Find Companies Using Sectigo SSL Certificates (API)

Most technographic signals tell you what software a company runs. A certificate authority tells you something different and often more useful: that somebody at the company signed a purchase order. Sectigo certificates are bought, not auto-issued, which means every domain on a Sectigo list has a renewal cycle, an internal owner, and a budget line that recurs.

The signal is also trivially cheap to collect. The certificate is presented during the TLS handshake, before a single byte of HTML is served, so you can read it without rendering the page, without JavaScript, and even when the site blocks your request outright. This guide covers what the Sectigo issuer string actually looks like, how DetectZeStack turns it into a detection, how to check one domain and then a list of them, and the one redirect behavior that will make two endpoints disagree if you do not plan for it. Every response below came from a live scan run while writing this post.

Why Find Companies Using Sectigo?

Three groups get different value from the same list.

Security and PKI vendors. If you sell certificate lifecycle management, key discovery, or a competing CA, a Sectigo deployment is a live procurement signal. The company already accepted that certificates are a purchased good with an expiry date attached, which is the hardest part of the sale. The renewal date is public — it is printed on the certificate — so the timing is public too.

Sales and partnerships more broadly. The validation level embedded in the certificate is a free firmographic. An OV or EV certificate carries the legal entity name, locality, province, and country in the subject field. That is verified registration data, checked by the CA at issuance, sitting in a field anyone can read.

Engineering and infrastructure teams. If you are auditing a supplier list, an acquisition target, or your own sprawling domain portfolio, the CA and expiry date together tell you which properties are on a manual renewal treadmill and which are on automated free issuance. The manual ones are where outages come from.

What Sectigo Is and What Its Certificates Signal

Sectigo is a commercial certificate authority, formerly Comodo CA, headquartered in the UK. It issues the full range of publicly trusted TLS certificates — domain validated, organization validated, and extended validation — and it is one of the highest-volume commercial CAs on the public web.

For detection purposes, the useful fact is that Sectigo stamps its own name into the issuer field of every certificate it signs. The issuer organization is Sectigo Limited, the country is GB, and the issuer common name is a versioned intermediate from the Sectigo Public Server Authentication CA family. Here is what github.com presented on the day of writing:

$ echo | openssl s_client -connect github.com:443 -servername github.com 2>/dev/null \
  | openssl x509 -noout -issuer
issuer=C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication CA DV E36

That is the whole fingerprint. No page fetch, no cookies, no JavaScript execution.

Sectigo vs Free CAs: What the Choice Tells You About a Company

The certificate authority landscape splits cleanly into two economics. Let’s Encrypt issues free 90-day certificates through an automated protocol. The large cloud providers do something similar inside their own platforms: Amazon issues certificates free to AWS customers, Google Trust Services does the same for Google Cloud and Google Domains properties, and Cloudflare issues its own edge certificates at no cost. None of those choices required anyone to open a wallet.

Commercial CAs are the other half. A survey of certificates across a handful of well-known domains during this scan shows how mixed the real distribution is:

Note the two-character issuer common names on the free CAs — YE1, WE1 — against the descriptive product names on the commercial ones. That is a stylistic tell, but do not detect on it. Match the issuer organization.

The validation level sharpens the signal further. A DV certificate proves only that someone controlled the domain, so its subject contains a hostname and nothing else. An OV or EV certificate embeds the verified legal entity. Compare the subject on github.com, which is DV, against namecheap.com, which is EV:

github.com    subject: { "common_name": "github.com" }

namecheap.com subject: {
  "common_name": "www.namecheap.com",
  "organization": ["Namecheap, Inc."],
  "country": ["US"],
  "province": ["Arizona"]
}

The second one is a verified company record you did not have to buy.

How DetectZeStack Detects Sectigo

TLS Certificate Chain Inspection (source: tls)

DetectZeStack completes a TLS handshake with the target, takes the leaf certificate, reads the first entry of the issuer’s organization field, and matches that string case-insensitively against a table of known certificate authorities. Eight issuers are mapped, and they land in three different categories:

The bottom four are worth understanding even if you only care about Sectigo, because they are why a certificate detection sometimes shows up as infrastructure rather than as a CA. A certificate issued by Google Trust Services is reported as Google Cloud under Cloud hosting, not as a certificate authority, because the more useful inference from that issuer is where the site is hosted.

This runs on every scan alongside the HTTP and DNS detection, so you never have to ask for it separately. It is also the reason a scan of a site that blocks you still returns something — more on that below.

Why Sectigo Reports Confidence 70 and Not 100

Every technology inferred from the certificate chain carries "confidence": 70 and "source": "tls". Technologies matched from headers, cookies, or page body carry 100 with "source": "http". The 70 is a fixed marker for the source, not a per-domain probability, so it is identical on every Sectigo result you will ever see.

