Certificate authority
ZeroSSL: free ACME certificates on Sectigo roots
Details
- CCADB CA owner
- No own roots in the CCADB TLS report
- Country
- AT
- ACME
- Yes
- Free certificates
- Yes
- Products
- DV wildcard multi-domain
- Roots
- 0
- Roots trusted for TLS
- Chrome 0 · Mozilla 0 · Apple 0 · Microsoft 0
- CAA
sectigo.com
ZeroSSL is a certificate brand that gives out free 90-day DV certificates over ACME and through a web dashboard. It doesn't operate a root of its own: its intermediate CAs are signed by Sectigo roots, so browsers trust ZeroSSL certificates because they trust Sectigo.
Owner and headquarters
ZeroSSL's terms of service name ZeroSSL GmbH as the contracting company, and its intermediate certificates carry C=AT (Austria) and O=ZeroSSL GmbH. The CCADB has no CA owner record for ZeroSSL because it has no root certificate; issuance runs on Sectigo's CA infrastructure.
Root certificates
As of November 2026, CCADB lists no TLS roots under ZeroSSL. The chain served by zerossl.com runs from the intermediate "ZeroSSL ECC DV SSL CA 2" to Sectigo Public Server Authentication Root E46, which is cross-signed by USERTrust ECC Certification Authority. Older ZeroSSL intermediates such as "ZeroSSL ECC Domain Secure Site CA" (2020–2030) were signed directly by USERTrust ECC Certification Authority. Both Sectigo roots are trusted by Chrome, Mozilla, Apple and Microsoft. Serve the full chain your client downloads, or browsers on some devices may fail to build a path; see certificate chains.
Certificate products
ZeroSSL sells DV certificates only: 90-day certificates, annual certificates (which, under SC-081v3, must be renewed by day 199, as its pricing page explains), wildcard and multi-domain certificates. There are no OV or EV products under the ZeroSSL brand.
ACME support
ZeroSSL's ACME server is https://acme.zerossl.com/v2/DV90. It requires External Account Binding (EAB) credentials, which you create in the dashboard or through its API; clients such as acme.sh can register an account with an email address and obtain them automatically. Since acme.sh v3.0 in August 2021, ZeroSSL is acme.sh's default CA for new certificates.
Free certificates
The ACME service issues unlimited free 90-day certificates, including wildcards. The free web plan, without ACME, includes 3 90-day certificates. ZeroSSL says abusive users may be limited or blocked.
Notable incidents and changes
We found no publicly documented misissuance incident specific to the ZeroSSL brand. The main change for users was acme.sh switching its default to ZeroSSL in 2021, which surprised operators who expected Let's Encrypt. Because ZeroSSL depends on Sectigo's hierarchy, Sectigo's root changes, such as the move to the R46/E46 roots, also affect ZeroSSL chains.
CAA records
The CCADB lists 7 CAA issuer domain(s) recognized by the currently valid intermediate certificates of ZeroSSL. One issue record with any of them lets ZeroSSL issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.
Copy-ready record(s) for the first 3 domain(s):
example.com. CAA 0 issue "sectigo.com"
example.com. CAA 0 issue "affirmtrust.com"
example.com. CAA 0 issue "comodo.com"| Domain | Valid intermediates |
|---|---|
sectigo.com | 12 |
affirmtrust.com | 12 |
comodo.com | 12 |
comodoca.com | 12 |
entrust.net | 12 |
trust-provider.com | 12 |
usertrust.com | 12 |
For issuewild, iodef or DNS-provider formats, use the CAA record generator: CAA Generator
Root certificates (CCADB)
The CCADB TLS Server Authentication report lists no root certificates under this organization; its certificates chain to roots operated by another CA.
Valid intermediate CAs operated by ZeroSSL under roots that other CAs own (CCADB; number of valid intermediates in brackets):
- Sectigo (12)
Audits
The CCADB has no audit record for ZeroSSL because it has no root of its own in the TLS report; its certificates are covered by the audits of the CA that operates the roots.
CP/CPS documents
The CCADB has no CP/CPS link for the TLS roots of ZeroSSL.
Report a certificate problem
The CCADB lists no problem-reporting address for ZeroSSL. The Baseline Requirements put these instructions in section 1.5.2 of the CA's CPS.
Incident reports
CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “ZeroSSL”:
FAQ
Why does my acme.sh certificate come from ZeroSSL instead of Let's Encrypt?
Since acme.sh v3.0 (August 2021) ZeroSSL is acme.sh's default CA for new certificates. Run acme.sh --set-default-ca --server letsencrypt to switch, or pass --server letsencrypt per certificate.
Is ZeroSSL trusted as widely as Let's Encrypt?
Its certificates chain to Sectigo roots, which CCADB shows as trusted by Chrome, Mozilla, Apple and Microsoft, so browser trust is comparable. Test old devices separately if you serve legacy clients.
What CAA record allows ZeroSSL to issue certificates?
Publish example.com. CAA 0 issue "sectigo.com". The CCADB lists 7 recognized domain(s) for ZeroSSL: sectigo.com, affirmtrust.com, comodo.com, comodoca.com, entrust.net, trust-provider.com, usertrust.com.
How many root certificates does ZeroSSL have?
None of its own: the CCADB TLS report lists no root under ZeroSSL. Its 12 valid intermediate CAs chain to roots owned by Sectigo (12).