Certificate authority

Sectigo: the former Comodo CA, its roots and the Entrust deal

Last verified Nov 10, 2026

CCADB CA owner: Sectigo
Country: US
Country (CCADB): United Kingdom
ACME: Yes
Free certificates: No
Products: DV OV EV wildcard multi-domain S/MIME code-signing private-PKI
Roots: 14
Roots trusted for TLS: Chrome 6 · Mozilla 6 · Apple 13 · Microsoft 13
Intermediates under its roots: 1116 (842 valid)
Auditor: BDO International Limited
CAA: sectigo.com

Key points

Sectigo is the commercial certificate authority formerly known as Comodo CA; its press releases are datelined Scottsdale, Arizona, and its newer roots are issued by Sectigo Limited in the UK.
As of November 2026, CCADB shows Sectigo Public Server Authentication Root R46 and E46 (valid until 2046) and USERTrust RSA and ECC Certification Authority (until 2038) trusted for TLS by Chrome, Mozilla, Apple and Microsoft.
Sectigo announced on 2025-01-29 that it had bought Entrust's public certificate business and said on 2025-09-25 that the customer migration was complete; CCADB now lists six Entrust roots under Sectigo.
The ZeroSSL brand issues its free and paid certificates through intermediates that chain to Sectigo roots.
In March 2011 a compromised Comodo registration authority led to fraudulent certificates for public websites, which Comodo revoked and Mozilla blocked in Firefox.

Sectigo is the certificate authority previously known as Comodo CA, and a major source of commercial DV, OV and EV certificates. Its roots also anchor ZeroSSL, and since 2025 it owns the public certificate business and several roots of Entrust.

Owner and headquarters

Comodo's certificate business was renamed Sectigo in 2018. Sectigo's press releases are datelined Scottsdale, Arizona, while its current roots name Sectigo Limited in the United Kingdom as the issuer, which is why root-based tools show country GB. The CCADB lists the CA owner as "Sectigo".

Root certificates

As of November 2026, CCADB lists 14 roots under Sectigo. Trusted for TLS by Chrome, Mozilla, Apple and Microsoft are Sectigo Public Server Authentication Root R46 (RSA 4096) and E46 (ECDSA P-384), valid until 2046, USERTrust RSA and ECC Certification Authority, and COMODO RSA and ECC Certification Authority, valid until 2038. AAA Certificate Services, an older Comodo root from 2004, has been removed from Chrome's store. CCADB also lists the six Entrust roots that came with the 2025 acquisition, all removed from Chrome after its 2024 Entrust distrust; Entrust Root Certification Authority expires on 2026-11-27.

Certificate products

DV, OV and EV TLS certificates, wildcard and multi-domain variants, S/MIME, code signing and private PKI, sold directly, through Sectigo Certificate Manager for enterprises, and through many resellers.

ACME support

Sectigo supports ACME for paid certificates, with External Account Binding credentials issued through its platform. ZeroSSL's free ACME service also runs on Sectigo's hierarchy.

Free certificates

Sectigo doesn't sell free certificates under its own brand; the free option on its roots is ZeroSSL.

Notable incidents and changes

In March 2011 an attacker compromised a Comodo registration authority and obtained several fraudulent certificates for public websites; Comodo revoked them and Mozilla shipped Firefox updates to block them. On 2020-05-30 the old AddTrust External CA Root expired, and some older clients and TLS libraries that still relied on it failed to connect. In 2025 Sectigo took over Entrust's public certificate customers after browsers distrusted Entrust.

CAA records

The CCADB lists 7 CAA issuer domain(s) recognized by the currently valid intermediate certificates of Sectigo. One issue record with any of them lets Sectigo issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.

Copy-ready record(s) for the first 3 domain(s):

example.com. CAA 0 issue "sectigo.com"
example.com. CAA 0 issue "affirmtrust.com"
example.com. CAA 0 issue "comodo.com"

Domain	Valid intermediates
`sectigo.com`	865
`affirmtrust.com`	865
`comodo.com`	865
`comodoca.com`	865
`entrust.net`	865
`trust-provider.com`	865
`usertrust.com`	865

For issuewild, iodef or DNS-provider formats, use the CAA record generator: CAA Generator

Root certificates (CCADB)

Sectigo has 14 root certificate(s) in the CCADB TLS report. Together they have signed 1116 intermediate CA certificates, 842 of them still valid.

