# Certificate authorities: profiles, roots and root store status

> Profiles of 18 major certificate authorities plus every CA owner with TLS roots in the CCADB: roots, ACME support, free certificates and incidents.

Source: https://ssl.sh/cas/
Last updated: 2026-11-10

A certificate authority (CA) is trusted by browsers only if a root store such as [Chrome's](https://g.co/chrome/root-policy) or [Mozilla's](https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/) includes one of its root certificates. The profiles below cover who owns each major CA, its roots, [ACME](https://ssl.sh/glossary/acme/) support, free options and past incidents. The table further down lists every other organization that owns a TLS root in the CCADB.

See also the full [root certificate list](/roots/) and the [CA/Browser Forum ballots](/ballots/) that set the rules CAs must follow.


## CA profiles

- [Actalis](/cas/actalis/): Actalis, the Milan CA of Italy's Aruba Group: Authentication Root CA, new 2025 roots, and a free plan with unlimited 90-day DV certificates via ACME.
- [Amazon Trust Services](/cas/amazon/): Amazon Trust Services, the CA behind AWS Certificate Manager: Amazon Root CA 1–4, free certs for AWS services, exportable certs and ACME since 2026.
- [Apple](/cas/apple/): Apple runs the root program that decides trust on iOS and macOS but sells no TLS certificates; its own sites use intermediates under DigiCert.
- [Buypass](/cas/buypass/): Buypass, the Norwegian CA behind the free Buypass Go SSL ACME service, stopped issuing TLS certificates in October 2025; the last ones expired in October 2026.
- [Certum](/cas/certum/): Certum, the CA of Poland's Asseco Data Systems: Trusted Network and Trusted Root CA roots, 2023 roots, paid ACME, and its cross-sign of TrustAsia.
- [DigiCert](/cas/digicert/): DigiCert, the US CA behind GeoTrust, Thawte and RapidSSL: Global Root G2/G3 and G5 roots, paid ACME, and the 2024 revocation of 83,267 certificates.
- [eMudhra](/cas/emudhra/): eMudhra's emSign CA: roots, the October 2026 compromise of eight subordinate CA keys, Chrome removing ECC Root CA - G3 and a cutoff for Root CA - G1.
- [Entrust](/cas/entrust/): Why Chrome and Mozilla stopped trusting new Entrust TLS certificates in November 2024, what happened to its roots, and how its public business moved to Sectigo.
- [GlobalSign](/cas/globalsign/): GlobalSign, the CA founded in Belgium in 1996 and owned by Japan's GMO group: its R3, R5, R6, R46 and E46 roots, paid ACME and Chrome's removal of Root CA R1.
- [GoDaddy](/cas/godaddy/): GoDaddy's certificate authority: Go Daddy and Starfield G2 roots, the new 2025 TLS roots, ACME for paid certificates, and what Chrome has removed.
- [Google Trust Services](/cas/google-trust-services/): Google Trust Services is Google's public CA: GTS Root R1–R4, free DV certificates via its ACME API with Google Cloud EAB keys, and Chrome root store status.
- [HARICA](/cas/harica/): HARICA, the CA of Greek universities: TLS RSA/ECC Root CA 2021, 2015 roots dropped by Chrome, ACME, and GÉANT's TCS provider since 2025.
- [Let's Encrypt](/cas/lets-encrypt/): Let's Encrypt, the free ACME CA run by nonprofit ISRG: ISRG Root X1/X2, DV-only certificates and the 2025–2026 changes to OCSP, emails and client auth.
- [Microsoft](/cas/microsoft/): Microsoft runs both a root store (the Microsoft Trusted Root Program) and its own public PKI for Microsoft and Azure services; it doesn't sell TLS certificates.
- [Sectigo](/cas/sectigo/): Sectigo, formerly Comodo CA: USERTrust and R46/E46 roots, the roots it took over from Entrust in 2025, paid ACME, ZeroSSL's issuing CA and past incidents.
- [SSL.com](/cas/ssl-com/): SSL.com, a Houston CA founded in 2002: 2016 and 2022 roots, ex-Trustwave roots, ACME with free 90-day DV, and the 2025 aliyun.com misissuance.
- [TrustAsia](/cas/trustasia/): TrustAsia, the Shanghai CA: 2024 roots in Chrome and Mozilla, the 2026 switch from a DigiCert chain to its own root, and Tencent Cloud's free certificates.
- [ZeroSSL](/cas/zerossl/): ZeroSSL, an Austrian DV certificate brand on Sectigo roots: unlimited free 90-day certificates via ACME, and the default CA of acme.sh.

