Certificate authority
SSL.com: Houston CA, roots, ACME and the 2025 DCV flaw
Details
- CCADB CA owner
- SSL.com
- Country
- US
- Country (CCADB)
- United States of America
- ACME
- Yes
- Free certificates
- Yes
- Products
- DV OV EV wildcard multi-domain S/MIME code-signing document-signing
- Roots
- 12
- Roots trusted for TLS
- Chrome 6 · Mozilla 6 · Apple 10 · Microsoft 12
- Intermediates under its roots
- 235 (87 valid)
- Auditor
- BDO International Limited
- CAA
ssl.com
SSL.com is a US certificate authority that runs its own roots and sells DV, OV and EV TLS certificates, S/MIME, code signing and document signing. It supports ACME with External Account Binding and, according to its help center, falls back to free 90-day DV certificates over ACME when an account has no funds.
Owner and headquarters
SSL.com was founded in 2002 in Houston, Texas, as a certificate reseller and became a CA with its own self-signed root in 2016, according to its company timeline. It joined the CA/Browser Forum as an associate member in October 2016 and became a full voting member on 2017-08-03. Its roots name "SSL Corporation" as the organization.
Root certificates
As of November 2026, CCADB lists 12 roots under SSL.com. Six are trusted for TLS by Chrome, Mozilla, Apple and Microsoft: SSL.com Root Certification Authority RSA and ECC and the EV RSA R2 and EV ECC roots (2016–2042), and SSL.com TLS RSA Root CA 2022 and TLS ECC Root CA 2022 (valid until 2046). CCADB also lists the former Trustwave hierarchy under SSL.com: SecureTrust CA, Secure Global CA, XRamp Global CA and three Trustwave Global roots, all removed by Chrome and Mozilla.
Certificate products
DV, OV and EV TLS certificates including wildcard and multi-domain options, S/MIME, code signing and document signing.
ACME support
SSL.com's ACME servers are https://acme.ssl.com/sslcom-dv-ecc and https://acme.ssl.com/sslcom-dv-rsa. You copy the account key and HMAC key from your SSL.com account and pass them as EAB credentials on the first run of certbot or acme.sh; paid certificates are billed to the account.
Free certificates
SSL.com's help center says that if the account doesn't have enough funds for a paid certificate, an ACME request yields a free 90-day DV certificate covering one domain plus, optionally, its www subdomain.
Notable incidents
In April 2025 a researcher showed that SSL.com's implementation of BR method 3.2.2.4.14 ("Email to DNS TXT contact") treated the domain of the contact email address as validated. By publishing a TXT record pointing at an @aliyun.com mailbox for a test domain, the researcher obtained a certificate for aliyun.com and www.aliyun.com. SSL.com disabled the method, revoked the misissued certificates and reported the incident on Mozilla's Bugzilla (bug 1961406). SC-090 now phases out all email-based validation methods by 2028.
CAA records
The CCADB lists 8 CAA issuer domain(s) recognized by the currently valid intermediate certificates of SSL.com. One issue record with any of them lets SSL.com issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.
Copy-ready record(s) for the first 3 domain(s):
example.com. CAA 0 issue "ssl.com"
example.com. CAA 0 issue "affirmtrust.com"
example.com. CAA 0 issue "entrust.net"| Domain | Valid intermediates |
|---|---|
ssl.com | 163 |
affirmtrust.com | 11 |
entrust.net | 11 |
comodo.com | 1 |
comodoca.com | 1 |
sectigo.com | 1 |
trust-provider.com | 1 |
usertrust.com | 1 |
For issuewild, iodef or DNS-provider formats, use the CAA record generator: CAA Generator
Root certificates (CCADB)
SSL.com has 12 root certificate(s) in the CCADB TLS report. Together they have signed 235 intermediate CA certificates, 87 of them still valid.
Roots this CA owner has in the CCADB TLS Server Authentication report, with current status in each root store.
