BIMI CA Market Share 2026: One CA at 85.4%. One at Zero.

The BIMI certificate market added thousands of new certificates in 2025, breaking every prior issuance record. In the same period, the number of effective Certificate Authorities dropped from two to one-and-a-fraction. Entrust — which issued more than 693 BIMI certificates in its peak year — issued 501 in 2025 and zero in 2026. DigiCert, the other founding CA, absorbed the entire market.

This report documents how that happened, what 20227 certificates tell us about where the CA power sits today, and what the arrival of three new entrants (GlobalSign, Sectigo, SSL Corporation) means for the competitive landscape over the next 24 months.

Across all years of recorded BIMI certificate issuance, DigiCert holds 73.6% of all-time volume. Entrust holds 21.9% — certificates that were issued before its exit and that are now running down to expiry. GlobalSign stands at 2.8% of all-time volume, Sectigo at 1%, and SSL Corporation at 0.6%.

Entrust’s cumulative total of 4431 BIMI certificates represents the most consequential forced-migration event in the standard’s history. These certificates are active until their Not After date — but cannot be renewed with Entrust. Every holder must migrate to another CA before expiry or lose their inbox logo.

The expiry distribution is critical for planning. Of the 4431 outstanding Entrust certificates, 4431 have already expired (as of the July 2, 2026 snapshot). The remaining 0 active certificates expire on the following schedule:

GlobalSign launched BIMI issuance in late 2024 with a single test certificate. By the July 2, 2026 snapshot, it has issued 562 certificates — a 177.7% increase from its first full year (2024: 1 cert, 2025: 202 certs, 2026 YTD: 359 certs). Its growth trajectory is the steepest of any CA in the BIMI market, from zero baseline.

Sectigo (207 certificates) and SSL Corporation (123 certificates) entered more recently and are at earlier growth stages. Their combined 1.6% market share understates their trajectory — both entered during 2025 and have grown monthly since launch.

This report derives entirely from Certificate Transparency (CT) log data. The dataset contains 20227 BIMI certificate records with a snapshot date of 2026-07-02. CA identification uses the Intermediate CA field in the CT log record, with Root CA as fallback for multi-path issuance structures. All-time share percentages are calculated against the total issued corpus, not the active corpus.

Sectigo and SSL Corporation share CA infrastructure in certain issuance configurations. In volume tables, they are shown separately. In concentration analysis, the 1.6% figure reflects their combined share. The “active certificates” figure of 0 for Entrust is derived from the subset of Entrust-issued certificates whose Not After date was after 2026-07-02 in the dataset. The 4431 “already expired” figure represents Entrust certificates with a Not After date before the snapshot date.

The BIMI CA market is structurally healthier than the 85.4% headline suggests. DigiCert’s dominance is partly a statistical artefact of Entrust’s forced exit — not organic market capture. The correct comparison is: where would DigiCert’s 2026 share be if Entrust had continued operating at its 2024 pace (1,741 certs)? Roughly 65–70%, not 85.4%. That is concentrated but not unprecedented for a nascent market with high technical barriers to entry.

GlobalSign’s 177.7% first-to-second-year growth is the most important signal in this dataset. It shows that the market absorbs new entrants. An established CA with existing enterprise relationships can gain meaningful share within twelve months of launch. This matters for the long-term concentration question — the 85.4% figure is a transitional state, not a stable equilibrium.

Entrust’s 4431 legacy certificates will be fully retired by 2028. That retirement will coincide with the full maturation of GlobalSign, Sectigo, and SSL Corp. The CA landscape in 2028 will look substantially more competitive than today — not because DigiCert loses share organically, but because the Entrust-migration cohort will have already moved to new CAs and the new-entrant growth is compounding.