Comodo vs Sectigo: the same certificate authority

Comodo and Sectigo are not rivals: Sectigo is the new name of Comodo CA. Francisco Partners bought the certificate business from Comodo Group in October 2017, and the CA took the Sectigo name on 1 November 2018. PositiveSSL, EssentialSSL and InstantSSL kept their names, so "Comodo SSL" today is a Sectigo certificate.

The cheapest one we verified on 10 November 2026 was PositiveSSL at GoGetSSL for $16.00. Prices were copied from the sellers' own pages on 10 November 2026; they change often and the seller's checkout page is authoritative.

Timeline: from Comodo CA to Sectigo

The CA changed owners in October 2017, changed its name on 1 November 2018 and moved new issuance to Sectigo-branded intermediates on 14 January 2019.

Why the name changed

In its announcement Sectigo said it unveiled the new name "to limit market confusion" and to better represent where its products were heading. The rebrand came one year after the acquisition. The CA had been carved out of Comodo Group, a separate company, so after the sale two independent businesses would otherwise have shared the Comodo name.

What changed technically

Little changed for certificate users. Sectigo's January 2019 notice said that existing certificates, issuing CAs and roots would remain active and trusted, and that new certificates would come from Sectigo-branded issuing CAs under the long-standing USERTrust roots. Sectigo's chain documentation still lists both branded families:

• Roots: USERTrust RSA Certification Authority and COMODO RSA Certification Authority, both expiring in January 2038, plus the older AAA Certificate Services, expiring in January 2028.
• Intermediates: "Sectigo RSA DV/OV/EV Secure Server CA" alongside the older "Comodo RSA DV/OV/EV Secure Server CA".

That is why you may still see COMODO or AAA Certificate Services when you inspect a chain with our certificate decoder. It is not a sign of an old or untrusted certificate, only of which cross-signed path a client builds. Read certificate chains explained for how clients pick a path.

One genuine break happened in 2020: the AddTrust External CA Root expired on 30 May 2020. Sectigo's FAQ said modern browsers and operating systems were unaffected, but clients whose trust store contained only AddTrust would show warnings until updated. If an old server still sends the AddTrust cross-certificate, remove it and serve the current chain.

CAA records: use sectigo.com

If your DNS has CAA records, they must name Sectigo for any PositiveSSL, EssentialSSL, InstantSSL or Sectigo-branded order. Sectigo's knowledge base lists sectigo.com, trust-provider.com and usertrust.com. Its TLS CP/CPS (version 6.2.3) adds that comodo.com and comodoca.com are still recognized for a transitional period but are deprecated and should be replaced. A record such as example.com. CAA 0 issue "sectigo.com" is the safe choice; check yours with the CAA checker.

Comodo-era product names today

The old product names live on under Sectigo, and resellers still use them. Sectigo's own CP/CPS lists positivessl.com and instantssl.com among its official websites, and some resellers keep Comodo in their product URLs. Verified 1-year prices on 10 November 2026:

Namecheap no longer issues these. Since 11 July 2026 its PositiveSSL and EssentialSSL became "Standard SSL" and InstantSSL and PremiumSSL became "High Assurance SSL", issued by SSL.com. Existing Sectigo certificates bought there keep working, and reissuing them stays with Sectigo.

Checklist for a Comodo-era setup

If your servers or DNS were configured when the CA was still called Comodo, a short clean-up avoids surprises at the next renewal:

1. CAA: replace comodoca.com or comodo.com with sectigo.com before the transitional recognition ends.
2. Chain files: remove any AddTrust External CA Root cross-certificate and serve the chain supplied with your current certificate; confirm with the SSL checker.
3. Old bundles in clients: if an application ships its own CA bundle instead of using the operating system's trust store, make sure it contains the USERTrust roots.
4. Renewal plan: decide whether to stay with Sectigo or move to another CA or a free ACME certificate, and update CAA accordingly.

Comodo or Sectigo vs other CAs

Since they are one company, the real question is Sectigo against other CAs. In our price data, Sectigo's budget brands undercut DigiCert's brands for comparable validation, while Namecheap's SSL.com-issued products had even lower first-year prices; SSL.com also sells directly. See Sectigo vs DigiCert and PositiveSSL vs RapidSSL for head-to-head comparisons.

Whatever you buy, the same lifetime limits apply: since 15 March 2026 a publicly trusted TLS certificate lasts at most 200 days, 100 days from 15 March 2027 and 47 days from 15 March 2029. A "multi-year" Sectigo purchase is a subscription with several reissues.