Buying guide
SSL Certificate Warranty Explained: What It Covers (and What It Doesn’t)
An SSL certificate warranty protects your site visitors, not you, and only if the certificate authority made a mistake when it issued the certificate. Here is what the warranty covers, who can claim it and how much weight it deserves when you choose a certificate.
An SSL certificate warranty is a promise from the certificate authority (CA) to the people who rely on your certificate – your site visitors – that it followed its validation rules when it issued it. If the CA was careless, for example by issuing a certificate for your domain to an impostor, and a visitor loses money in an online transaction as a result, that visitor may claim compensation under conditions set by the CA. It does not insure you, your website or your data against hacks.
| Key fact | Detail |
|---|---|
| Official name | Relying-party warranty |
| Who is protected | Relying parties – people who trust the certificate, such as your customers |
| What triggers it | A CA error in validation or issuance (mis-issuance) |
| What it is not | Cyber insurance, a hacking guarantee or a refund promise to you |
| Where the terms live | The CA’s relying party agreement and certification practice statement (CPS) |
Compare warranties side by side
Our comparison lists validation level, domains covered and warranty for every certificate – with live prices.
Compare all certificatesWhat does an SSL warranty actually cover?
It covers financial loss that a relying party suffers because the CA did not use reasonable care when validating and issuing a certificate. Both DigiCert and Sectigo, the two CAs behind the brands we sell, phrase it this way in their relying party agreements: the CA warrants that it followed the validation process in its CPS.
The cover is narrow. Sectigo’s agreement limits a covered loss to a monetary loss from an online financial transaction with the certificate holder, made while relying on a valid, unrevoked certificate. DigiCert’s applies to a fraudulent charge in an online transaction during an SSL/TLS session that the payment provider refused to reverse.
What the warranty does not cover
- Your own losses as the certificate owner – the subscriber is excluded
- Hacks of your server, malware, data breaches or downtime
- Losses where the visitor ignored warnings or did not check that the certificate was valid
- Non-financial harm, such as exposed personal information (DigiCert excludes it explicitly)
- Certificate types excluded by the CA, such as client, code signing or intranet certificates in DigiCert’s agreement
Who can claim the warranty?
Only a relying party who meets every condition in the CA’s agreement – typically a person who paid a site online, trusted its certificate and lost money because the CA mis-issued that certificate. You, as the buyer, cannot claim it.
- Checked that the certificate and its chain were valid, unexpired and not revoked before relying on it
- Relied on it reasonablyno ignored browser warnings or obvious red flags
- Suffered a monetary loss in an online transaction with the certificate holder
- Did not get the money back through a chargeback or refund
- Filed a written claim within the CA's deadline (30 days at Sectigo, 60 days at DigiCert)
- Accepted the CA's relying party agreement and its arbitration terms
Does a higher SSL certificate warranty mean better security?
No. The warranty amount says nothing about encryption strength. A DV, OV and EV certificate from the same CA use the same key sizes and TLS protocols; the higher warranty that comes with OV and EV SSL certificates reflects the deeper identity checks, not stronger protection for your traffic.
DigiCert’s agreement even tells relying parties not to rely on domain-validated certificates for identity, because a DV certificate confirms only domain control. The larger warranty on OV and EV products is the CA’s way of standing behind the organization details it verified.
| What you want | What actually delivers it |
|---|---|
| Strong encryption | Any publicly trusted certificate plus a modern TLS configuration |
| Verified company identity in the certificate | OV or EV validation |
| Protection against hacks and malware | Patching, a web application firewall and malware scanning |
| Cover for your own losses | Cyber insurance, not a certificate warranty |
| Feature | Comodo Domain Validated UCC SSL | Comodo Elite SSL | Comodo Enterprise SSL | Comodo Enterprise SSL Pro | Comodo Enterprise SSL Pro Wildcard |
|---|---|---|---|---|---|
| Domains included | 3 | 1 | 1 | 1 | 1 wildcard domain |
| Domains covered | 3 hostnames (e.g. mail, autodiscover, webmail), expandable to 250 | example.com and www.example.com | example.com and www.example.com | example.com and www.example.com | example.com and *.example.com |
| SAN support | Yes | No | No | No | No |
| Additional domains (SAN) | 247 | 0 | 0 | 0 | 0 |
| Multi-domain | Yes | No | No | No | No |
| Subdomains | Specific subdomains listed as SANs | Not included | Not covered (www only) | Not covered (www only) | Unlimited first-level subdomains |
| Issuance time | Minutes | 1–3 business days | 1–3 business days | 1–3 business days | 1–3 business days |
| Warranty | $250,000 | $750,000 | $1,500,000 | $1,500,000 | $1,500,000 |
| Encryption | 256-bit, RSA 2048+/ECC | 256-bit, RSA 2048+/ECC | 256-bit, RSA 2048+/ECC | 256-bit, RSA 2048+/ECC | 256-bit, RSA 2048+/ECC |
| Supported servers | Microsoft Exchange, Office Communications Server, IIS, Apache, Nginx | All major web servers, panels and CDNs | All major servers (Apache, Nginx, IIS, cPanel, Plesk) | All major servers, load balancers and CDNs | All major servers, load balancers and containers |
| Browser compatibility | 99%+ of browsers and devices | 99%+ of browsers and devices | 99%+ of browsers and devices | 99%+ of browsers and devices | 99%+ of browsers and devices |
| Reissue | Unlimited free reissues | Unlimited free reissues | Unlimited free reissues | Unlimited free reissues | Unlimited free reissues |
| Validity period | 1–5 year plans (subscription with reissues) | 1–5 year plans (subscription with reissues) | 1–5 year plans (subscription with reissues) | 1–5 year plans (subscription with reissues) | 1–5 year plans (subscription with reissues) |
| Recommended for | Small to mid-sized businesses | Mid-sized and large businesses | Small to mid-sized businesses | Mid-sized to large organizations | Mid-sized to large organizations |
| Organization validation | No | Yes | Yes | Yes | Yes |
| Wildcard | No | No | No | No | Yes |
| Price | from $89.60 / yearView product | from $87.20 / yearView product | from $237.80 / yearView product | from $615.20 / yearView product | from $1,055.20 / yearView product |
Has anyone ever claimed an SSL warranty?
We do not know, and neither does anyone outside the CAs. No certificate authority publishes figures on warranty claims or payouts, and we have found no public record of a paid claim. Any statement that warranties are “never” or “often” paid out is a guess.
What is clear from the agreements is how hard a claim would be: the loss must come from CA mis-issuance, the visitor must have checked the certificate’s status, the money must be unrecoverable through the bank, and strict deadlines apply.
How much should warranty matter when you choose a certificate?
Treat the warranty as a side effect of the validation level, not as a reason to buy. Choose DV, OV or EV by how much identity you need to show, then the number of domains, then the brand – and compare all SSL certificates on those three points. Warranty also does not explain price differences on its own – our guide on how much an SSL certificate costs covers what you actually pay for.
Tip: If a seller uses a large warranty figure as its main argument, ask what validation the certificate includes. That is the part that protects your visitors day to day.
Choose by validation, not warranty
See every DV, OV and EV certificate with validation level, coverage and warranty in one table.
See the full comparison