Detect Sectigo on a Single Domain with /analyze

The fastest way to see the response shape is the public /demo endpoint. No API key, no signup, 20 requests per hour per IP:

$ curl -s "https://detectzestack.com/demo?url=github.com" | jq '.'
{
  "url": "https://github.com",
  "domain": "github.com",
  "technologies": [
    {
      "name": "React",
      "categories": ["JavaScript frameworks"],
      "confidence": 100,
      "description": "React is an open-source JavaScript library for building user interfaces or UI components.",
      "website": "https://reactjs.org",
      "icon": "React.svg",
      "cpe": "cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*",
      "source": "http"
    },
    {
      "name": "Sectigo",
      "categories": ["SSL/TLS certificate authority"],
      "confidence": 70,
      "source": "tls"
    }
  ],
  "categories": {
    "CDN": ["Amazon S3"],
    "CMS": ["Contentful"],
    "JavaScript frameworks": ["React"],
    "PaaS": ["Amazon Web Services", "GitHub Pages"],
    "SSL/TLS certificate authority": ["Sectigo"],
    "Security": ["HSTS"]
  },
  "meta": {
    "status_code": 200,
    "tech_count": 7,
    "scan_depth": "full"
  },
  "cached": false,
  "response_ms": 1842
}

Five of the seven technologies are trimmed from the technologies array above to keep the listing readable; the categories object shows all of them. Notice that the Sectigo entry has no description, website, or icon — those fields come from the HTTP fingerprint database and are simply absent on TLS-sourced entries, so code that reads them must tolerate their absence.

Reading the SSL/TLS certificate authority Category in the Response

Do not scan the technologies array for a name match. Read categories["SSL/TLS certificate authority"], which is a list, and test for membership. Against a live key the same call looks like this:

$ curl -s "https://detectzestack.p.rapidapi.com/analyze?url=namecheap.com" \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: detectzestack.p.rapidapi.com" \
  | jq '{domain, ca: .categories["SSL/TLS certificate authority"],
         status: .meta.status_code, tech_count: .meta.tech_count,
         depth: .meta.scan_depth, cached, response_ms}'
{
  "domain": "www.namecheap.com",
  "ca": ["Sectigo"],
  "status": 403,
  "tech_count": 4,
  "depth": "full",
  "cached": false,
  "response_ms": 335
}

That 403 is the interesting part. Namecheap runs Cloudflare Bot Management and refused to serve the page to the scanner, so almost nothing was detected from the HTML — and Sectigo came back anyway. The TLS handshake completes before the HTTP status code exists, which makes certificate-authority detection the single most block-resistant signal in the response. Never treat a non-200 as a reason to discard the CA field.

When a boolean is all you need, /check returns a much smaller object:

$ curl -s "https://detectzestack.p.rapidapi.com/check?url=namecheap.com&tech=Sectigo" \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: detectzestack.p.rapidapi.com"
{
  "domain": "www.namecheap.com",
  "technology": "Sectigo",
  "detected": true,
  "confidence": 70,
  "version": "",
  "categories": ["SSL/TLS certificate authority"],
  "response_ms": 0,
  "cached": true
}

The version field is always empty for a certificate authority — there is no such thing as a version of Sectigo — and response_ms: 0 above is a cache hit from the /analyze call a moment earlier.

Pull Full Issuer Details with /certificate/check

/analyze tells you the CA is Sectigo. /certificate/check tells you which Sectigo product, when it expires, what it was signed with, and what the chain above it looks like. There is a public demo for it too, at /demo/certificate, sharing the same 20-per-hour IP budget:

$ curl -s "https://detectzestack.com/demo/certificate?url=github.com" | jq '.'
{
  "domain": "github.com",
  "ip": "140.82.114.3",
  "port": 443,
  "tls": {
    "version": "TLS 1.3",
    "cipher_suite": "TLS_AES_128_GCM_SHA256",
    "negotiated_protocol": ""
  },
  "certificate": {
    "subject": { "common_name": "github.com" },
    "issuer": {
      "common_name": "Sectigo Public Server Authentication CA DV E36",
      "organization": ["Sectigo Limited"],
      "country": ["GB"]
    },
    "serial_number": "A5:9E:BD:B5:96:75:1D:B7:F5:C0:95:07:96:13:95:3C",
    "version": 3,
    "not_before": "2026-09-01T00:00:00Z",
    "not_after": "2026-11-29T23:59:59Z",
    "days_remaining": 81,
    "is_expired": false,
    "signature_algorithm": "ECDSA-SHA256",
    "public_key": { "algorithm": "ECDSA", "bit_length": 256 },
    "san_domains": ["github.com", "www.github.com"],
    "ocsp_servers": ["http://ocsp.sectigo.com"],
    "issuing_certificate_url": [
      "http://crt.sectigo.com/SectigoPublicServerAuthenticationCADVE36.crt"
    ]
  },
  "chain": [
    {
      "subject": "Sectigo Public Server Authentication CA DV E36",
      "issuer": "Sectigo Public Server Authentication Root E46",
      "is_ca": true,
      "not_after": "2036-03-21T23:59:59Z",
      "signature_algorithm": "ECDSA-SHA384"
    },
    {
      "subject": "Sectigo Public Server Authentication Root E46",
      "issuer": "USERTrust ECC Certification Authority",
      "is_ca": true,
      "not_after": "2038-01-18T23:59:59Z",
      "signature_algorithm": "ECDSA-SHA384"
    }
  ],
  "has_tls": true,
  "response_ms": 0
}

