Certificate authority
Apple and certificates: root program, not a public TLS CA
Details
- CCADB CA owner
- Apple Inc.
- Country
- US
- ACME
- No
- Free certificates
- No
- Roots
- 0
- Roots trusted for TLS
- Chrome 0 · Mozilla 0 · Apple 0 · Microsoft 0
- CAA
pki.apple.com
Apple is not a public TLS CA: it sells no TLS certificates, but its Apple Root Certificate Program decides which CAs Apple devices trust. Apple has also pushed the industry toward shorter certificate lifetimes, and its own websites use certificates from intermediates under DigiCert.
Owner and headquarters
Apple Inc. is a US company based in Cupertino, California; the EV certificate of www.apple.com lists Cupertino and Apple Inc. Apple also runs an internal PKI ("Apple PKI") for its own products and services, documented on its certificate authority website.
Root certificates
As of November 2026, the CCADB TLS Server Authentication report lists no roots under Apple as CA owner: Apple has no publicly trusted TLS root of its own in the Web PKI. Instead, Apple operates intermediate CAs such as "Apple Public EV Server RSA CA 4 - G1" that are signed by DigiCert Global Root G2, which is what www.apple.com uses. Apple's role in the table you'll see on other CA pages is as a root store: the "Apple" column shows whether Apple trusts each root.
Certificate products
Apple sells no certificates to the public. Apple's own CAs issue certificates for Apple services, devices and developer programs (such as code signing for apps), not TLS certificates for customer websites.
ACME support
Apple doesn't operate a public ACME service.
Free certificates
Apple issues no certificates for customer websites, free or paid.
Notable incidents and changes
Apple's influence is through policy. In 2020 it announced that its platforms would reject TLS certificates issued from 2020-09-01 with a validity period longer than 398 days, after the CA/Browser Forum ballot SC-022v2 for the same limit had failed; the Forum then adopted the rule in SC-031. In 2025 Apple's root program proposed SC-081v3, which brings the maximum down to 47 days by 2029. Apple's root program policy, published on GitHub, sets the requirements for CAs that want to be trusted on Apple devices.
CAA records
The CCADB lists 8 CAA issuer domain(s) recognized by the currently valid intermediate certificates of Apple. One issue record with any of them lets Apple issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.
Copy-ready record(s) for the first 3 domain(s):
example.com. CAA 0 issue "pki.apple.com"
example.com. CAA 0 issue "affirmtrust.com"
example.com. CAA 0 issue "comodo.com"| Domain | Valid intermediates |
|---|---|
pki.apple.com | 13 |
affirmtrust.com | 4 |
comodo.com | 4 |
comodoca.com | 4 |
entrust.net | 4 |
sectigo.com | 4 |
trust-provider.com | 4 |
usertrust.com | 4 |
For issuewild, iodef or DNS-provider formats, use the CAA record generator: CAA Generator
Root certificates (CCADB)
The CCADB TLS Server Authentication report lists no root certificates under this organization; its certificates chain to roots operated by another CA.
Valid intermediate CAs operated by Apple under roots that other CAs own (CCADB; number of valid intermediates in brackets):
Audits
The CCADB has no audit record for Apple because it has no root of its own in the TLS report; its certificates are covered by the audits of the CA that operates the roots.
CP/CPS documents
The CCADB has no CP/CPS link for the TLS roots of Apple.
Report a certificate problem
To report a mis-issued certificate, a compromised private key or other abuse, use the channels Apple lists in the CCADB (replace [at] and [dot] in addresses):
certification_authority[at]apple[dot]comcontact_pki[at]apple[dot]com
Incident reports
CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “Apple”:
FAQ
What CAA record allows Apple to issue certificates?
Publish example.com. CAA 0 issue "pki.apple.com". The CCADB lists 8 recognized domain(s) for Apple: pki.apple.com, affirmtrust.com, comodo.com, comodoca.com, entrust.net, sectigo.com, trust-provider.com, usertrust.com.
How do I report a problem certificate to Apple?
Use the channel(s) listed in the CCADB: certification_authority[at]apple[dot]com, contact_pki[at]apple[dot]com.
How many root certificates does Apple have?
None of its own: the CCADB TLS report lists no root under Apple. Its 19 valid intermediate CAs chain to roots owned by DigiCert (11), Sectigo (8).
Where are the incident reports for Apple?
In Mozilla's Bugzilla, product CA Program, component CA Certificate Compliance. Search for bug titles containing “Apple”; CAs title their reports with their own name.