TLS certificate issuer

The certificate authority that signed the certificate — who to go to when a renewal fails, and a way to tell that the certificate is the one your own automation issued.

• Help center

Every certificate names the certificate authority (CA) that signed it. The report shows the common name of the issuing certificate: for example R11 or E6 for Let's Encrypt, WE1 for Google Trust Services, or a Sectigo, DigiCert or GlobalSign name. It is the name of the intermediate that signed your certificate, which is not always the brand you bought from.

Why it matters

• Renewal problems. When a certificate fails to renew, the issuer tells you where to look: your ACME client for Let's Encrypt or ZeroSSL, the CDN or hosting panel for a certificate they manage, the reseller account for a paid one.
• Surprises. If your own Certbot is supposed to issue the certificate but the row names a CDN's CA, TLS ends somewhere else — a proxy, a hosting panel or a forgotten load balancer — and that is where renewal happens.
• CAA. If the domain publishes a CAA record, the issuer has to be on its list, or the next issuance will be refused.

What the row means

The row is informational and is shown as fine whenever a certificate was read: the scan's own connection already validated it. Compare the name with what you expect, and update CAA and your monitoring when you switch authorities.