Several fields are omitted from the certificate object above for length; the endpoint also returns san_ips, san_emails, key_usage, ext_key_usage, is_ca, crl_distribution_points, subject_key_id, and authority_key_id. Authenticated callers use the same shape at /certificate/check?url=.

Issuer Common Name, Organization, and Chain Entries

Three fields carry most of the value.

certificate.issuer.organization[0] is the string the detection matches on. It is "Sectigo Limited" on every Sectigo certificate regardless of product, which is why substring matching on Sectigo is safe.

certificate.issuer.common_name is the specific intermediate, and it encodes the product tier. Compare the three Sectigo domains scanned for this post: github.com presented Sectigo Public Server Authentication CA DV E36, gitlab.com presented Sectigo Public Server Authentication CA DV R36, and namecheap.com presented Sectigo Public Server Authentication CA EV R36. The DV or EV is the validation level, and the trailing E or R distinguishes the elliptic-curve hierarchy from the RSA one — which is why github.com’s key is ECDSA 256 while namecheap.com’s is RSA 2048.

chain gives you the path upward. Sectigo’s intermediates roll up to a Sectigo Public Server Authentication Root and then to a USERTrust root, the legacy hierarchy Sectigo inherited from its Comodo days. Namecheap’s RSA chain shows the parallel structure: Sectigo Public Server Authentication CA EV R36 under Sectigo Public Server Authentication Root R46 under USERTrust RSA Certification Authority.

Scan a Prospect List with /analyze/batch

POST /analyze/batch accepts up to 10 URLs per request and scans them concurrently. Each item in results carries either a result object in the single-domain shape or an error string, and the envelope adds successful, failed, and total_ms. A three-domain run:

$ curl -s -X POST "https://detectzestack.p.rapidapi.com/analyze/batch" \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: detectzestack.p.rapidapi.com" \
  -H "Content-Type: application/json" \
  -d '{"urls":["namecheap.com","zoom.us","nginx.com"]}' \
  | jq '{successful, failed, total_ms,
         rows: [.results[] | {url,
           domain: .result.domain,
           ca: .result.categories["SSL/TLS certificate authority"],
           status: .result.meta.status_code}]}'
{
  "successful": 3,
  "failed": 0,
  "total_ms": 2766,
  "rows": [
    { "url": "namecheap.com", "domain": "www.namecheap.com",
      "ca": ["Sectigo"], "status": 403 },
    { "url": "zoom.us", "domain": "zoom.us",
      "ca": ["DigiCert"], "status": 200 },
    { "url": "nginx.com", "domain": "www.f5.com",
      "ca": ["Sectigo"], "status": 200 }
  ]
}

Three domains, three CAs read, in under three seconds — and one of them was actively blocking the scanner. The domain field differing from the requested url is the redirect behavior described above; keep both columns so you can tell whose certificate you actually measured.

To run this over a real list, chunk the file into tens and write a CSV:

#!/usr/bin/env bash
# find-sectigo.sh - build a Sectigo prospect list from domains.txt
KEY="YOUR_KEY"
HOST="detectzestack.p.rapidapi.com"

echo "requested,resolved,ca,status,tech_count" > sectigo.csv
: > sectigo_retry.txt

# 10 URLs per request is the /analyze/batch maximum
xargs -n 10 < domains.txt | while read -r batch; do
  urls=$(printf '%s\n' $batch | jq -R . | jq -s '{urls: .}')
  resp=$(curl -s -X POST "https://$HOST/analyze/batch" \
    -H "X-RapidAPI-Key: $KEY" \
    -H "X-RapidAPI-Host: $HOST" \
    -H "Content-Type: application/json" \
    -d "$urls")