- trusted for TLS
- included with limits (NotBefore / no TLS bit)
- removed or blocked
- not included
| Root certificate | Key | Expires | Ch | Mo | Ap | MS | Intermediates |
|---|---|---|---|---|---|---|---|
| Secure Global CA | RSA 2048 | 2029-12-31 | Removed | Removed | Blocked | Included | 5 (1) |
| SecureTrust CA | RSA 2048 | 2029-12-31 | Removed | Removed | Included | Included | 33 (7) |
| SSL.com EV Root Certification Authority ECC | ECDSA P-384 | 2041-02-12 | Included | Included | Included | Included | 11 (6) |
| SSL.com EV Root Certification Authority RSA R2 | RSA 4096 | 2042-05-30 | Included | Included | Included | Included | 21 (10) |
| SSL.com Root Certification Authority ECC | ECDSA P-384 | 2041-02-12 | Included | Included | Included | Included | 26 (10) |
| SSL.com Root Certification Authority RSA | RSA 4096 | 2041-02-12 | Included | Included | Included | Included | 40 (16) |
| SSL.com TLS ECC Root CA 2022 | ECDSA P-384 | 2046-08-19 | Included | Included | Included | Included | 13 (13) |
| SSL.com TLS RSA Root CA 2022 | RSA 4096 | 2046-08-19 | Included | Included | Included | Included | 15 (15) |
| Trustwave Global Certification Authority | RSA 4096 | 2042-08-23 | Removed | Removed | Included | Included | 18 (1) |
| Trustwave Global ECC P256 Certification Authority | ECDSA P-256 | 2042-08-23 | Removed | Removed | Included | Included | 15 (1) |
| Trustwave Global ECC P384 Certification Authority | ECDSA P-384 | 2042-08-23 | Removed | Removed | Included | Included | 15 (1) |
| XRamp Global Certification Authority | RSA 2048 | 2035-01-01 | Removed | Removed | Included | Included | 23 (6) |
Valid intermediate CAs operated by SSL.com under roots that other CAs own (CCADB; number of valid intermediates in brackets):
- Sectigo (19)
Audits
Audit data the CCADB records for the TLS roots of SSL.com. Auditor(s): BDO International Limited. The most recent audit period ended on 2026-06-30.
| Audit | Scheme | Period | Statement | Report |
|---|---|---|---|---|
| Standard audit | WebTrust | 2025-07-01 – 2026-06-30 | 2026-09-21 | cpacanada.ca |
| Network security | WebTrust | 2025-07-01 – 2026-06-30 | 2026-09-21 | cpacanada.ca |
| TLS Baseline Requirements | WebTrust | 2025-07-01 – 2026-06-30 | 2026-09-21 | cpacanada.ca |
| TLS EV Guidelines | WebTrust | 2025-07-01 – 2026-06-30 | 2026-09-21 | cpacanada.ca |
CP/CPS documents
Certificate Policy and Certification Practice Statement links that SSL.com has disclosed in the CCADB for its TLS roots, with effective dates:
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf (effective 2026-10-05)
- Document repository: https://www.ssl.com/repository/
Report a certificate problem
To report a mis-issued certificate, a compromised private key or other abuse, use the channels SSL.com lists in the CCADB (replace [at] and [dot] in addresses):
Incident reports
CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “SSL.com”:
ACME directories (CCADB)
DV ACME directory URLs that SSL.com has disclosed in the CCADB for its valid certificates:
https://acme.ssl.comhttps://acme.ssl.com/sslcom-dv-ecchttps://acme.ssl.com/sslcom-dv-rsa
FAQ
What CAA record allows SSL.com to issue certificates?
Publish example.com. CAA 0 issue "ssl.com". The CCADB lists 8 recognized domain(s) for SSL.com: ssl.com, affirmtrust.com, entrust.net, comodo.com, comodoca.com, sectigo.com, trust-provider.com, usertrust.com.
Who audits SSL.com?
BDO International Limited, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2025-07-01 to 2026-06-30; the statement is dated 2026-09-21.
How do I report a problem certificate to SSL.com?
Use the channel(s) listed in the CCADB: https://www.ssl.com/revoke/.
How many root certificates does SSL.com have?
12 in the CCADB TLS report. Trusted for TLS: Chrome 6, Mozilla 6, Apple 10, Microsoft 12. They have signed 235 intermediates, 87 of them still valid.