# ZeroSSL: free ACME certificates on Sectigo roots

> ZeroSSL, an Austrian DV certificate brand on Sectigo roots: unlimited free 90-day certificates via ACME, and the default CA of acme.sh.

Source: https://ssl.sh/cas/zerossl/
Last updated: 2026-11-10

ZeroSSL is a certificate brand that gives out free 90-day DV certificates over [ACME](https://ssl.sh/glossary/acme/) and through a web dashboard. It doesn't operate a root of its own: its intermediate CAs are signed by [Sectigo](https://ssl.sh/cas/sectigo/) roots, so browsers trust ZeroSSL certificates because they trust Sectigo.

## Owner and headquarters

ZeroSSL's terms of service name ZeroSSL GmbH as the contracting company, and its intermediate certificates carry C=AT (Austria) and O=ZeroSSL GmbH. The CCADB has no CA owner record for ZeroSSL because it has no root certificate; issuance runs on Sectigo's CA infrastructure.

## Root certificates

As of November 2026, CCADB lists no TLS roots under ZeroSSL. The chain served by zerossl.com runs from the intermediate "ZeroSSL ECC DV SSL CA 2" to Sectigo Public Server Authentication Root E46, which is cross-signed by USERTrust ECC Certification Authority. Older ZeroSSL intermediates such as "ZeroSSL ECC Domain Secure Site CA" (2020–2030) were signed directly by USERTrust ECC Certification Authority. Both Sectigo roots are trusted by Chrome, Mozilla, Apple and Microsoft. Serve the full chain your client downloads, or browsers on some devices may fail to build a path; see [certificate chains](https://ssl.sh/learn/certificate-chains/).

## Certificate products

ZeroSSL sells DV certificates only: 90-day certificates, annual certificates (which, under [SC-081v3](https://ssl.sh/ballots/sc-081/), must be renewed by day 199, as its pricing page explains), wildcard and multi-domain certificates. There are no OV or EV products under the ZeroSSL brand.

## ACME support

ZeroSSL's ACME server is `https://acme.zerossl.com/v2/DV90`. It requires External Account Binding (EAB) credentials, which you create in the dashboard or through its API; clients such as acme.sh can register an account with an email address and obtain them automatically. Since acme.sh v3.0 in August 2021, ZeroSSL is acme.sh's default CA for new certificates.

## Free certificates

The ACME service issues unlimited free 90-day certificates, including wildcards. The free web plan, without ACME, includes 3 90-day certificates. ZeroSSL says abusive users may be limited or blocked.

## Notable incidents and changes

We found no publicly documented misissuance incident specific to the ZeroSSL brand. The main change for users was acme.sh switching its default to ZeroSSL in 2021, which surprised operators who expected Let's Encrypt. Because ZeroSSL depends on Sectigo's hierarchy, Sectigo's root changes, such as the move to the R46/E46 roots, also affect ZeroSSL chains.


## Root certificates (CCADB)

The CCADB TLS Server Authentication report lists no root certificates under this organization; its certificates chain to roots operated by another CA.

Valid intermediate CAs operated by ZeroSSL under roots that other CAs own (CCADB; number of valid intermediates in brackets):

- Sectigo: 12

## CAA records

The CCADB lists 7 CAA issuer domain(s) recognized by the currently valid intermediate certificates of ZeroSSL. One issue record with any of them lets ZeroSSL issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.

```
example.com. CAA 0 issue "sectigo.com"
example.com. CAA 0 issue "affirmtrust.com"
example.com. CAA 0 issue "comodo.com"
```

## Audits

The CCADB has no audit record for ZeroSSL because it has no root of its own in the TLS report; its certificates are covered by the audits of the CA that operates the roots.


## CP/CPS documents

The CCADB has no CP/CPS link for the TLS roots of ZeroSSL.


## Report a certificate problem

The CCADB lists no problem-reporting address for ZeroSSL. The Baseline Requirements put these instructions in section 1.5.2 of the CA's CPS.


## Incident reports

CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “ZeroSSL”: https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&product=CA+Program&component=CA+Certificate+Compliance&short_desc_type=allwords&short_desc=ZeroSSL&order=changeddate+DESC

## FAQ

**Why does my acme.sh certificate come from ZeroSSL instead of Let's Encrypt?**

Since acme.sh v3.0 (August 2021) ZeroSSL is acme.sh's default CA for new certificates. Run `acme.sh --set-default-ca --server letsencrypt` to switch, or pass `--server letsencrypt` per certificate.

**Is ZeroSSL trusted as widely as Let's Encrypt?**

Its certificates chain to Sectigo roots, which CCADB shows as trusted by Chrome, Mozilla, Apple and Microsoft, so browser trust is comparable. Test old devices separately if you serve legacy clients.

**What CAA record allows ZeroSSL to issue certificates?**

Publish example.com. CAA 0 issue "sectigo.com". The CCADB lists 7 recognized domain(s) for ZeroSSL: sectigo.com, affirmtrust.com, comodo.com, comodoca.com, entrust.net, trust-provider.com, usertrust.com.

**How many root certificates does ZeroSSL have?**

None of its own: the CCADB TLS report lists no root under ZeroSSL. Its 12 valid intermediate CAs chain to roots owned by Sectigo (12).

Sources: CCADB All Certificate Information (V5), List of CAA Identifiers, List of CA problem reporting mechanisms and TLS Server Authentication report (ccadb.org/resources).