Podcast
Root Causes 461: Sectigo Acquires Entrust Public CA Business
Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
January 29, 2025
Sectigo today announced the acquisition of the Entrust public CA business. Entrust will go forward as a Sectigo reseller. Join us to learn the details.
Podcast Transcript
Lightly edited for flow and brevity.
This is an important podcast. There is a big announcement, and Sectigo recently announced, and we're jumping on this as fast as we can here on the Root Causes podcast, that Sectigo has acquired, has taken over the Entrust public CA business. So what this means is that Sectigo is going to be responsible for public CA operations, for new certificates of all certificate types moving forward in place of Entrust certificates. This includes TLS, S/MIME, code signing and document signing. We're going to be doing all operations. So that will be all validation. So we will be doing organization validation, and also DCV, domain control validation, but it also includes everything else you might expect - issuance, CT logging, revocation, OCSP, CRL, etc. So all of that stuff is now Sectigo for all new certificates moving forward.
Obviously, there are still Entrust certificates that are active, that were issued by Entrust. Those will stay alive. Those are fine. Those will stay in the market for their full term and Entrust is responsible for them. So Entrust will do life cycle like revocation checking and Web Trust audits and things like that for that body of certificates for its national lifespan. But from here on out, everything new is coming from Sectigo and Sectigo is doing all those operations.
So as a reminder, you and I have discussed this in the past, Jay, like we've talked about the Entrust distrust, just let's give them a real quick rundown.
So Entrust came under fire earlier in 2024, in the first half of 2024, and you can look at a series of episodes we wrote about Bugzilla bloodbath and other topics along those lines to get a flavor for what was going on there. There was talk of distrust in the late summer. Entrust was actually distrusted by first Chrome and then Mozilla and Apple and basically effective November 12, 2024, they could not issue a new certificate that would work in all of the major browsers. There's a few episodes you can go listen to if you want details on that. Our Episode 399, Entrust Distrusted, our Episode 409, Mozilla Distrusts Entrust, our Episode 422, New Date for Entrust Distrust. Those are all episodes you can go listen to if you want more detail on the detrust event.
We also didn't manage to put an episode on it because we've been so crazy on other stuff, Jay, but Apple announced a distrust of Entrust certs and what was interesting here is it wasn't only TLS. It also included S/MIME and, email certificates. S/MIME and VMC, verified mark certificates. What that did was because Apple, of course, has a major mail client, that's effective, and that's within Apple's purview. That winds up being a pretty thorough action by the browsers to make Entrust not be a public CA anymore. So go listen to those episodes if you want more detail on all of that but that is the case. Entrust is not moving forward as a public ca on any of these certificate types.
Let's get into a couple details on what this means, like just businesswise for Entrust users. The first thing I mentioned was that your existing Entrust certs are unaffected. If they were issued before those distrust dates, they are fine on the distrusting platforms. The plan of action right now, of record by those platforms is to let those certificates run their full lifespan. Obviously, those browsers control their own technology. They can change their minds later on, but there's no reason to expect they will. I think it's a reasonable expectation to think that those Entrust certificates will live their full lifespan. So if you have those, they're running on a server, you don't have a crisis. You can let those go. Moving forward, though, you will be getting your certificates from Sectigo.
As I mentioned, Entrust is a Sectigo reseller. They will be able to take an order. They will be able to sell you a Sectigo certificate, just like they sold you an Entrust certificate today. If you have a business relationship with Entrust, and if you have a contract with Entrust, if you like to use their storefront, or if you're using their portal, you can continue to do that. Likewise, if you get any certificates, Sectigo certificates, that you do provision through Entrust CLM portal will be manageable in that portal. So if you're using ECS to manage certificates and you start ordering certificates, and Sectigo certificates come you can manage them right inside of ECS the way you do now. So the two companies are trying to make this as seamless as they can for existing customers, just to allow you to keep having CA operations and keep moving forward and not have any real worries about this.
As I mentioned, your existing Entrust certs are unaffected. However, when renewal time comes around, you're not going to be able to get a new renewal from Entrust. Likewise, if you need to replace a cert, you're not going to be able to replace it with a certificate from Entrust because they can't issue new certificates. So at that point, that server or that system or that machine will have to move over to getting a certificate from Sectigo instead. If you want to replace them over the course of the normal annual life cycle, or if you want to go ahead and do something more quickly and do some kind of migration, those options are all available to you, and those are all things that you can do. There's reasons to consider both. Maybe we'll hit that on another podcast. But replacing a renewal will be done.
I would say that if you're an existing Entrust customer, and you're listening this, and you're wondering what does this mean to me, Entrust will be in touch with you, and they're very committed to making sure that this is a good experience for all customers. They will be in touch with you. They will explain any specifics that you need to know, what you need to do but at a high level, I know that both companies are trying to make this absolutely as seamless as they possibly can.
I guess the last thing I want to say just is welcome. If you are an existing Entrust customer and you're coming over to Sectigo and you're joining us, we're very happy to have you. We do have a large global public CA business. We are one of the largest public CAs in the world. We have more than 700,000 businesses who are actively using our certificates in every country in the world we're allowed to sell into. We have a vast global array of large enterprise customers. We have an enterprise certificate lifecycle management platform as well as we have certificate offerings all the way from small business up to the largest of enterprises. So I'm very comfortable that we can fit you in and accommodate your needs, and that we have a service that's right for you, and just welcome. We can't wait to have a relationship with this additional set of enterprises and certificate users and businesses and help you guys succeed in the market. That's what I have to say. Jay, do we want to add anything to that?
I think it's worth saying that you and I, you especially, have been covering this distrust story for a while, since the beginning, and this, to me, sounds like a very positive conclusion to a lot of the events that have been going on, and it's the industry doing the right healthy thing.I agree. I think that’s a great point, Jay. Like, which is from the perspective of the WebPKI, this is a win. We wind up with what people really want is they want digital operations to work, and at the end of the day, this keeps those digital operations working in the most seamless way possible with a highly trustworthy, reliable, compliant, secure solution. It gets everybody to home plate pretty seamlessly. It was a long process. This whole thing from the time that there first started to be talk of distrusting Entrust until now, we're probably looking at an eight month cycle. So this has been going on for a long time, but this announcement hopefully puts a punctuation mark on that, and we can move forward, and all those customers can move forward, settle in with a new CA, move into a new era and be very productive and, just business as usual.Business as usual. That is the most important point of this podcast. Tim, thank you so much for reporting on this important set of facts here.Thank you, Jay. And if we need more detail, we'll record more episodes later, but I think that's the essential thing to know, and this has been Root Causes.Stay informed with expert insights
Subscribe to Root Causes for engaging discussions on PKI, digital security, and best practices for protecting your organization's critical assets. Don’t miss an episode!
