SSL.com Root Certificates, Cross-Signing, and Legacy Device Compatibility

Most SSL.com customers need to do nothing: certificates chain to SSL.com’s self-signed root, which over 99.9% of browsers, tablets, and mobile devices already trust. Only customers serving very old devices need special chain configuration, and SSL.com Support handles those cases one by one. 

Key takeaways 

• SSL.com’s self-signed root is widely trusted. The SSL.com root issued in February 2016 ships in all major browsers and certificate stores. SSL.com certificates are accepted by over 99.9% of browsers, tablets, and mobile devices. 

• The legacy Certum cross-signed root expired on September 11, 2023. Asseco Data Systems (Certum) created it to cross-sign SSL.com’s 2016 root. Updated devices ignore the expired certificate and build the chain to the SSL.com root. 

• Existing certificates stay valid. You do not need to reissue or reinstall a certificate because the cross-signed root expired. The SSL.com self-signed roots your certificates chain to do not expire until 2041. 

• Older devices may need help. Devices with root stores older than the 2016 root’s inclusion may not trust the SSL.com root on their own. If you serve these devices, contact SSL.com Support for chain configuration guidance. 

• Most trust errors come from a missing intermediate. Install the full chain your certificate order provides: your certificate plus the SSL.com intermediate certificate. 

SSL.com’s root certificate hierarchy 

Every SSL.com certificate chains up to an SSL.com root through an intermediate certificate. The SSL.com root signs the intermediate, and the intermediate signs your certificate.    SSL.com DV/OV chain of trust · 3 links, plus the expired Certum cross-certificate  Until September 11, 2023, older devices could also reach the SSL.com root through a Certum cross-certificate. That link has expired, so devices now trust the chain only through the SSL.com root in their own root store. 

Chains by certificate type 

Certificate type	Root	Intermediate
Domain Validated (DV) and Organization Validated (OV)	SSL.com Root Certification Authority RSA	SSL.com RSA SSL subCA
Extended Validation (EV)	SSL.com EV Root Certification Authority RSA R2	SSL.com EV SSL Intermediate CA RSA R2

Source: SSL.com Root Certificates. Certificates issued on or after May 5, 2026 chain to SSL.com’s 2022 roots instead; see the FAQ. 

Cross-signing and the Certum root expiration 

The Certum cross-signed root expired on September 11, 2023. This is a normal event in a root CA’s lifecycle and does not affect devices with an updated root store. 

What a cross-signed root is 

A cross-signed root certificate is issued by one certificate authority (CA) to vouch for another CA’s root. Devices that trust the first CA can then trust the second CA’s root through that link. Cross-signing lets a newer root work on older systems that do not yet include it in their trust store. 

Why SSL.com had a Certum cross-signed root 

When SSL.com created its root in 2016, older devices did not have it in their root stores yet. Asseco Data Systems (Certum) issued a cross-certificate for the 2016 SSL.com root, so those devices could reach a root they already trusted. The cross-certificate was issued by Certum Trusted Network CA and expired on September 11, 2023. 

Why the expiration does not affect most customers 

• The SSL.com root is now in the root stores. Devices from roughly the last 7 to 8 years ship with SSL.com roots in their default trusted root store. 

• Path building skips the expired link. During standard X.509 path building, a device ignores the expired cross-certificate and finds a valid chain to the SSL.com root. 

• The chain is shorter. Removing the cross-certificate drops one link from the chain, which improves SSL/TLS performance. 

Device and browser compatibility 

SSL.com certificates are accepted by over 99.9% of browsers, tablets, and mobile devices. Updated browsers trust the self-signed SSL.com root even on devices that are older than 2016. 

Where the SSL.com root is trusted 

SSL.com’s compatibility testing shows the 2016 root as trusted on these platforms. The full list of tested browser versions is on the SSL.com Certificate Compatibility page. 

