Bridge SSL
SSL certificate providers: who actually signs your certificate
SSL certificate providers come in four kinds: public certificate authorities that run an ACME server, commercial authorities that sell certificates at several validation levels, resellers that sell on behalf of an authority, and hosts or CDNs that arrange a certificate for you. Whoever hands the certificate over, its issuer field names the authority that signed and issued it (RFC 5280) [1]. To weigh one authority against another, compare certificate authorities by their criteria; this page sorts out who issues from who sells.
The four kinds at a glance
The table sorts SSL certificate providers by who signs the certificate and gives the first thing to check in each row.
| Kind | Who signs the certificate | What to check first |
|---|---|---|
| Public CA with an ACME server | The CA itself | Whether your client can complete its account and challenge steps [2] |
| Commercial CA | The CA itself | Which validation levels it sells: DV, OV or EV [3][4][8] |
| Reseller | The CA named in the issuer field | The issuer field, not the shop's name [1] |
| Host or CDN bundle | The CA named in the issuer field | Whether you can see, and choose, that CA [1] |
Public CAs with an ACME server
SSL certificate providers of this kind publish an ACME server, the protocol a CA and an applicant can use to automate verification and certificate issuance (RFC 8555) [2]. Let's Encrypt is one: a nonprofit that does not charge a fee for its certificates, offers domain-validated certificates and has no plans for OV or EV [5]. ZeroSSL runs an ACME server as well, but a new account there needs EAB credentials created in its dashboard [7], and its pricing page marks one plan Self Service Only and lists Basic Support [6].
ZeroSSL vs Let's Encrypt: what actually differs sets those two side by side. For the cases where the nonprofit stops being enough, read Let's Encrypt alternative: when you actually need one.
Commercial CAs and the validation levels
Commercial SSL certificate providers can sell levels that Let's Encrypt does not offer. Sectigo, for one, lists Domain Validation, Organization Validation and Extended Validation certificates on its own certificates page [8]. The level is written into the certificate as a policy identifier, so you can read it instead of taking the seller's word: the CA/Browser Forum Baseline Requirements reserve 2.23.140.1.2.1 for domain-validated and 2.23.140.1.2.2 for organization-validated certificates [3], and the Extended Validation Guidelines give EV 2.23.140.1.1 [4].
A higher level matters when a contract or a compliance regime names it. Otherwise the kind of provider turns on automation and support. What each level costs is a separate question: how much does an SSL certificate cost.
Resellers and hosts: who sells is not who signs
Among SSL certificate providers, a reseller is a shop. It sells certificates that a certificate authority signs, and the issuer field names that authority, not the shop [1]. Judge a purchase from a shop by the authority in the issuer field.
The same rule holds for a host or a CDN that installs a certificate for you: read the issuer field [1]. Before relying on a bundle, ask the host three things. Which authority signs? Can you choose it? What happens at renewal, on every renewal? Whether a certificate comes bundled or bought, the answers decide how much of the work stays yours.
Read the issuer in a live certificate
Reading the issuer takes one command. We ran it against the sites of four SSL certificate providers; it only reads the certificate each server presents and issues nothing [11].
$ echo | openssl s_client -connect letsencrypt.org:443 -servername letsencrypt.org 2>/dev/null | openssl x509 -noout -issuer -ext certificatePolicies| Site | Issuer organisation | CA/B policy identifier | Level it asserts |
|---|---|---|---|
| letsencrypt.org | Let's Encrypt | 2.23.140.1.2.1 | domain validated |
| zerossl.com | ZeroSSL GmbH | 2.23.140.1.2.1 | domain validated |
| digicert.com | DigiCert Inc | 2.23.140.1.1 | extended validation |
| sectigo.com | Sectigo Limited | 2.23.140.1.2.2 | organization validated |
DigiCert's and Sectigo's certificates carry a second identifier of their own beside the CA/B one. The table shows what these servers presented when we ran the command. A site can change authority at its next renewal, so the method carries over; the table does not.
What the provider kind changes
SSL certificate providers differ in three things that you feel: automation, validation level, and who answers when something fails.
Automation. An authority with an ACME server speaks the same protocol [2], though the account step can differ, as EAB does at ZeroSSL [7]. The maximum validity of publicly trusted certificates is scheduled to fall from 398 days to 47 days between March 2026 and March 2029 [10], so renewing by hand gets harder for every kind.
Validation level. Choose it from the requirement, as above [3][4].
Support. Let's Encrypt states that it is not able to offer direct support to its subscribers and points to community support forums [5]. ZeroSSL's pricing page lists Basic Support [6].
Browser trust is not on the list. Mozilla and Google each decide inclusion for their own root store [9], so ask whether a provider's roots are in the stores your visitors use.
FAQ
Who are the SSL certificate providers?
Four kinds: public CAs with an ACME server, commercial CAs, resellers, and hosts or CDNs that arrange the certificate. The CA that signed a certificate is named in its issuer field. [1]
How do I find out who issued my certificate?
Read the issuer field. openssl s_client and openssl x509 -noout -issuer print it for any site you can connect to. [1]
Does a reseller change who issues the certificate?
No. The issuer field names the authority that signed, not the shop. [1]
Does the kind of provider decide browser trust?
Browser trust is decided per root store: Mozilla and Google each decide for their own. Check that the provider's roots are in the stores your visitors use. [9]
Sources
RFC 5280, Internet X.509 Public Key Infrastructure Certificate and CRL Profile: the issuer field.
RFC 8555, Automatic Certificate Management Environment (ACME): abstract.
CA/Browser Forum, Baseline Requirements: §7.1.2.7 certificate policy identifiers.
CA/Browser Forum, Guidelines for the Issuance and Management of Extended Validation Certificates: EV policy identifier.
Let's Encrypt, FAQ: validation types, fee, nonprofit, support.
ZeroSSL, Pricing: plans and support.
ZeroSSL, ACME documentation: EAB credentials.
Sectigo, TLS/SSL certificates page: validation levels listed.
Mozilla Root Store Policy §7.3 and Chrome Root Program Policy: inclusion and removal at the program's sole discretion.
CA/Browser Forum, Ballot SC-081v3: schedule of reducing validity periods.
Our run: leaf certificates read with openssl on the day of writing; nothing issued.