Google’s Decision to Distrust Entrust: Implications for VMC Certificates and BIMI
In a major shakeup for digital security, Google has announced that it will no longer trust public TLS certificates issued by Entrust and its subsidiary, AffirmTrust, after October 31, 2024. This move is driven by ongoing concerns about Entrust’s compliance and reliability. As a result, website operators and organisations using Entrust for their SSL certificates must consider whether they need to take action to ensure continuous security.
Impact on BIMI and VMC Certificates
Google’s recent decision has sparked significant discussion in the martech and email communities. Of particular concern is the impact on organisations using Verified Mark Certificates (VMCs) for Brand Indicators for Message Identification (BIMI), as Entrust is one of the major vendors of VMCs.
You can read Steve Atkins post at Word to the Wise here. Also hear from Al Iverson talk about the subject in the video below.
Why VMCs are Important
BIMI is a protocol that allows organizations to display their brand logos in the inboxes of major consumer webmail providers. To display a logo at Gmail, organizations need more than just a clean DMARC setup and a published BIMI record; they also require a VMC. A VMC, similar to a TLS certificate, is issued by a trusted certificate authority (CA).
Limited VMC Providers
Currently, there are only two trusted CAs for issuing BIMI VMCs: DigiCert and Entrust. Google’s decision to remove Entrust from its trusted list poses a significant future challenge for organizations relying on Entrust for their BIMI VMCs.
Understanding Google’s Decision
Google’s Chrome Security Team cited a history of compliance failures and unmet improvement commitments by Entrust as the primary reasons for their decision. These failures have eroded confidence in Entrust’s ability to act as a reliable CA. As a result, from November 1, 2024, Chrome versions 127 and higher will distrust any new TLS certificates issued by Entrust. This impacts website SSL and https connections essentially.
Key Dates and Actions
Effective November 1, 2024: Chrome versions 127 and higher will distrust new TLS server authentication certificates issued by Entrust and AffirmTrust. Certificates issued on or before October 31, 2024, will remain trusted until they expire.
What This Means for VMC Certificate Holders
If you are using Entrust for your BIMI VMC, it is important to consider what may change in future:
- Trust Issues with VMCs: Given Google’s loss of confidence in Entrust, it is in the opinion of some that the trust in BIMI VMCs issued by Entrust could be impacted in the future. This could result in your brand logo not being displayed in Gmail and other email services that rely on trusted CAs.
Note: Entrust has stated that VMCs are not impacted by Google’s decision.
Read more from their CEO on the subject here: https://www.entrust.com/blog/2024/07/thoughts-on-the-google-chrome-announcement-and-our-commitment-to-the-public-tls-certificate-business/ - Need for More Vendors: In my opinion the decision highlights a critical vulnerability in the BIMI ecosystem, as there are only two CAs currently trusted for issuing VMCs. To avoid disruptions and ensure continuity, it is advisable to have more vendors trusted for BIMI VMCs. Expanding the list of trusted CAs would provide organisations with more options and enhance the resilience of their email branding strategies.
Entrust’s Response
Entrust has acknowledged the decision and emphasized its commitment to serving customers’ certificate needs through alternative or partner roots. They assure that all TLS certificates issued through October 31, 2024, will remain trusted by Google until their expiration. They have also stated that VMCs are not impacted.
Read more here: https://www.entrust.com/blog/2024/07/thoughts-on-the-google-chrome-announcement-and-our-commitment-to-the-public-tls-certificate-business/
Conclusion
Google’s decision to distrust Entrust and AffirmTrust certificates marks a significant development in the landscape of digital security. While this move aims to enhance the overall security of internet users, it poses immediate questions for organisations relying on Entrust for their TLS certificates and raises valid concerns for those using BIMI VMCs.
Website operators must consider the fact they may need to transition to a new trusted CAs to maintain website’s integrity and avoid users facing disruptions. However at this time Entrust believe they can make the required changes in such time as to ensure their is no user disruption,
This situation underscores the importance of diversifying trusted certificate authorities within the BIMI ecosystem to enhance resilience and reduce dependency on a limited number of providers. By taking proactive steps now, organisations can navigate these changes smoothly and continue to secure their digital communications effectively.
Note: post edited to reflect the fact Entrust have stated that users should not face disruption and fixes should be in place before the November 1 deadline.
