Certificate Authority Companies: The Complete List of SSL CAs (2026)

Roughly 50 organisations operate publicly trusted roots that are included in the major browser and OS root stores tracked by the Common CA Database (CCADB). W3Techs monitors around 35 of them in its website survey. In practice the list is far shorter than that: eight certificate authority companies account for more than 95% of all certificates observed on public websites, and everyone else sits below 0.1% share.

Let's Encrypt is the largest certificate authority by volume, used by 64.3% of all websites (W3Techs, 8 September 2026), which works out to a 67.7% CA market share. Among commercial certificate authority companies, GlobalSign leads on website count at 20.5%, followed by Sectigo at 4.7%, the GoDaddy Group at 3.5% and the DigiCert Group at 1.6%. By enterprise revenue rather than raw certificate count, DigiCert is the largest.

A certificate authority operates the roots, runs the validation infrastructure and signs the certificates. A reseller buys issuance capacity from one or more CAs and sells it under its own brand at a lower price. The certificate you receive from a reseller is chained to the same CA root, so the browser trust is identical; what differs is price, support and the management console.

Trustworthy CAs maintain strict validation processes, undergo annual WebTrust or ETSI audits, publish a Certificate Policy and Certification Practice Statement, log every certificate to Certificate Transparency, and are accepted into the Chrome, Mozilla, Microsoft and Apple root programs. The Entrust distrust of 2024 showed that even a thirty-year-old CA loses that status if incident response falls short.

No. Root store inclusion is not a single yes-or-no list. A CA can be trusted by Microsoft but not by Chrome, or trusted for existing certificates but not for newly issued ones — which is exactly the situation Entrust ended up in. Before buying, check that the CA's roots appear in all four major root programs and that no distrust timeline is pending against it.

Pricing varies based on validation level (DV, OV, EV), warranty amounts, customer support quality, additional features (malware scanning, vulnerability assessment), brand reputation, and the CA's operational costs and profit margins. The underlying cryptography is identical across every publicly trusted CA — a $3 DV certificate and a $300 DV certificate produce the same padlock.

Browser vendors maintain root certificate programs with strict requirements including security audits, compliance standards, incident reporting timelines and operational practices. CAs must pass rigorous evaluations to be included in browser trust stores. Non-compliance can lead to distrust actions, as seen with Entrust in 2024 and Symantec in 2017–2018.

In mid-2024, Google Chrome and Mozilla Firefox announced they would no longer trust new TLS certificates issued by Entrust's public roots, effective November 2024; Apple followed. The cause was a pattern of compliance failures and inadequate incident responses rather than a single breach. Two years on, Entrust's public TLS share sits below 0.1% and it serves the market through certificates issued from another CA's roots. Its private PKI, HSM and non-TLS business is unaffected.

Browser vendors remove the CA from their trust stores, so certificates from that CA trigger full-page security warnings. Existing certificates are usually grandfathered until a cut-off date, giving operators a migration window. This has now happened twice at scale — Symantec (2017–2018) and Entrust (2024) — which is why an inventory of what you have deployed, and from whom, is worth maintaining.

Since March 2026 SSL certificates are capped at 199 days (CA/Browser Forum Ballot SC-081v3), dropping to 100 days in 2027 and 47 days in 2029. That turns renewal into a recurring operational task, so ACME support has moved from a nice-to-have to the single most important selection criterion. If a CA cannot issue to your ACME client, expect to pay for the difference in staff time.

For a standard brochure or e-commerce site, a DV certificate from Sectigo, GoDaddy or Certum covers everything you need at a low price, and Let's Encrypt covers it at no cost if your host supports ACME. Pay for OV or EV only when a compliance requirement, a payment processor or a procurement questionnaire specifically asks for a validated organisation name in the certificate.

DigiCert and GlobalSign dominate the enterprise segment because the product being bought is not really the certificate — it is the lifecycle management platform, the SLA, the private PKI options and the support desk. Sectigo competes on the same feature set at a lower price point. Given the 199-day cap, weight the discovery and automation capabilities of the CLM platform heavily in the decision.

Technically no — a certificate from any publicly trusted CA works identically everywhere. Location matters for compliance (eIDAS-qualified certificates in the EU must come from a qualified trust service provider such as Actalis, Certum or D-Trust), for invoicing and VAT, for local-language support, and occasionally for data-residency requirements in the validation process.

The encryption is identical. Let's Encrypt, ZeroSSL and Buypass issue DV certificates using the same algorithms and key sizes as any commercial CA, and browsers treat them the same way. What you do not get for free is organisation validation, a warranty, phone support, or certificates with lifetimes and SAN counts geared to enterprise deployments.