Certificate authority
Entrust: distrusted by Chrome and Mozilla, TLS business sold
Details
- CCADB CA owner
- Entrust
- Country
- US
- Country (CCADB)
- United States of America
- ACME
- No
- Free certificates
- No
- Roots
- 4
- Roots trusted for TLS
- Chrome 0 · Mozilla 0 · Apple 4 · Microsoft 4
- Intermediates under its roots
- 26 (0 valid)
- Auditor
- Deloitte
- CAA
entrust.net
Entrust was a long-established commercial certificate authority until browsers withdrew trust from its new TLS certificates in late 2024. Chrome stopped trusting certificates from Entrust roots with a first SCT after 2024-11-11, Mozilla after 2024-11-30, and in 2025 Entrust sold its public certificate business to Sectigo.
Owner and headquarters
Entrust is a US company; the CCADB still lists a CA owner called "Entrust". Since the sale of its public certificate business, Entrust no longer sells publicly trusted TLS certificates itself. The products field above is therefore empty.
Root certificates
As of November 2026, CCADB lists four AffirmTrust roots under Entrust (Commercial, Networking, Premium and Premium ECC). Chrome and Mozilla have removed them, Apple still includes them, and Microsoft lists them as "NotBefore", meaning only certificates issued before a cutoff are trusted. The better-known roots, such as Entrust Root Certification Authority, G2, G4, EC1 and Entrust.net (2048), now appear under Sectigo as CA owner, all removed from Chrome. Entrust's 2022 roots appear in the CCADB only with Microsoft's NotBefore status.
Certificate products
No publicly trusted TLS products remain at Entrust. Customers were moved to Sectigo's platform; Sectigo said on 2025-09-25 that the migration was complete.
ACME support
Entrust no longer offers ACME for public TLS certificates. Former Entrust ACME users get certificates from Sectigo's hierarchy instead.
Free certificates
Entrust never offered free publicly trusted TLS certificates.
Notable incidents
On 2024-06-27 Google announced that Chrome would stop trusting TLS certificates chaining to Entrust's roots whose earliest Signed Certificate Timestamp (SCT) was after the cutoff, later set to 2024-11-11 23:59:59 UTC, enforced from Chrome 131. Google cited a pattern of compliance incidents and unmet improvement commitments. On 2024-07-31 Mozilla followed with a distrust-after date of 2024-11-30. Certificates issued before the cutoffs stayed valid until expiry. The case shows how root programs act against a CA: through SCT-based cutoffs that protect existing sites, not overnight removal. Compare the 2026 eMudhra case and the root program timeline.
CAA records
The CCADB lists 2 CAA issuer domain(s) recognized by the currently valid intermediate certificates of Entrust. One issue record with any of them lets Entrust issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.
Copy-ready record(s) for the first 2 domain(s):
example.com. CAA 0 issue "entrust.net"
example.com. CAA 0 issue "affirmtrust.com"| Domain | Valid intermediates |
|---|---|
entrust.net | 7 |
affirmtrust.com | 7 |
For issuewild, iodef or DNS-provider formats, use the CAA record generator: CAA Generator
Root certificates (CCADB)
Entrust has 4 root certificate(s) in the CCADB TLS report. Together they have signed 26 intermediate CA certificates, 0 of them still valid.
Roots this CA owner has in the CCADB TLS Server Authentication report, with current status in each root store.
- trusted for TLS
- included with limits (NotBefore / no TLS bit)
- removed or blocked
- not included
| Root certificate | Key | Expires | Ch | Mo | Ap | MS | Intermediates |
|---|---|---|---|---|---|---|---|
| AffirmTrust Commercial | RSA 2048 | 2030-12-31 | Removed | Removed | Included | Included (NotBefore cutoff) | 10 (0) |
| AffirmTrust Networking | RSA 2048 | 2030-12-31 | Removed | Removed | Included | Included (NotBefore cutoff) | 7 (0) |
| AffirmTrust Premium | RSA 4096 | 2040-12-31 | Removed | Removed | Included | Included (NotBefore cutoff) | 5 (0) |
| AffirmTrust Premium ECC | ECDSA P-384 | 2040-12-31 | Removed | Removed | Included | Included (NotBefore cutoff) | 4 (0) |
Audits
Audit data the CCADB records for the TLS roots of Entrust. Auditor(s): Deloitte. The most recent audit period ended on 2025-02-28.
| Audit | Scheme | Period | Statement | Report |
|---|---|---|---|---|
| Standard audit | WebTrust | 2024-03-01 – 2025-02-28 | 2025-06-27 | cpacanada.ca |
| Network security | WebTrust | 2024-03-01 – 2025-02-28 | 2025-06-27 | cpacanada.ca |
| TLS Baseline Requirements | WebTrust | 2024-03-01 – 2025-02-28 | 2025-06-27 | cpacanada.ca |
| TLS EV Guidelines | WebTrust | 2024-03-01 – 2025-02-28 | 2025-06-27 | cpacanada.ca |
CP/CPS documents
Certificate Policy and Certification Practice Statement links that Entrust has disclosed in the CCADB for its TLS roots, with effective dates:
- CPS: https://www.entrust.com/sites/default/files/documentation/licensingandagreements/ecs/affirmtrust-ssl-cps-3-18.pdf (effective 2025-01-15)
- Document repository: https://www.entrust.com/legal-compliance/entrust-certificate-services-repository
Report a certificate problem
To report a mis-issued certificate, a compromised private key or other abuse, use the channels Entrust lists in the CCADB (replace [at] and [dot] in addresses):
- https://www.entrust.com/support/certificate-solutions/report-a-problem
problemreport[at]entrust[dot]comabuse[at]affirmtrust[dot]com
Incident reports
CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “Entrust”:
FAQ
My site still has an Entrust certificate. Is it broken?
Only if it was issued after the cutoffs: Chrome distrusts Entrust-root certificates whose earliest SCT is after 2024-11-11, Mozilla those issued after 2024-11-30. Older certificates have expired by now under the 398-day limit, so any certificate still chaining to an Entrust root should be replaced.
What CAA record allows Entrust to issue certificates?
Publish example.com. CAA 0 issue "entrust.net". The CCADB lists 2 recognized domain(s) for Entrust: entrust.net, affirmtrust.com.
Who audits Entrust?
Deloitte, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2024-03-01 to 2025-02-28; the statement is dated 2025-06-27.
How do I report a problem certificate to Entrust?
Use the channel(s) listed in the CCADB: https://www.entrust.com/support/certificate-solutions/report-a-problem, problemreport[at]entrust[dot]com, abuse[at]affirmtrust[dot]com.