# What Is CCADB (Common CA Database)? Definition and Examples

> CCADB is the Common CA Database, a shared repository where CAs disclose their roots, intermediates, audits, policies and CRLs to root programs.

Source: https://ssl.sh/glossary/ccadb/
Last updated: 2026-11-10

The CCADB (Common CA Database) was created by Mozilla and is now used jointly by major [root programs](https://ssl.sh/glossary/root-program/), including those of Mozilla, Microsoft, Google and Apple. CAs record every root and [intermediate certificate](https://ssl.sh/glossary/intermediate-certificate/) that chains to an included root, together with audit statements, Certificate Policy and CPS documents, and the URLs of their full CRLs. Root programs use it to review inclusion requests, track audit deadlines and manage CA records in one place.

## Why it matters
Disclosure turns the web PKI's intermediates into an inventory that anyone can check. An intermediate that chains to a trusted root but is missing from the CCADB is itself a compliance incident, and root programs read the audit reports stored there when deciding whether to keep trusting a CA. The CRL URLs disclosed in the CCADB are what Mozilla uses to build [CRLite](https://ssl.sh/glossary/crlite/), which matters more now that Ballot SC-063 has made CRLs mandatory and OCSP optional.

## Example
Get the SHA-256 fingerprint of an unfamiliar intermediate from a chain:

```bash
openssl x509 -in intermediate.pem -noout -fingerprint -sha256
```

Searching the CCADB's published reports for that fingerprint shows which CA operates the intermediate, its audit statements, and whether it is technically constrained or revoked.

## Common misconceptions
- **The CCADB is a trust store.** Being listed is not the same as being trusted; each vendor still decides which roots to include.
- **Only root certificates are recorded.** Every intermediate capable of issuing publicly trusted certificates must be disclosed too.
- **It is run by the CA/Browser Forum.** It is operated for the root store operators and is separate from the Forum.

## Related terms

- [根证书计划](https://ssl.sh/zh/glossary/root-program/): 根证书计划是浏览器或操作系统厂商用来决定其信任库收录、限制或移除哪些根 CA 的政策与流程。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [下级 CA](https://ssl.sh/zh/glossary/subordinate-ca/): 下级 CA 是 CA 证书由另一个 CA（通常是根 CA）签发的证书颁发机构，一般负责实际签发终端证书。
- [WebTrust 审计](https://ssl.sh/zh/glossary/webtrust/): WebTrust 审计是由持证审计师依据 CA/B 论坛和根证书计划要求检查 CA 内部控制的审计框架，全称 WebTrust for CAs。
- [CRL](https://ssl.sh/zh/glossary/crl/): CRL 是由 CA 签名并定期重新发布的证书吊销列表，列出它在证书到期前就已吊销的证书序列号。
- [CRLite](https://ssl.sh/zh/glossary/crlite/): CRLite 是 Mozilla 为 Firefox 打造的压缩吊销数据集，浏览器无需联系 CA，就能在本地判断公开记录的证书是否已被吊销。
- [中间证书](https://ssl.sh/zh/glossary/intermediate-certificate/): 中间证书是由根证书（或上级中间证书）签发、用来签发网站证书的 CA 证书，服务器必须把它和网站证书一起发送给客户端。