SSL certificates can be valid for at most 199 days. By 15 March 2027 the limit becomes 99 days, for DigiCert certificates from 24 February 2027. Read more →

SSL Certificates

SSL certificate Cheap SSL DV SSL Wildcard SSL Multi-Domain (SAN) OV & EV SSL

Specialty Certificates

Code Signing Document Signing Email / S/MIME VMC / BIMI
View all products
In effect now Certificate Lifetime

Automation

Overview AutoDNS FairSSL vs Let's Encrypt

Platforms

Windows Setup Linux & Kubernetes Appliances ACME Clients

Tools

SSL Scanner Certificate Decoder CAA Generator

Guides

Windows Server Linux & Open Source All guides

Company

About Us Contact Installation Service
News

Language

Dansk Svenska English

Currency

Login Create Account
Sectigo

Sectigo PositiveSSL

DV Max 199 days 99 days from 12 March 2027

Simple SSL certificate with flexible automated validation methods

Validation
Domain Validation
Type
Single domain
Certificate Authority
Sectigo
256-bit encryption Free reissuance Root compatibility Windows Root Store The root is included from 2023 With 1 Cross-Sign the root is included from 2010 Microsoft's root store. It updates automatically on every supported Windows version. For older clients to validate, the server has to send the cross certificate on top of the ordinary intermediate. On Windows Server, Server Authentication also has to be turned off for the new root on the server: otherwise Schannel builds the short chain to the new root and the cross certificate is never sent.Apple Root Store The root is included from 2025 With 1 Cross-Sign the root is included from 2010 Apple's root store in iOS and macOS. It follows the operating system version, so older devices never receive new roots. For older clients to validate, the server has to send the cross certificate on top of the ordinary intermediate. On Windows Server, Server Authentication also has to be turned off for the new root on the server: otherwise Schannel builds the short chain to the new root and the cross certificate is never sent.Android Root Store The root is included from 2025 With 1 Cross-Sign the root is included from 2010 Android's built-in root store. It follows the Android version, and older phones rarely receive new roots. For older clients to validate, the server has to send the cross certificate on top of the ordinary intermediate. On Windows Server, Server Authentication also has to be turned off for the new root on the server: otherwise Schannel builds the short chain to the new root and the cross certificate is never sent.Linux Root Store The root is included from 2024 With 1 Cross-Sign the root is included from 2010 The Mozilla NSS bundle, shipped by Debian, Ubuntu and RHEL as ca-certificates. For older clients to validate, the server has to send the cross certificate on top of the ordinary intermediate. On Windows Server, Server Authentication also has to be turned off for the new root on the server: otherwise Schannel builds the short chain to the new root and the cross certificate is never sent.Java Root Store The root is included from 2025 With 1 Cross-Sign the root is included from 2010 The Java cacerts file. It follows the Java update installed on the server. For older clients to validate, the server has to send the cross certificate on top of the ordinary intermediate. On Windows Server, Server Authentication also has to be turned off for the new root on the server: otherwise Schannel builds the short chain to the new root and the cross certificate is never sent.8.1of 10Requires 1 Cross-SignCovered by the root certificate itselfCovered through one cross-signed certificate

About Sectigo PositiveSSL

Sectigo PositiveSSL is the former Comodo Positive SSL, a simple certificate with flexible validation methods, using e-mail, DNS CNAME and HTTP/HTTPS.

This product is one of the only products we have found, that add a Critical attribute to the Basic Constraints CA:False parameter, which is required possibly due to a bug, by some versions of Cisco Firepower Management Center (FMC), Cisco Firepower 7000/8000 series. We therefore highly recommend using this product for your Cisco needs. The critical attribute is normally not needed on the Basic Constraints CA:False, therefore most CA's do not add it and there is no way to easily "add" it to their products.

If the certificate is ordered as www. first, the name without www. will automatically be added.

Note - Sectigo has changed root certificate the 2nd of June 2025.
All certificates issued from this date will be from the new root CA certificates and issued with SHA2-384 hashing algorithm.
For more information click here.

Reissue schedule

Certificates must be reissued before they expire within the order period. The timeline shows when each reissue is needed.

1 year

Order: 1 year
↓ 99-day cap
199d
99d
67d
€
Oct 2026
Issue and install
Apr 2027
Reissue and install
Aug 2027
Reissue and install
€
Oct 2027
Renew order
+ issue new cert.

from

€44€22 /year excl. VAT
Buy Sectigo PositiveSSL Compare certificates
  • 14-day full refund
  • Free phone support
  • No hidden fees
  • Unlimited server installation

Ready to create a free account?

Create a free account and order your first certificate. A DV certificate is issued in under 2 minutes.

Create free account Compare certificates