Roots this CA owner has in the CCADB TLS Server Authentication report, with current status in each root store.

trusted for TLS
included with limits (NotBefore / no TLS bit)
removed or blocked
not included

Root certificate	Key	Expires	Ch	Mo	Ap	MS	Intermediates
AAA Certificate Services	RSA 2048	2028-12-31	Removed	Included	Included	Included	95 (53)
COMODO Certification Authority	RSA 2048	2029-12-31	Not included	Included	Included	Removed	27 (4)
COMODO Certification Authority	RSA 2048	2030-12-31	Removed	Not included	Not included	Included	0 (0)
COMODO ECC Certification Authority	ECDSA P-384	2038-01-18	Included	Included	Included	Included	21 (17)
COMODO RSA Certification Authority	RSA 4096	2038-01-18	Included	Included	Included	Included	42 (23)
Entrust Root Certification Authority	RSA 2048	2026-11-27	Removed	Removed	Included	Included	18 (2)
Entrust Root Certification Authority - EC1	ECDSA P-384	2037-12-18	Removed	Included	Included	Included	4 (2)
Entrust Root Certification Authority - G2	RSA 2048	2030-12-07	Removed	Included	Included	Included	29 (12)
Entrust Root Certification Authority - G4	RSA 4096	2037-12-27	Removed	Included	Included	Included	3 (0)
Entrust.net Certification Authority (2048)	RSA 2048	2029-07-24	Removed	Included	Included	Included	35 (9)
Sectigo Public Server Authentication Root E46	ECDSA P-384	2046-03-21	Included	Included	Included	Included	103 (102)
Sectigo Public Server Authentication Root R46	RSA 4096	2046-03-21	Included	Included	Included	Included	136 (135)
USERTrust ECC Certification Authority	ECDSA P-384	2038-01-18	Included	Included	Included	Included	214 (195)
USERTrust RSA Certification Authority	RSA 4096	2038-01-18	Included	Included	Included	Included	389 (288)

Audits

Audit data the CCADB records for the TLS roots of Sectigo. Auditor(s): BDO International Limited. The most recent audit period ended on 2026-03-31.

Audit	Scheme	Period	Statement	Report
Standard audit	WebTrust	2025-04-01 – 2026-03-31	2026-06-22	cpacanada.ca
Network security	WebTrust	2025-04-01 – 2026-03-31	2026-06-22	cpacanada.ca
TLS Baseline Requirements	WebTrust	2025-04-01 – 2026-03-31	2026-06-22	cpacanada.ca
TLS EV Guidelines	WebTrust	2025-04-01 – 2026-03-31	2026-06-22	cpacanada.ca

CP/CPS documents

Certificate Policy and Certification Practice Statement links that Sectigo has disclosed in the CCADB for its TLS roots, with effective dates:

Markdown CP/CPS: https://raw.githubusercontent.com/sectigo/policy-documentation/refs/heads/main/Sectigo%20Code%20Signing%20CP%20CPS.md (effective 2026-09-30)
Markdown CP/CPS: https://raw.githubusercontent.com/sectigo/policy-documentation/refs/heads/main/Sectigo%20Document%20Signing%20CP%20CPS.md (effective 2026-09-30)
Markdown CP/CPS: https://raw.githubusercontent.com/sectigo/policy-documentation/refs/heads/main/Sectigo%20SMIME%20CP%20CPS.md (effective 2026-09-30)
Markdown CP/CPS: https://raw.githubusercontent.com/sectigo/policy-documentation/refs/heads/main/Sectigo%20TLS%20CP%20CPS.md (effective 2026-09-30)
Document repository: https://sectigo.com/legal

Report a certificate problem

To report a mis-issued certificate, a compromised private key or other abuse, use the channels Sectigo lists in the CCADB (replace [at] and [dot] in addresses):

https://secure.sectigo.com/products/RevocationPortal
https://acme.sectigo.com/v2/keyCompromise
https://acme.sectigo.com/v2/keyCompromise/revokeCert
signedmalwarealert[at]sectigo[dot]com
sslabuse[at]sectigo[dot]com

Incident reports

CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “Sectigo”:

Bugzilla: incident reports matching “Sectigo”

FAQ

Why do some sites still show 'AddTrust' or 'COMODO' in their certificate chain?

Those are older Sectigo roots and cross-certificates. AddTrust External CA Root expired on 2020-05-30; if a server still sends it, remove it and serve the current chain from your CA.

What CAA record allows Sectigo to issue certificates?

Publish example.com. CAA 0 issue "sectigo.com". The CCADB lists 7 recognized domain(s) for Sectigo: sectigo.com, affirmtrust.com, comodo.com, comodoca.com, entrust.net, trust-provider.com, usertrust.com.

Who audits Sectigo?

BDO International Limited, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2025-04-01 to 2026-03-31; the statement is dated 2026-06-22.

How do I report a problem certificate to Sectigo?

Use the channel(s) listed in the CCADB: https://secure.sectigo.com/products/RevocationPortal, https://acme.sectigo.com/v2/keyCompromise, https://acme.sectigo.com/v2/keyCompromise/revokeCert.