The BIMI certificate authority landscape in 2026 is not the market it was in 2022. Two founding pillars — DigiCert and Entrust — built the ecosystem together. One has now exited. Two new CAs have entered. And one channel provider operates under a rebranded infrastructure that traces back to DigiCert’s original market position.
Entrust discontinued its Certificate Authority business, which included the cessation of all public certificate issuance — BIMI certificates included. The 4431 organisations holding active Entrust-issued BIMI certificates are operating on legacy certificates that will not be renewed through Entrust. Their pathway is migration to recognized BIMI certificate providers – DigiCert, GlobalSign, or Sectigo before their expiry date.
DigiCert captured 85.4% of all new BIMI issuances in the first half of 2026 (January 1 – July 2). GlobalSign, which entered the BIMI market properly in 2025, has issued 562 certificates. SSL Corp — operating Sectigo as a distribution channel — has issued 330 certificates across both brands since entering in 2025. The four-CA market is now effectively a one-CA market for new issuances, with two emerging challengers.
CA Landscape
Four CAs — Three Eras
Section 01
How the BIMI CA Market Was Built — and How It Changed
Section 02
The Entrust Exit — Impact on 4431 Active Certificate Holders
In November 2024, Google announced that Chrome would stop trusting new TLS/SSL certificates issued by Entrust, citing a pattern of compliance failures and mis-issuances. Mozilla Firefox followed with an equivalent distrust decision. Because BIMI’s Verified Mark Certificate (VMC) and Common Mark Certificate (CMC) infrastructure depends on publicly-trusted Certificate Authority roots, this browser distrust decision effectively ended Entrust’s ability to issue any new BIMI certificates. Entrust’s last BIMI certificate was issued in May 2025 — a brief continuation period covering certificates in pipeline before the distrust became fully effective. As of the July 2026 dataset snapshot, only 0 Entrust BIMI certificates remain active globally; all expire by December 2026. No renewal path exists with Entrust. Holders must migrate to an active CA (DigiCert, GlobalSign, or Sectigo) before their certificate’s “Not After” date to avoid an inbox logo gap.
Entrust’s discontinuation of its CA business is the most operationally significant event in the BIMI certificate market to date. As a founding CA that held 21.9% of all active BIMI certificates at peak, its exit leaves a substantial population of certificate holders requiring migration.
Your existing Entrust BIMI certificate remains valid until its printed expiry date. When that date arrives, Entrust will not issue a renewal certificate. You must migrate to an alternative CA — DigiCert, GlobalSign, or Sectigo — before your expiry date. Begin the migration process at least 60–90 days before expiry. The migration requires the new CA to independently validate your trademark or commercial use evidence.
| Country | Active Entrust Certs | % of Country BIMI | Migration Priority |
|---|---|---|---|
 United Kingdom | 663 | 38.1% | Critical — 38.1% of UK market at risk |
 United States | 1805 | 20.8% | High volume — largest absolute exposure |
 India | 317 | 33.7% | High — BFSI concentration |
 Canada | 207 | 30.9% | High — confirm expiry dates now |
 Italy | 116 | 38% | High — begin migration planning |
 Germany | 222 | 18.6% | Moderate — monitor expiry schedule |
 Australia | 185 | 22% | Moderate |
 Netherlands | 111 | 21.1% | Moderate |
 France | 107 | 16.1% | Plan ahead |
 Spain | 95 | 28.1% | High — migration needed |
Section 03
GlobalSign and Sectigo — The New Market Entrants
GlobalSign
GlobalSign is a well-established global CA with decades of TLS and code-signing certificate history. Its BIMI programme launched properly in 2025 with 202 certificates — a deliberate market entry, not a pilot. In the first half of 2026 (January 1 – July 2) it has already issued 359 certificates, surpassing its full 2025 output. Japan (78) and the US (81) are its primary 2026 markets, with India (44), Australia (17), and Germany (15) following.
GlobalSign entered the BIMI market at a strategically advantageous moment — precisely as Entrust was winding down. Its enterprise PKI relationships in Japan (where it holds 19.5% of the country’s BIMI CA share) and India (8%) position it well to absorb displaced Entrust demand in those markets.
