Stack category
European TLS Certificate Authorities
A TLS certificate authority issues the digital certificates that let browsers trust your website — every HTTPS connection starts with the CA's signature on your certificate.
Why this layer matters for sovereignty
Your certificate authority vouches for your identity to every visitor: browsers show its name in the padlock, and a mis-issued or revoked certificate can take your site offline.
Certificate issuance requires validating your domain and often your organization — that validation data (domains, contacts, DNS records) sits with the CA and is personal data under the GDPR.
An eIDAS-qualified European CA is audited under EU rules and keeps the trust chain — and revocation decisions about your domain — under EU jurisdiction.
CA automation is the real risk: ACME-driven issuance means the CA holds an API credential for your DNS, so where it is operated matters as much as where it is incorporated.
What to look for
ACME support with DNS-01 challenges, so issuance and renewal run unattended.
Certificate lifecycle management: renewal reminders, revocation tooling, and CT-log monitoring for your domains.
Qualified certificates (QWAC) if you need eIDAS-regulated proof of identity — mostly relevant for regulated sectors.
Free-tier limits and renewal pricing: many CAs are free for basic DV certificates, but OV/EV tiers vary widely.
European & open-source tls certificate providers
Curated as part of the European Stack Builder. Badges reflect the organization's origin — EU, EEA, EFTA, and UK count as European.
Certificate authority offering free and paid TLS certificates with ACME automation
Qualified German trust service provider and certificate authority from Bundesdruckerei
Deutsche Telekom's certificate authority for enterprise and managed PKI
eIDAS-qualified Italian certificate authority with free and paid SSL certificates
Certificate authority operated by the pan-European GÉANT research network
Frequently asked questions
What is a certificate authority?
A certificate authority (CA) is a trusted organization that issues TLS certificates: it verifies that you control a domain (and, for OV/EV certificates, your organization's identity) and signs your certificate with its root, which browsers and operating systems already trust. Every HTTPS connection your visitors make is validated against that signature chain.
What is the difference between SSL and TLS certificates?
None in practice. SSL (Secure Sockets Layer) is the predecessor protocol of TLS (Transport Layer Security); SSL 3.0 was deprecated in 2015 and every modern HTTPS connection uses TLS 1.2 or 1.3. The certificates are the same X.509 certificates — the industry kept the 'SSL certificate' name out of habit, which is why providers, tools, and search queries still use both terms interchangeably.
Why use a European certificate authority?
Issuing a certificate requires the CA to verify your domain and hold validation records — and revoking one can take your site offline. A European CA processes that data under the GDPR and is supervised by an EU trust-service regulator under eIDAS, so the trust chain of your site stays under European jurisdiction. Several European CAs (ZeroSSL, Actalis, HARICA) also offer free SSL certificates with full ACME automation.
Is Let's Encrypt European?
No. Let's Encrypt is operated by the Internet Security Research Group (ISRG), a US nonprofit, and is the most widely used free certificate authority. Its certificates are excellent for most sites, but the operator is under US jurisdiction — European alternatives with comparable ACME automation include ZeroSSL, Actalis, HARICA, and Buypass.
Pick your TLS Certificate
Compare these providers side by side and assemble your full sovereign stack.
Open the Stack Builder