SSL Toolkit Logo
Tools Features Compare FAQ Login

Certificate Authority Reputation Checker

Check the reputation and trustworthiness of Certificate Authorities

CA Reputation

About

The Certificate Authority Reputation tool provides detailed reputation profiles for Certificate Authorities, including trust status, security history, incident reports, and industry rankings. It helps you evaluate CAs before choosing them for your certificate needs and monitors CAs you already use for trust changes.

The reputation data is compiled from browser trust store changes, CA/Browser Forum discussions, security researcher reports, and public incident disclosures. Each CA profile includes a trust score, historical incidents, and recommendations.

How to Use

  1. 1Browse the CA list or search for a specific Certificate Authority
  2. 2Click on a CA name to view its full reputation profile
  3. 3Review the trust status, incident history, and security rating
  4. 4Compare multiple CAs to make informed selection decisions

Use Cases

What Trust Reporting Means Here

There is no widely accepted reputation score for certificate authorities, so this page does not invent one. It reports what can be established from the trust store this machine actually uses.

  1. 1Read the issuing authority from the live certificate and classify it: self-signed, a trust anchor in the local store, or an intermediate trusted through a root.
  2. 2Load the trust bundles and compare against the self-signed roots they contain. Matching names is done against root certificates only — an earlier version matched the intermediate that issued your certificate, which flagged every well-run authority as untrusted because issuance is almost always via intermediates.
  3. 3Explain what the result does and does not establish. An intermediate not being a trust anchor is normal and is not a finding; whether the chain is intact has to come from the certificates the server actually sends, which the chain checker covers.

An earlier version of this page published hand-written scores out of a hundred for named authorities, along with a non-English allegation about one of them. Both were removed: scores that were not derived from anything are worse than no score, and unsupported accusations about real organisations have no place in a tool.

Tips & Best Practices

  • •Check CA reputation before committing to long-term certificate contracts
  • •Subscribe to reputation change alerts for CAs you actively use
  • •Consider using multiple CAs for critical infrastructure to reduce single-CA risk
  • •Review CA incident response history — how they handle issues matters as much as the issues themselves

Technical Details

●Data Sources:** Browser trust stores, CA/B Forum minutes, security researcher reports, incident disclosures
●Scoring:** Weighted reputation based on trust history (40%), incidents (25%), compliance (20%), industry standing (15%)
●Updates:** Real-time for trust changes, weekly for reputation scores, monthly for full profiles
●History:** Complete incident database going back to 2012

Frequently Asked Questions

Trustworthy CAs have: consistent trust store presence across all major platforms, no history of security incidents or mis-issuance, compliance with CA/Browser Forum Baseline Requirements, transparent incident disclosure and response, and strong industry reputation among security professionals.
The reputation profile is updated with incident details, impact assessment, and remediation status. Users monitoring that CA receive alerts. If the incident leads to distrust by browser vendors, the profile reflects the trust status change and affected certificate ranges.
Yes, the comparison view shows trust status, incident history, supported features, and reputation scores for multiple CAs simultaneously. This helps you make informed decisions when selecting a CA or evaluating alternatives.
Because no defensible method exists for producing one from outside. A previous version of this page published scores out of a hundred for named authorities, but they were written by hand rather than computed from anything, so they described the author's opinion while looking like a measurement. Reports of issuance incidents are published by the root programmes, and that is the source to use when you need to know about a specific authority.
No — it is the normal case. Almost every certificate is issued by an intermediate, which is trusted because it chains to a root rather than because it appears in a trust store directly. Roots are held back deliberately so compromising one does not compromise everything beneath it. What matters is whether the chain from your certificate up to a root is intact and complete, which the chain checker on this site verifies.
That the certificate was issued to itself rather than by a separate authority, which is the normal construction for a root certificate and unusual for anything else. A self-signed leaf — which is what a website serving one looks like — is accepted only by machines explicitly configured to trust it, which in practice means no browsers on the public internet. That is the finding, and it is stated rather than scored.
From the certificate bundles available to this machine, which typically means the system's CA store or the certifi bundle. That is a good proxy for what mainstream browsers accept, since they draw from similar roots, but it is not identical to any one browser's store — root programmes add and remove roots on their own schedules. Treat a positive result as strong evidence and a negative one as worth confirming elsewhere.
Start by establishing whether the chain is complete, since a missing intermediate produces an untrusted result that looks like an authority problem. Compare against a second resolver or browser to see whether it is specific to this store. If the chain is genuinely broken, fix the server's chain; if the authority is genuinely untrusted, you have a policy decision to make rather than a configuration fix, and you should not make it on the basis of a number this site previously invented.

Related Tools

CA Trust CA Trust Store CA Reputation DB Issuer Identifier Certificate Detail SSL Report