Why is Apple distrusting Entrust CA and VMCs, and what are the alternatives?
Updated on 3 Aug 2026: We updated this guide for Entrust's completed VMC exit and Apple's current certificate trust rules.
Apple distrusted specific Entrust roots because of concerns about the CA's compliance and engagement with Apple Root Program requirements and broader industry standards. For BIMI, the affected root is Entrust Verified Mark Root Certification Authority - VMCR1, with an effective date of November 15, 2024. Separate affected Entrust roots cover TLS, S/MIME, and timestamping.
The old grace period is no longer an operational option. BIMI mark certificates have a maximum validity of 398 days, so a certificate issued on or before November 15, 2024 has expired. Entrust also stopped issuing VMCs in May 2025 and completed the transition of its public certificate business to Sectigo. Replace any remaining Entrust-rooted BIMI deployment through a currently accepted mark-certificate path, then test Apple-hosted recipient accounts and the other inbox providers your audience uses.
The direct answer
Apple's distrust is a root-store policy with an issuance-date cutoff. Entrust's notice states that Apple will not support TLS, S/MIME, timestamping, and VMC certificates issued from affected Entrust public roots after November 15, 2024. Sectigo's analysis highlights the wider scope of Apple's action: it reached beyond browser TLS into S/MIME, timestamping, and the Entrust VMCR1 root used for BIMI mark certificates.
For VMCs, the visible effect is limited to recipients whose mail is handled by Apple at iCloud.com, mac.com, or me.com. Those recipients can lose the verified logo when the VMC chains to the affected root. The policy does not block email delivery, and it does not remove Gmail's blue checkmark or logo display at non-Apple mailbox providers that still accept the certificate.
Treat the cutoff as historical
Certificates issued on or before the cutoff were allowed to work until natural expiry. That grace period has ended for compliant mark certificates because their maximum validity is 398 days. Rehosting the same expired PEM does not restore trust or BIMI display.
- Check certificate expiry: Treat an expired PEM as a failed dependency even if the BIMI TXT record still resolves.
- Check the certificate chain: Verify whether the PEM chains to Entrust Verified Mark Root Certification Authority - VMCR1.
- Check recipient scope: Test iCloud.com, mac.com, and me.com accounts separately because Gmail and Yahoo make their own certificate-acceptance decisions.
Entrust-rooted VMC status by issue date
The cutoff still explains the policy, but certificate validity determines the action now.
Issued on or before cutoff
Historical
The 398-day maximum validity means the certificate has expired.
Issued after cutoff
Replace
An Entrust VMCR1 chain falls inside Apple's distrust window.
Why Apple made the trust decision
Apple says it removes a CA or specific certificates when the CA has issues related to compliance and engagement with Apple Root Program requirements or broader industry standards. Apple did not publish an incident-by-incident explanation on its change page. The wider 2024 public record documented certificate misissuance, slow remediation, and incident handling that did not restore root-program confidence.
Google and Mozilla applied their own distrust decisions to new Entrust TLS certificates. Apple made a separate, broader decision that also covered S/MIME, timestamping, and the VMCR1 root for BIMI. This is a decision about which certificate chains Apple accepts, not a judgment about a sender's individual messages or a change to DMARC delivery policy.
Why VMCs are in scope
A VMC is an X.509 certificate used as evidence that a brand controls a logo for BIMI. It depends on a certificate chain that the receiving mailbox provider accepts. Apple controls certificate trust for its own BIMI processing, so it can stop accepting a VMC chain even when the sender's DNS and authentication remain correct.
BIMI display depends on DMARC, DNS, logo hosting, VMC hosting, and certificate trust.
This distinction matters because Apple Branded Mail and Apple Business Connect can affect Apple-specific brand display, but they do not replace a trusted mark certificate for BIMI across mailbox providers that require one. Apple requirements still need to be handled as their own Apple-facing layer.
Branded Mail assumption
- Apple-only settings: This would affect only Apple's own brand-logo program.
- No certificate concern: The BIMI PEM file would remain a normal mailbox-provider issue.
- Limited migration: The team would update Apple brand settings and leave the VMC alone.
Certificate trust reality
- Apple-hosted recipient scope: The VMC impact applies to recipients at iCloud.com, mac.com, and me.com.
- VMC evidence risk: A valid-looking BIMI record can fail when Apple does not accept the certificate chain.
- Replacement path: The fix is a current mark certificate accepted by the target mailbox providers.
What to replace Entrust with
Entrust stopped VMC issuance on May 12, 2025 and completed the transition of its public certificate business to Sectigo in September 2025. DigiCert, GlobalSign, and SSL.com appear in the BIMI Group's current mark-certificate issuer directory. Sectigo began selling VMCs and CMCs in 2026. Confirm that each target mailbox provider accepts the exact certificate and chain before purchase, because issuer-directory inclusion or vendor availability does not guarantee universal display.
DigiCert CertCentral screen for managing mark certificates.
|
|
|
|---|---|---|
DigiCert VMC or CMC | Teams needing VMC or CMC issuance with optional file hosting. | Compare validation, hosting, renewal terms, and total cost. |
GlobalSign Mark Certificate | Brands comparing VMC and CMC workflows. | Confirm regional trademark eligibility and mailbox acceptance. |
SSL.com Mark Certificate | Teams comparing VMC, CMC, or government-mark options. | Confirm provider display rules for the chosen certificate type. |
Sectigo VMC or CMC | Entrust customers moving after the public-certificate transition. | The mark-certificate offering began in 2026, so confirm the final chain and mailbox acceptance. |
Apple Business Connect | Apple-specific brand presentation. | Does not replace BIMI mark-certificate needs elsewhere. |
No certificate yet | DMARC enforcement and BIMI DNS preparation. | Logo display remains limited at providers that require a mark certificate. |
Practical replacement choices for Entrust-rooted VMC risk.