## All other CA owners in the CCADB

| CA owner | Country | Roots | Chrome | Mozilla | Apple | Microsoft |
|---|---|---|---|---|---|---|
| A-Trust | AT | 2 | 0 | 0 | 0 | 2 |
| ACCV (Spain) | ES | 1 | 1 | 1 | 1 | 1 |
| ANCE (Tunisia) | TN | 1 | 1 | 1 | 0 | 1 |
| ANF AC | ES | 1 | 1 | 1 | 0 | 0 |
| Atos | DE | 3 | 2 | 2 | 3 | 3 |
| BJCA | CN | 2 | 0 | 2 | 0 | 0 |
| CCA India | IN | 1 | 0 | 0 | 0 | 1 |
| Certainly LLC | US | 2 | 2 | 2 | 2 | 0 |
| Certigna | FR | 2 | 1 | 0 | 1 | 2 |
| certSIGN | RO | 2 | 1 | 1 | 2 | 2 |
| CFCA | CN | 1 | 1 | 1 | 1 | 1 |
| Chunghwa Telecom | TW | 2 | 1 | 1 | 2 | 2 |
| ComSign | IL | 1 | 0 | 0 | 0 | 1 |
| Cybertrust Japan | JP | 2 | 0 | 2 | 0 | 2 |
| D-Trust | DE | 6 | 6 | 6 | 2 | 6 |
| Department of Defence Australia | AU | 1 | 0 | 0 | 0 | 1 |
| Deutsche Telekom Security | DE | 4 | 4 | 4 | 2 | 4 |
| Disig, a.s. | SK | 2 | 1 | 1 | 1 | 2 |
| Docaposte Certinomis | FR | 1 | 0 | 0 | 0 | 1 |
| e-commerce monitoring (GLOBALTRUST) | AT | 3 | 0 | 0 | 0 | 3 |
| EDICOM | ES | 1 | 0 | 0 | 0 | 1 |
| Fina | HR | 1 | 0 | 0 | 0 | 1 |
| Finland DVV (VRK) | FI | 3 | 0 | 0 | 0 | 3 |
| Firmaprofesional | ES | 2 | 1 | 1 | 1 | 2 |
| FNMT (Spain) | ES | 3 | 2 | 2 | 1 | 3 |
| Global Digital Cybersecurity Authority (GDCA) | CN | 1 | 1 | 1 | 1 | 1 |
| HALCOM d.d. | SI | 1 | 0 | 0 | 0 | 1 |
| Hongkong Post / Certizen | HK | 1 | 1 | 1 | 1 | 1 |
| IdenTrust | US | 4 | 1 | 2 | 2 | 4 |
| ITI (Brazil) | BR | 1 | 0 | 0 | 0 | 1 |
| iTrusChina Co., Ltd. | CN | 2 | 2 | 2 | 0 | 0 |
| Izenpe S.A. | ES | 1 | 1 | 1 | 1 | 1 |
| Kamu SM (Turkey) | TR | 1 | 1 | 1 | 1 | 1 |
| KIR | PL | 1 | 1 | 1 | 0 | 1 |
| KLID (Korea) | KR | 1 | 0 | 0 | 0 | 1 |
| Microsec Ltd. | HU | 3 | 3 | 3 | 1 | 3 |
| NAVER Cloud Trust Services | KR | 3 | 1 | 1 | 1 | 3 |
| NETLOCK | HU | 2 | 0 | 1 | 0 | 2 |
| Netrust Pte Ltd | SG | 1 | 0 | 0 | 0 | 1 |
| OATI | US | 2 | 0 | 0 | 0 | 2 |
| OISTE | CH | 4 | 4 | 4 | 2 | 2 |
| PostSignum | CZ | 1 | 0 | 0 | 0 | 1 |
| První certifikační autorita (I.CA) | CZ | 1 | 0 | 0 | 0 | 1 |
| SECOM Trust Systems | JP | 4 | 2 | 4 | 3 | 4 |
| SHECA | CN | 2 | 2 | 2 | 0 | 2 |
| SI-TRUST | SI | 1 | 0 | 0 | 0 | 1 |
| SwissSign AG | CH | 3 | 1 | 1 | 2 | 3 |
| Telia Company | SE | 4 | 1 | 3 | 2 | 4 |
| Thailand NRCA (ETDA) | TH | 1 | 0 | 0 | 0 | 1 |
| TWCA | TW | 3 | 2 | 3 | 2 | 3 |
| Visa | US | 2 | 0 | 0 | 0 | 2 |

Source: CCADB TLS Server Authentication report and All Included Root Certificate Trust Bit Settings (ccadb.org/resources).