# Certum: Polish Asseco CA, roots, ACME and TrustAsia cross-sign > Certum, the CA of Poland's Asseco Data Systems: Trusted Network and Trusted Root CA roots, 2023 roots, paid ACME, and its cross-sign of TrustAsia. Source: https://ssl.sh/cas/certum/ Last updated: 2026-11-10 Certum is a Polish certificate authority run by Asseco Data Systems, part of the Asseco software group. It sells DV, OV and EV TLS certificates, S/MIME and code signing, supports ACME for paid certificates, and its long-lived Certum Trusted Network CA root also cross-signs [TrustAsia](https://ssl.sh/cas/trustasia/)'s new root. ## Owner and headquarters The CCADB records the CA owner as Asseco Data Systems S.A., a Polish company; Certum's website says it is part of the Asseco Group. Older Certum roots still carry the name of Unizeto Technologies S.A., the company that originally ran Certum. ## Root certificates As of November 2026, CCADB lists six Certum roots in the TLS report. Four are trusted for TLS by Chrome, Mozilla, Apple and Microsoft: Certum Trusted Network CA (RSA 2048, until 2029-12-31), Certum Trusted Network CA 2 (RSA 4096, until 2046), Certum Trusted Root CA (RSA 4096, until 2043) and Certum EC-384 CA (ECDSA P-384, until 2043). The 2023 roots Certum TLS RSA Root CA and Certum TLS ECC Root CA (valid until 2048) are so far only in Microsoft's store. Certum's own website chains through Certum Trusted Root CA, cross-signed by Certum Trusted Network CA. ## Certificate products DV, OV and EV TLS certificates in single-domain, multi-domain, wildcard and IP address variants, S/MIME email certificates and code signing certificates, sold directly and, according to its website, through about 300 authorized resellers. ## ACME support Certum's support site documents ACME v2 based on RFC 8555 for its commercial SSL certificates. You take the EAB key ID and HMAC from the certificate details in your Certum account; the ACME account is tied to the account that ordered the product. Validation works with dns-01 (also for wildcards) and http-01, and Certum doesn't recommend a particular client. ## Free certificates Certum doesn't offer free publicly trusted TLS certificates. ## Notable incidents and changes We found no recent distrust action against Certum. Certum also plays a role in another CA's hierarchy: TrustAsia's new TLS RSA Root CA, used for new TrustAsia certificates since early 2026, is delivered with a cross-certificate from Certum Trusted Network CA so that clients that don't yet include TrustAsia's root can still validate the chain. ## Root certificates (CCADB) Certum has 6 root certificate(s) in the CCADB TLS report. Together they have signed 136 intermediate CA certificates, 115 of them still valid. | Root certificate | Key | Expires | Chrome | Mozilla | Apple | Microsoft | Intermediates | SHA-256 | |---|---|---|---|---|---|---|---|---| | Certum EC-384 CA | ECDSA P-384 | 2043-03-26 | Included | Included | Included | Included | 14 | 6B328085625318AA50D173C98D8BDA09D57E27413D114CF787A0F5D06C030CF6 | | Certum TLS ECC Root CA | ECDSA P-384 | 2048-01-26 | Not included | Not included | Not included | Included | 3 | 630CCB83B0180A992495E039D2613C3287A8102F8A8D703DB1330A3E86D4E653 | | Certum TLS RSA Root CA | RSA 4096 | 2048-01-26 | Not included | Not included | Not included | Included | 21 | ED12A6E9289239D66CA1D244CE90C623AC305AD05602DA352BCFC5FEF2C4458D | | Certum Trusted Network CA | RSA 2048 | 2029-12-31 | Included | Included | Included | Included | 46 | 5C58468D55F58E497E743982D2B50010B6D165374ACF83A7D4A32DB768C4408E | | Certum Trusted Network CA 2 | RSA 4096 | 2046-10-06 | Included | Included | Included | Included | 12 | B676F2EDDAE8775CD36CB0F63CD1D4603961F49E6265BA013A2F0307B6D0B804 | | Certum Trusted Root CA | RSA 4096 | 2043-03-16 | Included | Included | Included | Included | 40 | FE7696573855773E37A95E7AD4D9CC96C30157C15D31765BA9B15704E1AE78FD | ## CAA records The CCADB lists 2 CAA issuer domain(s) recognized by the currently valid intermediate certificates of Certum. One issue record with any of them lets Certum issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them. ``` example.com. CAA 0 issue "certum.eu" example.com. CAA 0 issue "certum.pl" ``` ## Audits Audit data the CCADB records for the TLS roots of Certum. Auditor(s): Ernst & Young, LLP. The most recent audit period ended on 2026-02-10. - Standard audit: WebTrust 2025-02-11 – 2026-02-10 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=84a61b66-db2a-4a62-a227-ea3624e52f3e) - Network security: WebTrust 2025-02-11 – 2026-02-10 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=55c7a16e-283a-4bf2-8e88-3f716fff5cea) - TLS Baseline Requirements: WebTrust 2025-02-11 – 2026-02-10 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a23fcf5d-bdb5-45d3-abbb-2b230214f989) - TLS EV Guidelines: WebTrust 2025-02-11 – 2026-02-10 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7799eaad-dd3c-489b-9dd1-21c5c1c6046c) ## CP/CPS documents Certificate Policy and Certification Practice Statement links that Certum has disclosed in the CCADB for its TLS roots, with effective dates: - CP/CPS: https://repository.certum.pl/cp-cps-tls/Certificate_Policy_and_Certification_Practice_Statement_for_TLS_Certificates_v1.1.0.pdf - CPS: https://www.files.certum.eu/documents/repo_pl/PL_3_Kodeks_Postep_Cert/Kodeks%20Post%c4%99powania%20Certyfikacyjnego%20Niekwalifikowanych%20Us%c5%82ug%20Certum_v8.5.pdf - CP: https://www.files.certum.eu/documents/repsitory/2-cert-policy/Certification%20Policy%20of%20CERTUM%20Certification%20Services_v5.3.pdf - Markdown CP/CPS: https://repository.certum.pl/cp-cps-tls/Certificate_Policy_and_Certification_Practice_Statement_for_TLS_Certificates_v1.1.0.md ## Report a certificate problem To report a mis-issued certificate, a compromised private key or other abuse, use the channels Certum lists in the CCADB (replace [at] and [dot] in addresses): - https://problemreport.certum.pl/ ## Incident reports CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “Certum”: https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&product=CA+Program&component=CA+Certificate+Compliance&short_desc_type=allwords&short_desc=Certum&order=changeddate+DESC ## FAQ **What CAA record allows Certum to issue certificates?** Publish example.com. CAA 0 issue "certum.eu". The CCADB lists 2 recognized domain(s) for Certum: certum.eu, certum.pl. **Who audits Certum?** Ernst & Young, LLP, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2025-02-11 to 2026-02-10; the statement is dated 2026-04-03. **How do I report a problem certificate to Certum?** Use the channel(s) listed in the CCADB: https://problemreport.certum.pl/. **How many root certificates does Certum have?** 6 in the CCADB TLS report. Trusted for TLS: Chrome 4, Mozilla 4, Apple 4, Microsoft 6. They have signed 136 intermediates, 115 of them still valid. Sources: CCADB All Certificate Information (V5), List of CAA Identifiers, List of CA problem reporting mechanisms and TLS Server Authentication report (ccadb.org/resources).