Certificate authority
Certum: Polish Asseco CA, roots, ACME and TrustAsia cross-sign
Details
- CCADB CA owner
- Asseco Data Systems S.A.
- Country
- PL
- Country (CCADB)
- Polska
- ACME
- Yes
- Free certificates
- No
- Products
- DV OV EV wildcard multi-domain IP S/MIME code-signing
- Roots
- 6
- Roots trusted for TLS
- Chrome 4 · Mozilla 4 · Apple 4 · Microsoft 6
- Intermediates under its roots
- 136 (115 valid)
- Auditor
- Ernst & Young, LLP
- CAA
certum.eu
Certum is a Polish certificate authority run by Asseco Data Systems, part of the Asseco software group. It sells DV, OV and EV TLS certificates, S/MIME and code signing, supports ACME for paid certificates, and its long-lived Certum Trusted Network CA root also cross-signs TrustAsia's new root.
Owner and headquarters
The CCADB records the CA owner as Asseco Data Systems S.A., a Polish company; Certum's website says it is part of the Asseco Group. Older Certum roots still carry the name of Unizeto Technologies S.A., the company that originally ran Certum.
Root certificates
As of November 2026, CCADB lists six Certum roots in the TLS report. Four are trusted for TLS by Chrome, Mozilla, Apple and Microsoft: Certum Trusted Network CA (RSA 2048, until 2029-12-31), Certum Trusted Network CA 2 (RSA 4096, until 2046), Certum Trusted Root CA (RSA 4096, until 2043) and Certum EC-384 CA (ECDSA P-384, until 2043). The 2023 roots Certum TLS RSA Root CA and Certum TLS ECC Root CA (valid until 2048) are so far only in Microsoft's store. Certum's own website chains through Certum Trusted Root CA, cross-signed by Certum Trusted Network CA.
Certificate products
DV, OV and EV TLS certificates in single-domain, multi-domain, wildcard and IP address variants, S/MIME email certificates and code signing certificates, sold directly and, according to its website, through about 300 authorized resellers.
ACME support
Certum's support site documents ACME v2 based on RFC 8555 for its commercial SSL certificates. You take the EAB key ID and HMAC from the certificate details in your Certum account; the ACME account is tied to the account that ordered the product. Validation works with dns-01 (also for wildcards) and http-01, and Certum doesn't recommend a particular client.
Free certificates
Certum doesn't offer free publicly trusted TLS certificates.
Notable incidents and changes
We found no recent distrust action against Certum. Certum also plays a role in another CA's hierarchy: TrustAsia's new TLS RSA Root CA, used for new TrustAsia certificates since early 2026, is delivered with a cross-certificate from Certum Trusted Network CA so that clients that don't yet include TrustAsia's root can still validate the chain.
CAA records
The CCADB lists 2 CAA issuer domain(s) recognized by the currently valid intermediate certificates of Certum. One issue record with any of them lets Certum issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.
Copy-ready record(s) for the first 2 domain(s):
example.com. CAA 0 issue "certum.eu"
example.com. CAA 0 issue "certum.pl"| Domain | Valid intermediates |
|---|---|
certum.eu | 154 |
certum.pl | 154 |
For issuewild, iodef or DNS-provider formats, use the CAA record generator: CAA Generator
Root certificates (CCADB)
Certum has 6 root certificate(s) in the CCADB TLS report. Together they have signed 136 intermediate CA certificates, 115 of them still valid.
Roots this CA owner has in the CCADB TLS Server Authentication report, with current status in each root store.
- trusted for TLS
- included with limits (NotBefore / no TLS bit)
- removed or blocked
- not included
| Root certificate | Key | Expires | Ch | Mo | Ap | MS | Intermediates |
|---|---|---|---|---|---|---|---|
| Certum EC-384 CA | ECDSA P-384 | 2043-03-26 | Included | Included | Included | Included | 14 (13) |
| Certum TLS ECC Root CA | ECDSA P-384 | 2048-01-26 | Not included | Not included | Not included | Included | 3 (3) |
| Certum TLS RSA Root CA | RSA 4096 | 2048-01-26 | Not included | Not included | Not included | Included | 21 (21) |
| Certum Trusted Network CA | RSA 2048 | 2029-12-31 | Included | Included | Included | Included | 46 (28) |
| Certum Trusted Network CA 2 | RSA 4096 | 2046-10-06 | Included | Included | Included | Included | 12 (11) |
| Certum Trusted Root CA | RSA 4096 | 2043-03-16 | Included | Included | Included | Included | 40 (39) |
Audits
Audit data the CCADB records for the TLS roots of Certum. Auditor(s): Ernst & Young, LLP. The most recent audit period ended on 2026-02-10.
| Audit | Scheme | Period | Statement | Report |
|---|---|---|---|---|
| Standard audit | WebTrust | 2025-02-11 – 2026-02-10 | 2026-04-27 | cpacanada.ca |
| Network security | WebTrust | 2025-02-11 – 2026-02-10 | 2026-04-03 | cpacanada.ca |
| TLS Baseline Requirements | WebTrust | 2025-02-11 – 2026-02-10 | 2026-04-03 | cpacanada.ca |
| TLS EV Guidelines | WebTrust | 2025-02-11 – 2026-02-10 | 2026-04-03 | cpacanada.ca |
CP/CPS documents
Certificate Policy and Certification Practice Statement links that Certum has disclosed in the CCADB for its TLS roots, with effective dates:
- CP/CPS: https://repository.certum.pl/cp-cps-tls/Certificate_Policy_and_Certification_Practice_Statement_for_TLS_Certificates_v1.1.0.pdf (effective 2026-10-05)
- CPS: https://www.files.certum.eu/documents/repo_pl/PL_3_Kodeks_Postep_Cert/Kodeks%20Post%c4%99powania%20Certyfikacyjnego%20Niekwalifikowanych%20Us%c5%82ug%20Certum_v8.5.pdf (effective 2026-09-14)
- CP: https://www.files.certum.eu/documents/repsitory/2-cert-policy/Certification%20Policy%20of%20CERTUM%20Certification%20Services_v5.3.pdf (effective 2026-09-14)
- Markdown CP/CPS: https://repository.certum.pl/cp-cps-tls/Certificate_Policy_and_Certification_Practice_Statement_for_TLS_Certificates_v1.1.0.md (effective 2026-10-05)
- Document repository: https://www.certum.pl/pl/cert_wiedza_repozytorium_pl_en/
Report a certificate problem
To report a mis-issued certificate, a compromised private key or other abuse, use the channels Certum lists in the CCADB (replace [at] and [dot] in addresses):
Incident reports
CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “Certum”:
ACME directories (CCADB)
DV ACME directory URLs that Certum has disclosed in the CCADB for its valid certificates:
https://acme.certum.pl/directory
FAQ
What CAA record allows Certum to issue certificates?
Publish example.com. CAA 0 issue "certum.eu". The CCADB lists 2 recognized domain(s) for Certum: certum.eu, certum.pl.
Who audits Certum?
Ernst & Young, LLP, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2025-02-11 to 2026-02-10; the statement is dated 2026-04-03.
How do I report a problem certificate to Certum?
Use the channel(s) listed in the CCADB: https://problemreport.certum.pl/.
How many root certificates does Certum have?
6 in the CCADB TLS report. Trusted for TLS: Chrome 4, Mozilla 4, Apple 4, Microsoft 6. They have signed 136 intermediates, 115 of them still valid.