SSL Corp and the Sectigo Channel
SSL Corp operates as the Root CA for BIMI certificates issued under the Sectigo brand. This is a distribution architecture, not a separate CA: SSL Corp issues and roots the certificate; Sectigo operates as an intermediate CA brand and reseller channel. The two entities combined represent 330 active BIMI certificates — 123 direct SSL Corp issuances and 207 under the Sectigo brand.
Sectigo’s BIMI certificate product was originally associated with DigiCert’s brand infrastructure before Sectigo’s separation and independent branding. The Sectigo BIMI product has since been restructured under SSL Corp’s Root CA infrastructure. When evaluating a Sectigo BIMI certificate, the Root CA in the certificate chain is SSL Corp — this is relevant for organisations conducting CA due diligence or verifying certificate chain trust.
The combined Sectigo 2026 YTD output of 295 certificates in the first half of 2026 (January 1 – July 2) represents a significant ramp from their 2025 entry. The US (110), India (47), and Canada (35) are their strongest 2026 markets, reflecting strong adoption across several English-speaking markets.
| CA | Cumulative Share (all time) | 2026 YTD Share (new only) | Direction |
|---|---|---|---|
| DigiCert | 73.6% | 85.4% | ↑ Gaining rapidly |
| Entrust | 21.9% | 0% | ↓↓ Exited |
| GlobalSign | 2.8% | 7.9% | ↑ Expanding |
| Sectigo | 1.6% | 6.5% | ↑ Growing fast |
In 2026, 85.4% of every new BIMI certificate issued goes through DigiCert. GlobalSign and Sectigo together account for the remaining 14.6%. The market has structurally shifted from a two-CA founding duopoly to a DigiCert-dominant market with two challenger entrants absorbing what growth they can capture from displaced Entrust demand and new adopters.
Expert Interpretation
The founding duopoly shaped the ecosystem’s geographic and sector distribution
DigiCert and Entrust did not build identical customer bases. DigiCert’s enterprise PKI relationships ran deepest in US technology, German enterprise, and French financial services. Entrust’s ran deepest in UK financial services, India BFSI, Canadian public sector, and Italian retail. These relationship patterns are visible in the current CA market share by country — the UK’s 38.1% Entrust share and India’s 33.7% are direct legacies of Entrust’s enterprise identity management depth in those markets, not outcomes of BIMI product comparison.
Entrust’s exit was orderly and foreseeable from the data — the wind-down began in 2025
Entrust dropped from 1741 new BIMI certificates in 2024 to 501 in 2025 — a 71% decline. This was not a market share loss to competitors. It was a planned reduction consistent with an orderly CA business wind-down. Organisations that renewed Entrust certificates in 2025 likely received certificates with terms ending in 2026 or 2027 — these are the expiry events that certificate holders now need to plan around.
GlobalSign and Sectigo entered at exactly the right moment — the question is market capacity
With 4431 Entrust certificates requiring eventual migration and DigiCert already capturing 85.4% of new issuances, the question for GlobalSign and Sectigo is whether they can process migration volume at the scale that Entrust’s exit creates. Their combined 2026 YTD output of ~654 certificates suggests they are growing but not yet at replacement capacity for Entrust’s historical 1741+ annual run rate. DigiCert will absorb the majority of Entrust migrations.
FAQ
Frequently Asked Questions
My Entrust BIMI certificate is still working. Why do I need to plan migration now?
What is the relationship between Sectigo and SSL Corp in BIMI certificates?
Can I migrate from Entrust to GlobalSign or SSL Corp instead of DigiCert?
When will Entrust certificates start expiring in volume?
Read next
Related Resources
author = {VMCcerts Research},
title = {BIMI CA Landscape and Migration Patterns 2026},
institution = {VMCcerts},
year = {2026},
url = {https://vmccerts.com/research/bimi-ca-migration-patterns-2026},
note = {Dataset: VMCcerts BIMI Dataset v2026.2. Snapshot: 2026-07-02.}
}
AU – VMCcerts Research
TI – BIMI CA Landscape and Migration Patterns 2026
PY – 2026
PB – VMCcerts
UR – https://vmccerts.com/research/bimi-ca-migration-patterns-2026
ER –