# SZAFIR ROOT CA2 root certificate (KIR)

> SZAFIR ROOT CA2 is a root CA certificate operated by KIR (RSA 2048, valid until 2035-10-19, SHA-256 A1339D33). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Mozilla, Microsoft.

Source: https://ssl.sh/roots/kir-szafir-root-ca2/
Last updated: 2026-11-10

SZAFIR ROOT CA2 is a root CA certificate operated by KIR (RSA 2048, valid until 2035-10-19, SHA-256 A1339D33). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Mozilla, Microsoft.

| Field | Value |
|---|---|
| CA owner | KIR |
| Subject | CN=SZAFIR ROOT CA2,O=Krajowa Izba Rozliczeniowa S.A.,C=PL |
| SHA-256 | A1339D33281A0B56E557D3D32B1CE7F9367EB094BD5FA72A7E5004C8DED7CAFE |
| SPKI SHA-256 | 6E364B6133DEEFDCBB21273C5F445A20AFBC05038D5B021C0C2153039016345B |
| Valid from | 2015-10-19 |
| Expires | 2035-10-19 |
| Key | RSA 2048 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 3E8A5D07EC55D232D5B7E3B65F01EB2DDCE4D6E4 |
| SHA-1 (Windows thumbprint) | E252FA953FEDDB2460BD6E28F39CCCCF5EB33FDE |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: not EV-enabled; First included in: NSS 3.23 / Firefox 46; Inclusion bug: #817994 |
| Apple | Not included | No | - | - |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Secure Email |

The CCADB lists no EV policy OID for SZAFIR ROOT CA2.

## Intermediate CAs issued by this root

The CCADB lists 7 intermediate CA certificates signed directly by SZAFIR ROOT CA2: 3 currently valid, 1 expired and 3 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| SZAFIR ROOT CA3 TLS | Krajowa Izba Rozliczeniowa S.A. (KIR) | 2031-07-20 | Valid | CA4E42BD74D061E84C0BD6B033BE7FBEC6576E23D5EFA960B12BA39F81D85B5E |
| SZAFIR Trusted CA6 | Krajowa Izba Rozliczeniowa S.A. (KIR) | 2034-10-21 | Valid | 8DBCEFD897D49653085E8914E71664943C2BC674405193B3AFAB3F66E92AD961 |
| SZAFIR Trusted CA5 | Krajowa Izba Rozliczeniowa S.A. (KIR) | 2034-10-08 | Valid | 1EBFA14EBD05CB7CAA79F84F4992379F1497AADD9ED0C7784B320411038292EE |
| SZAFIR Trusted CA2 | Krajowa Izba Rozliczeniowa S.A. (KIR) | 2025-10-26 | Expired | E22E6B25908E1107A607AF060E0B24E50C6D9562FF04F455BE0F8DF41A5032C0 |
| SZAFIR Trusted CA4 | Krajowa Izba Rozliczeniowa S.A. (KIR) | 2034-09-16 | Revoked | 848C421B3EACC83DA87CCA36E2DC02594DA7959B1E4B5624A89885FD5BB1B684 |
| SZAFIR Trusted CA4 | Krajowa Izba Rozliczeniowa S.A. (KIR) | 2034-09-16 | Revoked | 1FDC53B2632136B0331F21E8BBD922DF4F1A37E90D1D7003E266BA51A22DD60A |
| SZAFIR Trusted CA3 | Krajowa Izba Rozliczeniowa S.A. (KIR) | 2033-10-11 | Revoked | EC036C294F512DD28C5666C2D53EC0DCF6F397FED6F8703A7C7532DA3E02DE8C |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as SZAFIR ROOT CA2 with a different issuer, so a client has to carry SZAFIR ROOT CA2 itself in its root store to trust it.


## What happens when it expires

SZAFIR ROOT CA2 is valid until 2035-10-19, about 8.9 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is SZAFIR ROOT CA2 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Chrome, Mozilla, Microsoft trust it for TLS server authentication; Apple do not.

**When does SZAFIR ROOT CA2 expire?**

On 2035-10-19, about 8.9 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has SZAFIR ROOT CA2 issued?**

The CCADB lists 7: 3 valid, 1 expired and 3 revoked. The newest valid one is SZAFIR ROOT CA3 TLS, valid until 2031-07-20.

**Is SZAFIR ROOT CA2 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).