  # One row per domain where the handshake succeeded
  echo "$resp" | jq -r '.results[]
    | select(.result != null)
    | . as $item
    | $item.result as $r
    | [
        $item.url,
        $r.domain,
        (($r.categories["SSL/TLS certificate authority"] // []) | join(";")),
        ($r.meta.status_code | tostring),
        ($r.meta.tech_count | tostring)
      ] | @csv' >> sectigo.csv

  # Errors and DNS-only scans are unknown, not negative
  echo "$resp" | jq -r '.results[]
    | select(.error != null or .result.meta.scan_depth == "partial")
    | .url' >> sectigo_retry.txt

  sleep 1
done

echo "Sectigo hits: $(grep -c ',"Sectigo"' sectigo.csv)"

The retry file matters. A scan_depth of "partial" means only DNS resolved — no TLS handshake happened, so no certificate was read. Recording that as "not Sectigo" silently poisons the list. A 403 with a CA present, by contrast, is a perfectly good row.

Build a List of Companies Using Sectigo with /lookup

Everything above works forward: you supply a domain and get its stack. /lookup runs backward, taking a technology name and returning domains from DetectZeStack’s snapshot database that were seen using it:

$ curl -s "https://detectzestack.p.rapidapi.com/lookup?tech=Sectigo&limit=5" \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: detectzestack.p.rapidapi.com"
{
  "technology": "Sectigo",
  "total": 157,
  "limit": 2,
  "offset": 0,
  "results": [
    {
      "domain": "us.ovhcloud.com",
      "category": "SSL/TLS certificate authority",
      "confidence": 70,
      "version": "",
      "first_seen": "2026-05-25T19:47:20Z",
      "last_seen": "2026-09-09T18:02:09Z"
    },
    {
      "domain": "swazimobile.com",
      "category": "SSL/TLS certificate authority",
      "confidence": 70,
      "version": "",
      "first_seen": "2026-05-25T19:47:54Z",
      "last_seen": "2026-09-09T18:02:05Z"
    }
  ],
  "response_ms": 11
}

Two details to read carefully. total is the full count of matching domains in the database — 157 at the time of this call — and it is not capped by your plan. limit is, and the response echoes back the clamped value: the request above asked for 5 and got 2, because that call used a free-tier key. The per-call row caps are:

Page through with offset to walk past the per-call cap. The first_seen and last_seen timestamps are the useful extra here: a domain whose first_seen is months old and whose last_seen is yesterday has been on Sectigo continuously, which is a renewal relationship rather than a one-off.

Common Stack Patterns Around Sectigo Certificates

A CA rarely tells the whole story, and the technologies that sit next to it change what the detection means.

Sectigo with a CDN in front. The namecheap.com scan returned Cloudflare under CDN, Cloudflare Bot Management under Security, and Sectigo under certificate authority in the same response. That combination means the origin certificate is Sectigo’s while an edge sits in front — two vendors, two contracts, two renewal calendars.

Sectigo on a platform that usually issues its own. When a site is clearly on AWS or Google Cloud but presents a Sectigo certificate, someone deliberately declined the free option. That is usually a compliance requirement or a corporate PKI standard, and it is a strong qualifier if you sell into either.

Sectigo EV with a filled subject. The presence of subject.organization, subject.province, and subject.country tells you the certificate is OV or EV, which costs meaningfully more than DV. It also hands you the verified legal entity name for free.

A short days_remaining. The days_remaining field is a countdown to a purchasing decision. Commercial certificates near expiry are the moment a competing CA or a lifecycle-management product is most relevant, and the date is printed on the certificate for anyone to read.

Rate Limits and Plans

The /demo and /demo/certificate endpoints share a budget of 20 requests per hour per IP with no signup, which is enough to confirm the response shape against domains you already know. For lists and anything you want to re-run next quarter, the free RapidAPI plan includes 100 requests per month with no credit card. Paid plans start at $9 per month for 1,000 requests, then $29 for 10,000 and $79 for 50,000. Certificate-chain inspection runs on every scan at every plan level, alongside header, cookie, and DNS detection, so Sectigo and the rest of the stack come back in the same call.

Conclusion

Sectigo is detected from one string: the issuer organization on the leaf certificate, which reads Sectigo Limited on every certificate the CA signs. It lands under the SSL/TLS certificate authority category at confidence 70 with source tls, and because the handshake completes before any HTTP response exists, it survives the 403s and bot challenges that hide everything else about a site. For one domain, openssl s_client or /demo answers the question in a second. For the full picture — product tier, expiry countdown, chain, and the legal entity on an EV certificate — use /certificate/check. For a list, /analyze/batch handles 10 domains per call and /lookup works backward from the technology to the domains. The one rule to encode: a partial scan is unknown, a 403 with a CA is a good row, and the domain you requested is not always the domain whose certificate you measured.