# Sectigo: the former Comodo CA, its roots and the Entrust deal > Sectigo, formerly Comodo CA: USERTrust and R46/E46 roots, the roots it took over from Entrust in 2025, paid ACME, ZeroSSL's issuing CA and past incidents. Source: https://ssl.sh/cas/sectigo/ Last updated: 2026-11-10 Sectigo is the certificate authority previously known as Comodo CA, and a major source of commercial DV, OV and EV certificates. Its roots also anchor [ZeroSSL](https://ssl.sh/cas/zerossl/), and since 2025 it owns the public certificate business and several roots of [Entrust](https://ssl.sh/cas/entrust/). ## Owner and headquarters Comodo's certificate business was renamed Sectigo in 2018. Sectigo's press releases are datelined Scottsdale, Arizona, while its current roots name Sectigo Limited in the United Kingdom as the issuer, which is why root-based tools show country GB. The CCADB lists the CA owner as "Sectigo". ## Root certificates As of November 2026, CCADB lists 14 roots under Sectigo. Trusted for TLS by Chrome, Mozilla, Apple and Microsoft are Sectigo Public Server Authentication Root R46 (RSA 4096) and E46 (ECDSA P-384), valid until 2046, USERTrust RSA and ECC Certification Authority, and COMODO RSA and ECC Certification Authority, valid until 2038. AAA Certificate Services, an older Comodo root from 2004, has been removed from Chrome's store. CCADB also lists the six Entrust roots that came with the 2025 acquisition, all removed from Chrome after its 2024 Entrust distrust; Entrust Root Certification Authority expires on 2026-11-27. ## Certificate products DV, OV and EV TLS certificates, wildcard and multi-domain variants, S/MIME, code signing and private PKI, sold directly, through Sectigo Certificate Manager for enterprises, and through many resellers. ## ACME support Sectigo supports ACME for paid certificates, with External Account Binding credentials issued through its platform. ZeroSSL's free ACME service also runs on Sectigo's hierarchy. ## Free certificates Sectigo doesn't sell free certificates under its own brand; the free option on its roots is [ZeroSSL](https://ssl.sh/cas/zerossl/). ## Notable incidents and changes In March 2011 an attacker compromised a Comodo registration authority and obtained several fraudulent certificates for public websites; Comodo revoked them and Mozilla shipped Firefox updates to block them. On 2020-05-30 the old AddTrust External CA Root expired, and some older clients and TLS libraries that still relied on it failed to connect. In 2025 Sectigo took over Entrust's public certificate customers after browsers distrusted Entrust. ## Root certificates (CCADB) Sectigo has 14 root certificate(s) in the CCADB TLS report. Together they have signed 1116 intermediate CA certificates, 842 of them still valid. | Root certificate | Key | Expires | Chrome | Mozilla | Apple | Microsoft | Intermediates | SHA-256 | |---|---|---|---|---|---|---|---|---| | AAA Certificate Services | RSA 2048 | 2028-12-31 | Removed | Included | Included | Included | 95 | D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF4 | | COMODO Certification Authority | RSA 2048 | 2029-12-31 | Not included | Included | Included | Removed | 27 | 0C2CD63DF7806FA399EDE809116B575BF87989F06518F9808C860503178BAF66 | | COMODO Certification Authority | RSA 2048 | 2030-12-31 | Removed | Not included | Not included | Included | 0 | 1A0D20445DE5BA1862D19EF880858CBCE50102B36E8F0A040C3C69E74522FE6E | | COMODO ECC Certification Authority | ECDSA P-384 | 2038-01-18 | Included | Included | Included | Included | 21 | 1793927A0614549789ADCE2F8F34F7F0B66D0F3AE3A3B84D21EC15DBBA4FADC7 | | COMODO RSA Certification Authority | RSA 4096 | 2038-01-18 | Included | Included | Included | Included | 42 | 52F0E1C4E58EC629291B60317F074671B85D7EA80D5B07273463534B32B40234 | | Entrust Root Certification Authority | RSA 2048 | 2026-11-27 | Removed | Removed | Included | Included | 18 | 73C176434F1BC6D5ADF45B0E76E727287C8DE57616C1E6E6141A2B2CBC7D8E4C | | Entrust Root Certification Authority - EC1 | ECDSA P-384 | 2037-12-18 | Removed | Included | Included | Included | 4 | 02ED0EB28C14DA45165C566791700D6451D7FB56F0B2AB1D3B8EB070E56EDFF5 | | Entrust Root Certification Authority - G2 | RSA 2048 | 2030-12-07 | Removed | Included | Included | Included | 29 | 43DF5774B03E7FEF5FE40D931A7BEDF1BB2E6B42738C4E6D3841103D3AA7F339 | | Entrust Root Certification Authority - G4 | RSA 4096 | 2037-12-27 | Removed | Included | Included | Included | 3 | DB3517D1F6732A2D5AB97C533EC70779EE3270A62FB4AC4238372460E6F01E88 | | Entrust.net Certification Authority (2048) | RSA 2048 | 2029-07-24 | Removed | Included | Included | Included | 35 | 6DC47172E01CBCB0BF62580D895FE2B8AC9AD4F873801E0C10B9C837D21EB177 | | Sectigo Public Server Authentication Root E46 | ECDSA P-384 | 2046-03-21 | Included | Included | Included | Included | 103 | C90F26F0FB1B4018B22227519B5CA2B53E2CA5B3BE5CF18EFE1BEF47380C5383 | | Sectigo Public Server Authentication Root R46 | RSA 4096 | 2046-03-21 | Included | Included | Included | Included | 136 | 7BB647A62AEEAC88BF257AA522D01FFEA395E0AB45C73F93F65654EC38F25A06 | | USERTrust ECC Certification Authority | ECDSA P-384 | 2038-01-18 | Included | Included | Included | Included | 214 | 4FF460D54B9C86DABFBCFC5712E0400D2BED3FBC4D4FBDAA86E06ADCD2A9AD7A | | USERTrust RSA Certification Authority | RSA 4096 | 2038-01-18 | Included | Included | Included | Included | 389 | E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2 | ## CAA records The CCADB lists 7 CAA issuer domain(s) recognized by the currently valid intermediate certificates of Sectigo. One issue record with any of them lets Sectigo issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them. ``` example.com. CAA 0 issue "sectigo.com" example.com. CAA 0 issue "affirmtrust.com" example.com. CAA 0 issue "comodo.com" ``` ## Audits Audit data the CCADB records for the TLS roots of Sectigo. Auditor(s): BDO International Limited. The most recent audit period ended on 2026-03-31. - Standard audit: WebTrust 2025-04-01 – 2026-03-31 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4a226df8-aaab-4411-9f0c-8b918bb5ded5) - Network security: WebTrust 2025-04-01 – 2026-03-31 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4c133ad7-77c4-404d-b6ec-d01c0faa7174) - TLS Baseline Requirements: WebTrust 2025-04-01 – 2026-03-31 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=19f98dd5-6b66-474d-8370-a0e3fda6e4b5) - TLS EV Guidelines: WebTrust 2025-04-01 – 2026-03-31 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d7007d1d-8575-4370-bd6b-2259f23a5934) ## CP/CPS documents Certificate Policy and Certification Practice Statement links that Sectigo has disclosed in the CCADB for its TLS roots, with effective dates: - Markdown CP/CPS: https://raw.githubusercontent.com/sectigo/policy-documentation/refs/heads/main/Sectigo%20Code%20Signing%20CP%20CPS.md - Markdown CP/CPS: https://raw.githubusercontent.com/sectigo/policy-documentation/refs/heads/main/Sectigo%20Document%20Signing%20CP%20CPS.md - Markdown CP/CPS: https://raw.githubusercontent.com/sectigo/policy-documentation/refs/heads/main/Sectigo%20SMIME%20CP%20CPS.md - Markdown CP/CPS: https://raw.githubusercontent.com/sectigo/policy-documentation/refs/heads/main/Sectigo%20TLS%20CP%20CPS.md ## Report a certificate problem To report a mis-issued certificate, a compromised private key or other abuse, use the channels Sectigo lists in the CCADB (replace [at] and [dot] in addresses): - https://secure.sectigo.com/products/RevocationPortal - https://acme.sectigo.com/v2/keyCompromise - https://acme.sectigo.com/v2/keyCompromise/revokeCert - signedmalwarealert[at]sectigo[dot]com - sslabuse[at]sectigo[dot]com ## Incident reports CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “Sectigo”: https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&product=CA+Program&component=CA+Certificate+Compliance&short_desc_type=allwords&short_desc=Sectigo&order=changeddate+DESC ## FAQ **Why do some sites still show 'AddTrust' or 'COMODO' in their certificate chain?** Those are older Sectigo roots and cross-certificates. AddTrust External CA Root expired on 2020-05-30; if a server still sends it, remove it and serve the current chain from your CA. **What CAA record allows Sectigo to issue certificates?** Publish example.com. CAA 0 issue "sectigo.com". The CCADB lists 7 recognized domain(s) for Sectigo: sectigo.com, affirmtrust.com, comodo.com, comodoca.com, entrust.net, trust-provider.com, usertrust.com. **Who audits Sectigo?** BDO International Limited, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2025-04-01 to 2026-03-31; the statement is dated 2026-06-22. **How do I report a problem certificate to Sectigo?** Use the channel(s) listed in the CCADB: https://secure.sectigo.com/products/RevocationPortal, https://acme.sectigo.com/v2/keyCompromise, https://acme.sectigo.com/v2/keyCompromise/revokeCert. Sources: CCADB All Certificate Information (V5), List of CAA Identifiers, List of CA problem reporting mechanisms and TLS Server Authentication report (ccadb.org/resources).