# SSL.com: Houston CA, roots, ACME and the 2025 DCV flaw > SSL.com, a Houston CA founded in 2002: 2016 and 2022 roots, ex-Trustwave roots, ACME with free 90-day DV, and the 2025 aliyun.com misissuance. Source: https://ssl.sh/cas/ssl-com/ Last updated: 2026-11-10 SSL.com is a US certificate authority that runs its own roots and sells DV, OV and EV TLS certificates, S/MIME, code signing and document signing. It supports ACME with External Account Binding and, according to its help center, falls back to free 90-day DV certificates over ACME when an account has no funds. ## Owner and headquarters SSL.com was founded in 2002 in Houston, Texas, as a certificate reseller and became a CA with its own self-signed root in 2016, according to its company timeline. It joined the CA/Browser Forum as an associate member in October 2016 and became a full voting member on 2017-08-03. Its roots name "SSL Corporation" as the organization. ## Root certificates As of November 2026, CCADB lists 12 roots under SSL.com. Six are trusted for TLS by Chrome, Mozilla, Apple and Microsoft: SSL.com Root Certification Authority RSA and ECC and the EV RSA R2 and EV ECC roots (2016–2042), and SSL.com TLS RSA Root CA 2022 and TLS ECC Root CA 2022 (valid until 2046). CCADB also lists the former Trustwave hierarchy under SSL.com: SecureTrust CA, Secure Global CA, XRamp Global CA and three Trustwave Global roots, all removed by Chrome and Mozilla. ## Certificate products DV, OV and EV TLS certificates including wildcard and multi-domain options, S/MIME, code signing and document signing. ## ACME support SSL.com's ACME servers are `https://acme.ssl.com/sslcom-dv-ecc` and `https://acme.ssl.com/sslcom-dv-rsa`. You copy the account key and HMAC key from your SSL.com account and pass them as EAB credentials on the first run of certbot or acme.sh; paid certificates are billed to the account. ## Free certificates SSL.com's help center says that if the account doesn't have enough funds for a paid certificate, an ACME request yields a free 90-day DV certificate covering one domain plus, optionally, its www subdomain. ## Notable incidents In April 2025 a researcher showed that SSL.com's implementation of BR method 3.2.2.4.14 ("Email to DNS TXT contact") treated the domain of the contact email address as validated. By publishing a TXT record pointing at an @aliyun.com mailbox for a test domain, the researcher obtained a certificate for aliyun.com and www.aliyun.com. SSL.com disabled the method, revoked the misissued certificates and reported the incident on Mozilla's Bugzilla (bug 1961406). [SC-090](https://ssl.sh/ballots/sc-090/) now phases out all email-based validation methods by 2028. ## Root certificates (CCADB) SSL.com has 12 root certificate(s) in the CCADB TLS report. Together they have signed 235 intermediate CA certificates, 87 of them still valid. | Root certificate | Key | Expires | Chrome | Mozilla | Apple | Microsoft | Intermediates | SHA-256 | |---|---|---|---|---|---|---|---|---| | Secure Global CA | RSA 2048 | 2029-12-31 | Removed | Removed | Blocked | Included | 5 | 4200F5043AC8590EBB527D209ED1503029FBCBD41CA1B506EC27F15ADE7DAC69 | | SecureTrust CA | RSA 2048 | 2029-12-31 | Removed | Removed | Included | Included | 33 | F1C1B50AE5A20DD8030EC9F6BC24823DD367B5255759B4E71B61FCE9F7375D73 | | SSL.com EV Root Certification Authority ECC | ECDSA P-384 | 2041-02-12 | Included | Included | Included | Included | 11 | 22A2C1F7BDED704CC1E701B5F408C310880FE956B5DE2A4A44F99C873A25A7C8 | | SSL.com EV Root Certification Authority RSA R2 | RSA 4096 | 2042-05-30 | Included | Included | Included | Included | 21 | 2E7BF16CC22485A7BBE2AA8696750761B0AE39BE3B2FE9D0CC6D4EF73491425C | | SSL.com Root Certification Authority ECC | ECDSA P-384 | 2041-02-12 | Included | Included | Included | Included | 26 | 3417BB06CC6007DA1B961C920B8AB4CE3FAD820E4AA30B9ACBC4A74EBDCEBC65 | | SSL.com Root Certification Authority RSA | RSA 4096 | 2041-02-12 | Included | Included | Included | Included | 40 | 