Android	Android 9 through 13
iOS	iOS 12 through 16
macOS	High Sierra through Sonoma, with Safari, Chrome, Firefox, Edge, and Opera
Platform	Versions tested as trusted
Windows	Windows 7, 8, 8.1, 10, 11, and Windows Server 2019, with current Edge, Chrome, Firefox, and Opera

Devices that may be affected 

A device may fail to trust an SSL.com certificate when its root store predates the inclusion of the 2016 SSL.com root and has not been updated since. Typical examples: 

• Operating systems that no longer receive root store updates, such as Windows XP, Windows 7, and Windows 8 

• Older browsers that are no longer updated 

• Embedded devices, IoT devices, and appliances with a fixed root store 

• Legacy Java runtimes and other applications that ship their own trust store 

On Windows XP, Windows 7, and Windows 8, SSL.com’s testing found that some browsers may not establish trust for the root. 

How to tell if this affects you 

• Modern browsers report no errors, but some users or devices do. This points to an outdated root store on the failing devices. 

• Errors appear on every device. This usually means the server is missing the intermediate certificate, not a root problem. See the next section. 

What to do 

Install the complete certificate chain, check it with a scanner, and contact support only if older devices still fail. 

1. Install the full chain on your server 

1. Download the root and intermediate certificates from your certificate order page, where you downloaded your SSL/TLS certificate. They are also on the SSL.com Repository page. 

1. Install the intermediate certificate on your server with your SSL/TLS certificate. Apache users who manage certificates in a configuration file can point SSLCertificateChainFile to the CA bundle file. 

1. Restart the web server. 

1. On some Windows servers, change the IIS binding to a different certificate and then back to the SSL.com certificate, so IIS picks up the new chain. Older servers may need a full IIS restart. 

Instructions for popular web servers: How Do I Install a Certificate? 

2. Test the connection 

Check your site with a third-party SSL checker, such as the SSL Shopper SSL Checker. Confirm that the chain is complete and that no expired certificates are being served. 

3. Remove the expired Certum cross-certificate (if present) 

If your server or a Windows trust store still holds the expired cross-certificate, remove it: 

1. Open Microsoft Management Console (MMC). 

1. Select File > Add/Remove Snap-in. 

1. Select Certificates, choose Computer account, then select Next > Finish > OK. 

1. Right-click Certificates (Local Computer) and select Find Certificates. 

1. In Contains, type Certum and select Find Now. 

1. Right-click the SSL.com certificate issued by Certum Trusted Network CA that expires on 9/11/2023, and select Delete. 

Then restart your web server. If the chain is still wrong, reinstall the intermediate certificate and the SSL.com root. As a last step, reprocess your certificate and install the new issuance with its chain. 

4. Contact support for older devices 

If you must serve devices whose root stores predate the 2016 SSL.com root, contact SSL.com Support for chain configuration guidance. Include the following in your request: 

• Your certificate order number and domain 

• The device types, operating systems, and versions that fail 

• The exact error message the devices show 

• Your web server software and version 

Reach SSL.com Support by email at support@ssl.com, by phone at 1-877-SSL-SECURE, or through the chat link on ssl.com. 

Frequently asked questions 

Are certificates issued before September 11, 2023 still trusted? 

Yes. Your certificate stays valid until its own expiration date. Devices build a chain to the SSL.com self-signed root, which all major browsers and certificate stores trust. 

Do I need to reissue or reinstall my certificate because the Certum cross-signed root expired? 

In most cases, no. Trust stores usually find the correct path on their own. On some older platforms you may need to restart the web server, remove the expired cross-certificate, reinstall the intermediate and root, or reprocess the certificate. 

When does the SSL.com root expire? 

The SSL.com self-signed roots that your certificates chain to do not expire until 2041. 

What does SSL.com’s move to the 2022 roots change? 

SSL.com moved certificate issuance from its 2016 roots to new 2022 roots on May 5, 2026. For standard HTTPS server authentication, nothing changes for you. If your systems rely on the Client Authentication EKU in TLS certificates, or are pinned to the 2016 roots, read What SSL’s Root Migration Means for You and contact SSL.com. 

Can I install the old Certum cross-signed root to support older devices? 

No. That cross-certificate expired on September 11, 2023 and no longer provides a valid path. Contact SSL.com Support for current options for older devices. 

My site works in modern browsers but fails on one older device. What should I check? 

First, confirm that your server sends the full chain (see What to do). If the chain is correct, the device’s root store likely predates the 2016 SSL.com root. Update the device’s operating system or root store if you can; otherwise, contact SSL.com Support.