# Actalis: Italian CA with free unlimited ACME certificates

> Actalis, the Milan CA of Italy's Aruba Group: Authentication Root CA, new 2025 roots, and a free plan with unlimited 90-day DV certificates via ACME.

Source: https://ssl.sh/cas/actalis/
Last updated: 2026-11-10

Actalis is an Italian certificate authority, part of the Aruba Group, that sells TLS, S/MIME and signing certificates and also offers a free plan with unlimited 90-day DV certificates over [ACME](https://ssl.sh/glossary/acme/). That makes it one of the few European options among the free ACME CAs.

## Owner and headquarters

Actalis S.p.A. is based in Milan, Italy; its root certificate names "Actalis S.p.A." with locality Milan. Its website says it is part of the Aruba Group, the Italian provider of domains, hosting and certified email (PEC). Actalis also provides qualified trust services for the Italian public administration.

## Root certificates

As of November 2026, CCADB lists three Actalis roots. Actalis Authentication Root CA (RSA 4096, 2011–2030) is trusted for TLS by Chrome, Mozilla, Apple and Microsoft. The two roots created in 2025, Actalis TLS Server RSA Root CA 2025 (RSA 4096) and Actalis TLS Server ECC Root CA 2025 (ECDSA P-384), are valid until 2050 and so far included only by Microsoft. The current root expires in 2030, so the new roots need to be included in the other stores before then.

## Certificate products

DV, OV and EV TLS certificates (wildcards are included in some paid plans), S/MIME email certificates and code signing certificates, sold through subscription plans named Free, Bronze, Silver and Gold.

## ACME support

Actalis supports ACME for the certificates in its plans. You activate ACME automation in the customer area and then use a standard ACME client.

## Free certificates

The Free plan issues 90-day DV certificates: unlimited when ACME automation is activated, and four per year (renewed quarterly) when you request them manually. Third-party tests report that free ACME certificates are limited to a single host name, so use another CA for multi-domain or wildcard certificates if you need them for free.

## Notable incidents and changes

We found no major distrust event involving Actalis. The notable changes are the 2025 roots and the free ACME plan. Root inclusion takes time, so test the chain on the devices you support before relying on the new roots.


## Root certificates (CCADB)

Actalis has 3 root certificate(s) in the CCADB TLS report. Together they have signed 42 intermediate CA certificates, 13 of them still valid.

| Root certificate | Key | Expires | Chrome | Mozilla | Apple | Microsoft | Intermediates | SHA-256 |
|---|---|---|---|---|---|---|---|---|
| Actalis Authentication Root CA | RSA 4096 | 2030-09-22 | Included | Included | Included | Included | 41 | 55926084EC963A64B96E2ABE01CE0BA86A64FBFEBCC7AAB5AFC155B37FD76066 |
| Actalis TLS Server ECC Root CA 2025 | ECDSA P-384 | 2050-02-22 | Not included | Not included | Not included | Included | 0 | 4EFAADA2543E1E02666998574B3BAD96AE264088FA5917F75D32E7A609D1869C |
| Actalis TLS Server RSA Root CA 2025 | RSA 4096 | 2050-02-22 | Not included | Not included | Not included | Included | 1 | 6D0E47DFDE7CF48308CD4C6C1517DD1AF033DCC72BB0501C04268B03B58A9085 |

## CAA records

The CCADB lists 1 CAA issuer domain(s) recognized by the currently valid intermediate certificates of Actalis. One issue record with any of them lets Actalis issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.

```
example.com. CAA 0 issue "actalis.it"
```

## Audits

Audit data the CCADB records for the TLS roots of Actalis. Auditor(s): TayllorCox PCEB. The most recent audit period ended on 2026-03-31.

- Standard audit: ETSI EN 319 411 2025-06-07 – 2026-03-31 (https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_Standard_Audit_v2_signedTS.pdf)
- TLS Baseline Requirements: ETSI EN 319 411 2025-06-07 – 2026-03-31 (https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_TLS-BR_Audit_v2_signedTS.pdf)
- TLS EV Guidelines: ETSI EN 319 411 2025-06-07 – 2026-03-31 (https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_TLS-EV_Audit_v2_signedTS.pdf)

## CP/CPS documents

Certificate Policy and Certification Practice Statement links that Actalis has disclosed in the CCADB for its TLS roots, with effective dates:

- CP/CPS: https://www.actalis.com/cp-cps-code-signing-certificates
- CP/CPS: https://www.actalis.com/cp-cps-smime-certificates
- CP/CPS: https://www.actalis.com/cps-for-tsl-server-certificates
- Markdown CP/CPS: https://github.com/Actalis-CA/CP-CPS/raw/refs/heads/main/CPS/CodeSigning_CP_CPS_v1.0.md
- Markdown CP/CPS: https://github.com/Actalis-CA/CP-CPS/raw/refs/heads/main/CPS/SMIME_CP_CPS_v1.0.md
- Markdown CP/CPS: https://raw.githubusercontent.com/Actalis-CA/CP-CPS/refs/heads/main/CPS/TLS_CP_CPS_v6.0.md

## Report a certificate problem

To report a mis-issued certificate, a compromised private key or other abuse, use the channels Actalis lists in the CCADB (replace [at] and [dot] in addresses):

- cert-problem[at]actalis[dot]it
- https://www.actalis.it/products/ssl-certificate.aspx

## Incident reports

CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “Actalis”: https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&product=CA+Program&component=CA+Certificate+Compliance&short_desc_type=allwords&short_desc=Actalis&order=changeddate+DESC

## FAQ

**Can I use Actalis as a free alternative to Let's Encrypt?**

Yes for DV certificates: the free plan issues unlimited 90-day DV certificates via ACME once automation is activated. Check the plan details for name and wildcard limits; third-party reports say free ACME certificates cover a single host.

**What CAA record allows Actalis to issue certificates?**

Publish example.com. CAA 0 issue "actalis.it". The CCADB lists 1 recognized domain(s) for Actalis: actalis.it.

**Who audits Actalis?**

TayllorCox PCEB, according to the CCADB. The latest TLS Baseline Requirements audit (ETSI EN 319 411) covers 2025-06-07 to 2026-03-31; the statement is dated 2026-04-02.

**How do I report a problem certificate to Actalis?**

Use the channel(s) listed in the CCADB: cert-problem[at]actalis[dot]it, https://www.actalis.it/products/ssl-certificate.aspx.

Sources: CCADB All Certificate Information (V5), List of CAA Identifiers, List of CA problem reporting mechanisms and TLS Server Authentication report (ccadb.org/resources).