85666A562EE0BE5CE925C1D8890A6F76A87EC16D4D7D5F29EA7419CF20123B69 | | SSL.com TLS ECC Root CA 2022 | ECDSA P-384 | 2046-08-19 | Included | Included | Included | Included | 13 | C32FFD9F46F936D16C3673990959434B9AD60AAFBB9E7CF33654F144CC1BA143 | | SSL.com TLS RSA Root CA 2022 | RSA 4096 | 2046-08-19 | Included | Included | Included | Included | 15 | 8FAF7D2E2CB4709BB8E0B33666BF75A5DD45B5DE480F8EA8D4BFE6BEBC17F2ED | | Trustwave Global Certification Authority | RSA 4096 | 2042-08-23 | Removed | Removed | Included | Included | 18 | 97552015F5DDFC3C8788C006944555408894450084F100867086BC1A2BB58DC8 | | Trustwave Global ECC P256 Certification Authority | ECDSA P-256 | 2042-08-23 | Removed | Removed | Included | Included | 15 | 945BBC825EA554F489D1FD51A73DDF2EA624AC7019A05205225C22A78CCFA8B4 | | Trustwave Global ECC P384 Certification Authority | ECDSA P-384 | 2042-08-23 | Removed | Removed | Included | Included | 15 | 55903859C8C0C3EBB8759ECE4E2557225FF5758BBD38EBD48276601E1BD58097 | | XRamp Global Certification Authority | RSA 2048 | 2035-01-01 | Removed | Removed | Included | Included | 23 | CECDDC905099D8DADFC5B1D209B737CBE2C18CFB2C10C0FF0BCF0D3286FC1AA2 | Valid intermediate CAs operated by SSL.com under roots that other CAs own (CCADB; number of valid intermediates in brackets): - Sectigo: 19 ## CAA records The CCADB lists 8 CAA issuer domain(s) recognized by the currently valid intermediate certificates of SSL.com. One issue record with any of them lets SSL.com issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them. ``` example.com. CAA 0 issue "ssl.com" example.com. CAA 0 issue "affirmtrust.com" example.com. CAA 0 issue "entrust.net" ``` ## Audits Audit data the CCADB records for the TLS roots of SSL.com. Auditor(s): BDO International Limited. The most recent audit period ended on 2026-06-30. - Standard audit: WebTrust 2025-07-01 – 2026-06-30 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=acc3f372-b38b-4b15-b18f-2b4f744dd65a) - Network security: WebTrust 2025-07-01 – 2026-06-30 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6c467dfb-cc1c-4093-b54e-11de4b73e102) - TLS Baseline Requirements: WebTrust 2025-07-01 – 2026-06-30 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=00fa2ef1-ad05-49fc-af40-b407af21ff35) - TLS EV Guidelines: WebTrust 2025-07-01 – 2026-06-30 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b5960e24-3314-4fd8-b344-5ff81e020e9c) ## CP/CPS documents Certificate Policy and Certification Practice Statement links that SSL.com has disclosed in the CCADB for its TLS roots, with effective dates: - CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf ## Report a certificate problem To report a mis-issued certificate, a compromised private key or other abuse, use the channels SSL.com lists in the CCADB (replace [at] and [dot] in addresses): - https://www.ssl.com/revoke/ ## Incident reports CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “SSL.com”: https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&product=CA+Program&component=CA+Certificate+Compliance&short_desc_type=allwords&short_desc=SSL.com&order=changeddate+DESC ## FAQ **What CAA record allows SSL.com to issue certificates?** Publish example.com. CAA 0 issue "ssl.com". The CCADB lists 8 recognized domain(s) for SSL.com: ssl.com, affirmtrust.com, entrust.net, comodo.com, comodoca.com, sectigo.com, trust-provider.com, usertrust.com. **Who audits SSL.com?** BDO International Limited, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2025-07-01 to 2026-06-30; the statement is dated 2026-09-21. **How do I report a problem certificate to SSL.com?** Use the channel(s) listed in the CCADB: https://www.ssl.com/revoke/. **How many root certificates does SSL.com have?** 12 in the CCADB TLS report. Trusted for TLS: Chrome 6, Mozilla 6, Apple 10, Microsoft 12. They have signed 235 intermediates, 87 of them still valid. Sources: CCADB All Certificate Information (V5), List of CAA Identifiers, List of CA problem reporting mechanisms and TLS Server Authentication report (ccadb.org/resources).