Certificate authority
Actalis: Italian CA with free unlimited ACME certificates
Details
- CCADB CA owner
- Actalis
- Country
- IT
- Country (CCADB)
- Italy
- ACME
- Yes
- Free certificates
- Yes
- Products
- DV OV EV wildcard S/MIME code-signing
- Roots
- 3
- Roots trusted for TLS
- Chrome 1 · Mozilla 1 · Apple 1 · Microsoft 3
- Intermediates under its roots
- 42 (13 valid)
- Auditor
- TayllorCox PCEB
- CAA
actalis.it
Actalis is an Italian certificate authority, part of the Aruba Group, that sells TLS, S/MIME and signing certificates and also offers a free plan with unlimited 90-day DV certificates over ACME. That makes it one of the few European options among the free ACME CAs.
Owner and headquarters
Actalis S.p.A. is based in Milan, Italy; its root certificate names "Actalis S.p.A." with locality Milan. Its website says it is part of the Aruba Group, the Italian provider of domains, hosting and certified email (PEC). Actalis also provides qualified trust services for the Italian public administration.
Root certificates
As of November 2026, CCADB lists three Actalis roots. Actalis Authentication Root CA (RSA 4096, 2011–2030) is trusted for TLS by Chrome, Mozilla, Apple and Microsoft. The two roots created in 2025, Actalis TLS Server RSA Root CA 2025 (RSA 4096) and Actalis TLS Server ECC Root CA 2025 (ECDSA P-384), are valid until 2050 and so far included only by Microsoft. The current root expires in 2030, so the new roots need to be included in the other stores before then.
Certificate products
DV, OV and EV TLS certificates (wildcards are included in some paid plans), S/MIME email certificates and code signing certificates, sold through subscription plans named Free, Bronze, Silver and Gold.
ACME support
Actalis supports ACME for the certificates in its plans. You activate ACME automation in the customer area and then use a standard ACME client.
Free certificates
The Free plan issues 90-day DV certificates: unlimited when ACME automation is activated, and four per year (renewed quarterly) when you request them manually. Third-party tests report that free ACME certificates are limited to a single host name, so use another CA for multi-domain or wildcard certificates if you need them for free.
Notable incidents and changes
We found no major distrust event involving Actalis. The notable changes are the 2025 roots and the free ACME plan. Root inclusion takes time, so test the chain on the devices you support before relying on the new roots.
CAA records
The CCADB lists 1 CAA issuer domain(s) recognized by the currently valid intermediate certificates of Actalis. One issue record with any of them lets Actalis issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.
Copy-ready record(s) for the first 1 domain(s):
example.com. CAA 0 issue "actalis.it"| Domain | Valid intermediates |
|---|---|
actalis.it | 26 |
For issuewild, iodef or DNS-provider formats, use the CAA record generator: CAA Generator
Root certificates (CCADB)
Actalis has 3 root certificate(s) in the CCADB TLS report. Together they have signed 42 intermediate CA certificates, 13 of them still valid.
Roots this CA owner has in the CCADB TLS Server Authentication report, with current status in each root store.
- trusted for TLS
- included with limits (NotBefore / no TLS bit)
- removed or blocked
- not included
| Root certificate | Key | Expires | Ch | Mo | Ap | MS | Intermediates |
|---|---|---|---|---|---|---|---|
| Actalis Authentication Root CA | RSA 4096 | 2030-09-22 | Included | Included | Included | Included | 41 (12) |
| Actalis TLS Server ECC Root CA 2025 | ECDSA P-384 | 2050-02-22 | Not included | Not included | Not included | Included | 0 (0) |
| Actalis TLS Server RSA Root CA 2025 | RSA 4096 | 2050-02-22 | Not included | Not included | Not included | Included | 1 (1) |
Audits
Audit data the CCADB records for the TLS roots of Actalis. Auditor(s): TayllorCox PCEB. The most recent audit period ended on 2026-03-31.
| Audit | Scheme | Period | Statement | Report |
|---|---|---|---|---|
| Standard audit | ETSI EN 319 411 | 2025-06-07 – 2026-03-31 | 2026-04-02 | pceb.tayllorcox.cz |
| TLS Baseline Requirements | ETSI EN 319 411 | 2025-06-07 – 2026-03-31 | 2026-04-02 | pceb.tayllorcox.cz |
| TLS EV Guidelines | ETSI EN 319 411 | 2025-06-07 – 2026-03-31 | 2026-04-02 | pceb.tayllorcox.cz |
CP/CPS documents
Certificate Policy and Certification Practice Statement links that Actalis has disclosed in the CCADB for its TLS roots, with effective dates:
- CP/CPS: https://www.actalis.com/cp-cps-code-signing-certificates (effective 2026-06-22)
- CP/CPS: https://www.actalis.com/cp-cps-smime-certificates (effective 2026-06-22)
- CP/CPS: https://www.actalis.com/cps-for-tsl-server-certificates (effective 2026-06-22)
- Markdown CP/CPS: https://github.com/Actalis-CA/CP-CPS/raw/refs/heads/main/CPS/CodeSigning_CP_CPS_v1.0.md (effective 2026-06-22)
- Markdown CP/CPS: https://github.com/Actalis-CA/CP-CPS/raw/refs/heads/main/CPS/SMIME_CP_CPS_v1.0.md (effective 2026-06-22)
- Markdown CP/CPS: https://raw.githubusercontent.com/Actalis-CA/CP-CPS/refs/heads/main/CPS/TLS_CP_CPS_v6.0.md (effective 2026-06-22)
- Document repository: https://www.actalis.com/legal-repository
Report a certificate problem
To report a mis-issued certificate, a compromised private key or other abuse, use the channels Actalis lists in the CCADB (replace [at] and [dot] in addresses):
cert-problem[at]actalis[dot]it- https://www.actalis.it/products/ssl-certificate.aspx
Incident reports
CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “Actalis”:
ACME directories (CCADB)
DV ACME directory URLs that Actalis has disclosed in the CCADB for its valid certificates:
https://acme-api.actalis.com/acme/directory
FAQ
Can I use Actalis as a free alternative to Let's Encrypt?
Yes for DV certificates: the free plan issues unlimited 90-day DV certificates via ACME once automation is activated. Check the plan details for name and wildcard limits; third-party reports say free ACME certificates cover a single host.
What CAA record allows Actalis to issue certificates?
Publish example.com. CAA 0 issue "actalis.it". The CCADB lists 1 recognized domain(s) for Actalis: actalis.it.
Who audits Actalis?
TayllorCox PCEB, according to the CCADB. The latest TLS Baseline Requirements audit (ETSI EN 319 411) covers 2025-06-07 to 2026-03-31; the statement is dated 2026-04-02.
How do I report a problem certificate to Actalis?
Use the channel(s) listed in the CCADB: cert-problem[at]actalis[dot]it, https://www.actalis.it/products/ssl-certificate.aspx.