Data
Certificate authorities (CAs)
Who issues the certificates your browser trusts: profiles of 18 major CAs with their roots, ACME support, free options and notable incidents, plus data pages for every other CA owner in the CCADB.
A certificate authority (CA) is trusted by browsers only if a root store such as Chrome's or Mozilla's includes one of its root certificates. The profiles below cover who owns each major CA, its roots, ACME support, free options and past incidents. The table further down lists every other organization that owns a TLS root in the CCADB.
See also the full root certificate list and the CA/Browser Forum ballots that set the rules CAs must follow.
CA profiles
-
Actalis
Actalis, the Milan CA of Italy's Aruba Group: Authentication Root CA, new 2025 roots, and a free plan with unlimited 90-day DV certificates via ACME.
-
Amazon Trust Services
Amazon Trust Services, the CA behind AWS Certificate Manager: Amazon Root CA 1–4, free certs for AWS services, exportable certs and ACME since 2026.
-
Apple
Apple runs the root program that decides trust on iOS and macOS but sells no TLS certificates; its own sites use intermediates under DigiCert.
-
Buypass
Buypass, the Norwegian CA behind the free Buypass Go SSL ACME service, stopped issuing TLS certificates in October 2025; the last ones expired in October 2026.
-
Certum
Certum, the CA of Poland's Asseco Data Systems: Trusted Network and Trusted Root CA roots, 2023 roots, paid ACME, and its cross-sign of TrustAsia.
-
DigiCert
DigiCert, the US CA behind GeoTrust, Thawte and RapidSSL: Global Root G2/G3 and G5 roots, paid ACME, and the 2024 revocation of 83,267 certificates.
-
eMudhra
eMudhra's emSign CA: roots, the October 2026 compromise of eight subordinate CA keys, Chrome removing ECC Root CA - G3 and a cutoff for Root CA - G1.
-
Entrust
Why Chrome and Mozilla stopped trusting new Entrust TLS certificates in November 2024, what happened to its roots, and how its public business moved to Sectigo.
-
GlobalSign
GlobalSign, the CA founded in Belgium in 1996 and owned by Japan's GMO group: its R3, R5, R6, R46 and E46 roots, paid ACME and Chrome's removal of Root CA R1.
-
GoDaddy
GoDaddy's certificate authority: Go Daddy and Starfield G2 roots, the new 2025 TLS roots, ACME for paid certificates, and what Chrome has removed.
-
Google Trust Services
Google Trust Services is Google's public CA: GTS Root R1–R4, free DV certificates via its ACME API with Google Cloud EAB keys, and Chrome root store status.
-
HARICA
HARICA, the CA of Greek universities: TLS RSA/ECC Root CA 2021, 2015 roots dropped by Chrome, ACME, and GÉANT's TCS provider since 2025.
-
Let's Encrypt
Let's Encrypt, the free ACME CA run by nonprofit ISRG: ISRG Root X1/X2, DV-only certificates and the 2025–2026 changes to OCSP, emails and client auth.
-
Microsoft
Microsoft runs both a root store (the Microsoft Trusted Root Program) and its own public PKI for Microsoft and Azure services; it doesn't sell TLS certificates.
-
Sectigo
Sectigo, formerly Comodo CA: USERTrust and R46/E46 roots, the roots it took over from Entrust in 2025, paid ACME, ZeroSSL's issuing CA and past incidents.
-
SSL.com
SSL.com, a Houston CA founded in 2002: 2016 and 2022 roots, ex-Trustwave roots, ACME with free 90-day DV, and the 2025 aliyun.com misissuance.
-
TrustAsia
TrustAsia, the Shanghai CA: 2024 roots in Chrome and Mozilla, the 2026 switch from a DigiCert chain to its own root, and Tencent Cloud's free certificates.
-
ZeroSSL
ZeroSSL, an Austrian DV certificate brand on Sectigo roots: unlimited free 90-day certificates via ACME, and the default CA of acme.sh.
All other CA owners in the CCADB
Organizations that own at least one root trusted for TLS by a major root store. Store columns count the roots each store trusts for TLS.
Ch = Chrome, Mo = Mozilla, Ap = Apple, MS = Microsoft.
Download the data
- /data/pki/cas.json — roots grouped by CA owner
- /data/pki/roots.json — all roots with fingerprints, keys, dates and per-store status
FAQ
Where does the root certificate data come from?
From the public reports of the Common CA Database (CCADB), which Apple, Google Chrome, Microsoft and Mozilla use to run their root programs. ssl.sh refreshes it with uv run sslsh pki fetch and shows the date of the last update on each page.
Which CAs offer free TLS certificates through ACME?
As of November 2026, Let's Encrypt, ZeroSSL, Google Trust Services, SSL.com and Actalis are among the CAs with free ACME-issued certificates; open each profile for the conditions.