008F8C6B83FA658D1107A7EEAB7A7A8114AE |
| Buypass Class 3 CA 2 | Buypass | 2030-10-26 | Revoked | 0A59B558AE7FCE4CBA149ACFE0609E9D14E301A38421CEABE61347960376A400 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as Buypass Class 3 Root CA with a different issuer, so a client has to carry Buypass Class 3 Root CA itself in its root store to trust it.


## What happens when it expires

Buypass Class 3 Root CA is valid until 2040-10-26, about 14.0 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. Root programs can stop trusting it before it expires: Chrome 2025-10-31.

## FAQ

**Is Buypass Class 3 Root CA trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Chrome, Apple, Microsoft trust it for TLS server authentication; Mozilla do not. Distrust-after dates already set: Chrome 2025-10-31.

**When does Buypass Class 3 Root CA expire?**

On 2040-10-26, about 14.0 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Buypass Class 3 Root CA issued?**

The CCADB lists 7: 1 valid, 0 expired and 6 revoked. The newest valid one is Buypass Class 3 CA 2, valid until 2030-10-26.

**Is Buypass Class 3 Root CA cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).