CA Reputation Database

Look up Certificate Authority reputation and trust status

Domain

Port

Results

About

The Certificate Authority Reputation Database maintains a comprehensive reputation profile for all major Certificate Authorities, including trust status, historical incidents, security track record, and industry rankings. It aggregates data from security research, browser trust store changes, and incident reports to provide a complete picture of CA reliability.

Choosing the right CA is critical for your organization's security posture. This database helps you evaluate CAs based on their security history, compliance record, and industry reputation. It tracks CA distrust events, security incidents, and policy changes that may affect your certificate management strategy.

How to Use

1Browse the CA database by name, trust status, or reputation score
2Click on any CA to view its complete reputation profile including history and incidents
3Compare CAs side-by-side to evaluate options for your certificate needs
4Filter by trust status to find CAs trusted by all major platforms

Use Cases

•CA Selection:** Make informed decisions when choosing a Certificate Authority by reviewing their security track record and reputation

•Risk Assessment:** Evaluate the risk of your current CA based on their history of security incidents and trust issues

•Vendor Due Diligence:** Conduct due diligence on CAs as part of vendor assessment processes

•Migration Planning:** Identify alternative CAs when your current CA experiences trust issues or is distrusted

•Compliance Documentation:** Document CA evaluation as part of your certificate management policy for audits

What This Reports

Trust information comes from the certificate and the local trust store — not from a score someone assigned to an authority. This page reports what can be established and says plainly what it cannot.

1Identify the issuing authority from the live certificate and classify it as self-signed, a root present in the local trust store, or an intermediate trusted through a root.

2Load the available trust bundles and compare the authority against the self-signed roots they contain. Matching is done against roots only, because matching against the intermediate that issued your certificate flags almost every real authority as untrusted.

3Explain the classification, including that an intermediate not appearing in the trust store is normal and not itself a finding — that is what intermediates are.

This is trust information, not a reputation judgement. Root programmes publish incident reports about specific authorities, and that is the source for questions about an authority's history rather than a number derived from nothing.

Tips & Best Practices

•Check CA reputation before signing long-term certificate contracts

•Monitor CA reputation changes and subscribe to alerts for CAs you use

•Consider using multiple CAs for redundancy in case one CA experiences issues

•Review the CA's incident response history — how they handled past issues matters

Technical Details

●Data Sources:** Browser trust store changes, CA/Browser Forum minutes, security researcher reports, incident disclosures

●Scoring:** Weighted reputation score based on trust history, security incidents, compliance, and industry standing

●Update Frequency:** Real-time for trust changes, weekly for reputation updates, monthly for full profiles

●Historical Data:** Complete incident history going back to 2012

Frequently Asked Questions

The reputation score is calculated from multiple factors: trust store status across platforms (40%), history of security incidents (25%), compliance with CA/Browser Forum requirements (20%), and industry analyst assessments (15%). Scores are updated whenever new information becomes available.

When a CA is distrusted by a browser vendor, our database immediately updates their profile with the distrust event details, affected certificate ranges, and timeline. We also notify all users who monitor certificates from that CA with migration recommendations.

Yes, security researchers and organization can submit CA incident reports, trust observations, and reputation assessments through our submission portal. All submissions are reviewed by our team before being added to the database.

From two places you can inspect: the certificate itself, which names the issuing authority, and the trust bundles available on this machine, which contain the self-signed roots. Comparing those two produces the classification. Nothing is looked up from a database of opinions, which is why a previous version of this page's hand-written scores were removed.

Because that is how the system is designed to work. Roots are the anchors held by clients; intermediates are delegated from them and are trusted through that path rather than directly. A certificate whose issuer is an intermediate is the normal case for the entire internet. What matters is whether the chain from your certificate up to a root is complete and verifies, which is a separate question the chain pages answer.

Loosely, since browsers draw from similar root programmes but update on their own schedules and this server is not using any browser's store. A positive result is good evidence the authority is widely trusted. A negative one is worth confirming in a browser directly before acting, since a store difference can explain it without anything being wrong.

That is worth investigating but not alarming on its own. It can mean a private CA, a certificate from a newer authority, a root programme that removed or has not yet added the root, or simply a store difference on this machine. Establish whether the chain verifies in a browser before concluding anything — an untrusted result from a store that is not a browser's tells you less than it appears to.

Because there is no defensible way to compute one from outside, and a number that looks computed but is not is worse than no number. An earlier version published scores for named authorities that had been written by hand — and paired them with an unsupported accusation about one of them, which has no place in a tool. If you need to know about an authority's history, the root programme's published incident reports are the authoritative source.

Related Tools

CA Trust CA Trust Store CA Reputation Issuer Identifier Certificate Detail SSL Report