ACME SSL certificate providers

Actalis SSL

ACME and TLS certificates from an Italian certificate authority

ItalyEUEU hostedFree plan Ownership reviewed, controller unresolved

Scope verdict

Ownership reviewed, controller unresolved

Actalis S.p.A. is registered in Bergamo under 03358520967, REA 436479, at Via San Clemente 53, 24036 Ponte San Pietro; VAT 03358520967 and paid-up capital EUR 6.3 million. The site identifies a sole shareholder, the CPS names Aruba S.p.A. as holding company, and GLEIF confirms Aruba as direct and ultimate accounting-consolidation parent. Aruba reports natural-person parent exceptions without names or votes. Ultimate control therefore remains unresolved. Supply conditions v2.4 choose Italian law and the Court of Arezzo, subject to the stated Italian consumer-residence exception.

How we classify services

Actalis SSL is a hosted certificate-issuance service operated by Actalis S.p.A., part of the Aruba group. It offers DV, OV and EV server certificates and automated DV issuance through ACME. Free and paid subscriptions support unlimited 90-day ACME DV certificates; wildcard and organization-validated certificates have separate paid quotas. This is a certification service, not open-source CA software for self-hosting.

Annual service coverage does not mean a single certificate lasts a year. The current TLS CPS limits DV/OV/EV validity to 200 days; the shop says annual purchases receive a second certificate at no extra cost. Subscribers generate their own TLS key pairs and submit a certificate-signing request; the CPS says Actalis provides no subscriber-key escrow. These findings concern TLS, not the separate code-signing or S/MIME products.

Pricing

Free: unlimited 90-day DV certificates via ACME; the manual route provides four 90-day DV certificates under the published annual-coverage arrangement. With Warranty Standard, Bronze/Silver/Gold cost EUR 8.50/25/50 per month, or EUR 7/20/40 per month with annual payment, excluding VAT. Higher warranty cover costs extra. Standalone server-certificate headline prices start at EUR 50 for DV, EUR 300 for OV and EUR 450 for EV for first-year coverage; configuration and warranty selection affect the final price.

Data and operations

Infrastructure and email path

Verified operational dependencies, shown separately from ownership and from the service's core data hosting.

Core service hosting

Aruba S.p.A.

Provider control not verified
Observed
TLS CPS section 5.1.1 locates all CA systems in Aruba-owned and managed Italian data centres, with two full PKI sites and a third disaster-recovery site more than 300 km away. This product-specific claim does not locate every shop, supplier or international transfer.

Supporting services

Browser-required Certificate Transparency logs

Provider control not verified
Observed
TLS CPS section 4.3.1 requires precertificates to be submitted to browser-accepted CT logs. Section 9.3.2 treats issued certificates, CRLs and OCSP status as public. The actual log operators used per certificate were not independently enumerated.

Payment processing

PayPal and unnamed card/payment institutions

Provider control not verified
Observed
Supply conditions explicitly describe PayPal and credit-card payment and automatic renewal. The privacy notice identifies payment-institution categories without a complete named provider/region schedule. No transaction or checkout was performed.

Public DNS records identify visible providers and routes, not every backend location or private data-region setting.

Infrastructure checked:

More from Italy