# Hongkong Post Root CA 3 root certificate (Hongkong Post / Certizen)

> Hongkong Post Root CA 3 is a root CA certificate operated by Hongkong Post / Certizen (RSA 4096, valid until 2042-06-03, SHA-256 5A2FC03F). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/hongkong-post-root-ca-3/
Last updated: 2026-11-10

Hongkong Post Root CA 3 is a root CA certificate operated by Hongkong Post / Certizen (RSA 4096, valid until 2042-06-03, SHA-256 5A2FC03F). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Hongkong Post / Certizen |
| Subject | CN=Hongkong Post Root CA 3,O=Hongkong Post,L=Hong Kong,ST=Hong Kong,C=HK |
| SHA-256 | 5A2FC03F0C83B090BBFA40604B0988446C7636183DF9846E17101A447FB8EFD6 |
| SPKI SHA-256 | 2541E53BA5B3B07ACBE7097AC4A03E040C11CF7A6D4A67CB213D558B50167A06 |
| Valid from | 2017-06-03 |
| Expires | 2042-06-03 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 8165F8A4CA5EC00C99340DFC4C6AE23B81C5AA4 |
| SHA-1 (Windows thumbprint) | 58A2D0EC2052815BC1F3F86402244EC28E024B02 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: NSS 3.43 / Firefox 67; Inclusion bug: #1464306 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, OCSP Signing; Not-before cutoff: 2019-10-01 (OCSP Signing); Disallowed EKUs: OCSP Signing |

Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 4 intermediate CA certificates signed directly by Hongkong Post Root CA 3: 2 currently valid, 0 expired and 2 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Hongkong Post e-Cert SSL CA 3 - 17 | Government of Hong Kong (SAR), Hongkong Post, Certizen | 2032-06-03 | Valid | CB730C3A5FE958B8BDC5B363892C9F530B33F98A43CE3C2578FCE096B4AE233C |
| Hongkong Post e-Cert EV SSL CA 3 - 17 | Government of Hong Kong (SAR), Hongkong Post, Certizen | 2032-06-03 | Valid | 7ADADC0DBA5B9A97BEB1580947B0738537C9239934E88C67512B5D22D9D47FF7 |
| Hongkong Post e-Cert EV SSL CA 3 - 17 | Government of Hong Kong (SAR), Hongkong Post, Certizen | 2032-06-03 | Revoked | C18D53BF9864DD09BCBCACFD672E2566D4C81F6889E36DF5DD425C04211D0763 |
| Hongkong Post e-Cert SSL CA 3 - 17 | Government of Hong Kong (SAR), Hongkong Post, Certizen | 2032-06-03 | Revoked | 69ECDBC3147F581DFDCB522D9DEFB260B26784AD4955C74E6A52522CCC4C4408 |

## Cross-signed versions

5 certificate(s) in the CCADB have the same subject and public key as Hongkong Post Root CA 3 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Hongkong Post Root CA 3, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| GlobalSign | GlobalSign nv-sa | 2029-03-18 | Valid | 00482341B104A0DE6E0F1D508DB84CB514F7494FE04982133A5C750136C55DC8 |
| Hongkong Post Root CA 1 | Government of Hong Kong (SAR), Hongkong Post, Certizen | 2029-05-15 | Valid | 5544A24FEB21F681F1987D30E0AF5C49E9F9FFFD5550A889B40B1EC9CC81E667 |
| Hongkong Post Root CA 1 | Government of Hong Kong (SAR), Hongkong Post, Certizen | 2023-05-15 | Revoked | ABFA404ECEEA854381ABE294AC829440E0133E077911A67E1293CF111AC43C44 |
| Hongkong Post Root CA 1 | Government of Hong Kong (SAR), Hongkong Post, Certizen | 2023-05-15 | Expired | 176AEBF2972BD6F47179EDE3DE63848B1543B45AE2954BEA45185B152537B9C4 |
| Hongkong Post Root CA 1 | Government of Hong Kong (SAR), Hongkong Post, Certizen | 2023-05-15 | Revoked | F8F6037491861C069D3BB442B78A3DB4049EE7787B7C2841A7BA6966B5272F2C |

## What happens when it expires

Hongkong Post Root CA 3 is valid until 2042-06-03, about 15.6 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Hongkong Post Root CA 3 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does Hongkong Post Root CA 3 expire?**

On 2042-06-03, about 15.6 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Hongkong Post Root CA 3 issued?**

The CCADB lists 4: 2 valid, 0 expired and 2 revoked. The newest valid one is Hongkong Post e-Cert SSL CA 3 - 17, valid until 2032-06-03.

**Is Hongkong Post Root CA 3 cross-signed?**

Yes. The CCADB has 5 cross-certificate(s) with its subject and key, signed by GlobalSign, Hongkong Post Root CA 1; 2 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).