For the deeper vendor question, compare VMC vendors by chain, mailbox acceptance, validation friction, logo hosting, renewal handling, and support. For the policy question, the VMC requirement still depends on the mailbox provider, and the DNS record is only one input.
Stage and validate the new certificate before switching the BIMI record. Keep the old PEM URL available for rollback records, but do not expect an expired or distrusted PEM to keep displaying a logo. Mailbox providers cache BIMI results, so allow time for provider-side refreshes during testing.
Migration steps
Handle the migration as a certificate replacement plus an email-authentication check. BIMI display also depends on DMARC enforcement, aligned SPF or DKIM, DNS correctness, HTTPS hosting, SVG formatting, recipient support, and the mailbox provider's acceptance of the certificate chain.
Flowchart for moving from an Entrust-rooted VMC to a trusted replacement.
- Inventory certificates: Find every BIMI record, mark-certificate PEM URL, logo URL, and sending domain that uses the brand.
- Confirm expiry and chain: Open the PEM and check the issuer, root, serial number, validity dates, and certificate status.
- Select the replacement: Compare DigiCert, GlobalSign, SSL.com, or Sectigo based on mark eligibility, validation fit, final chain, and acceptance by target mailbox providers.
- Validate DMARC: BIMI needs enforcement, usually p=quarantine or p=reject with aligned authentication.
- Stage the files: Host the new SVG and PEM over HTTPS, then verify direct public access, expected content types, and complete certificate contents.
- Switch and monitor: Update the BIMI TXT record, send test messages to Apple-hosted and other priority recipient domains, and watch authentication reports.
DMARC enforcement exampleDNS
Host: _dmarc.example.com Type: TXT Value: "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s"
Before buying the replacement certificate, run the domain through a DMARC checker. If the record is missing or still at monitoring mode, use a record generator to create a clean starting point, then move to enforcement only after legitimate senders are authenticated.
BIMI record after certificate replacementDNS
Host: default._bimi.example.com Type: TXT Value: "v=BIMI1; l=https://e.co/bimi.svg; a=https://e.co/vmc.pem;"
Where Suped fits
Suped is not a certificate authority, so it does not issue a VMC or CMC. Suped's product handles the authentication and monitoring work around the certificate: DMARC monitoring, SPF and DKIM visibility, hosted policy management, alerts, and deliverability signals. This gives teams the authentication evidence needed before and after a mark-certificate migration.
A certificate replacement does not fix bad alignment, unknown senders, missing DKIM signatures, or an SPF record that breaks the lookup limit. Suped surfaces those issues in one place and turns aggregate DMARC data into source-level fixes.
Issue steps to fix dialog showing the issue overview, tailored fix steps, and verification action
For a team already close to enforcement, Suped's Hosted DMARC can simplify policy staging and reduce DNS changes. Hosted SPF helps when sender management is the blocker, and blocklist (blacklist) monitoring gives reputation context during a brand-logo rollout.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
Use the domain health result as a readiness gate. If DMARC enforcement, SPF, DKIM, and BIMI prerequisites are clean, proceed with the mark-certificate order. If they are not clean, fix authentication first. A trusted certificate attached to a weak authentication setup gives the team a false sense of progress.
Checks before you switch
A successful DNS lookup does not guarantee logo display. BIMI validation is layered. A mailbox provider can accept DMARC and still reject the logo because of SVG rules, PEM hosting, chain trust, certificate expiry, reputation signals, or provider-specific support.
Pre-switch checklist
- DMARC policy: Use enforcement at the organizational domain and check subdomain inheritance.
- Authentication alignment: Confirm that important mail passes aligned SPF or aligned DKIM.
- Logo format: Use a BIMI-compatible SVG and verify that the URL returns the expected content type.
- Certificate evidence: Confirm the new PEM chain, certificate type, subject details, expiry, and public availability.
- Mailbox tests: Send real messages to iCloud.com, mac.com, me.com, Gmail, Yahoo, and any other important audience domain.
Keep a change log with the old BIMI TXT value, the old PEM URL, the new PEM URL, both certificate serial numbers, and the exact time DNS changed. When a logo disappears for a subset of recipients, that record cuts troubleshooting time.
The DigiCert FAQ is useful for the broader certificate distrust timeline, especially where teams also have Entrust-rooted TLS inventory. Keep the BIMI project connected to the wider PKI inventory so the brand team is not the only group discovering certificate risk.
Views from the trenches
Best practices
Inventory VMC issue dates and chain names before changing DNS or asking teams to test logos.
Move DMARC to enforcement before buying a mark certificate, not after validation starts.
Keep the old PEM documented until the replacement passes for iCloud, Gmail, and Yahoo recipients.
Common pitfalls
Assuming Entrust still issues VMCs ignores its completed exit from public issuance.
Treating Apple Business Connect as a BIMI replacement leaves Gmail and Yahoo needs unsolved.
Changing the BIMI TXT record before the new PEM is public creates avoidable logo failures.
Expert tips
Ask the issuer to confirm the root chain before payment instead of relying on the quote.
Test with a real campaign seed message because inbox rendering can lag behind DNS changes.
Document the renewal owner because mark certificates expire yearly and depend on brand checks.
Expert from Email Geeks says Apple including VMCs changes the risk calculation because BIMI depends on root trust rather than Branded Mail settings alone.
2024-12-31 - Email Geeks
Expert from Email Geeks says certificates issued before the cutoff were not an immediate emergency, but replacement planning needed to start before expiry.
2024-12-31 - Email Geeks
Practical recommendation
Any Entrust VMC issued on or before November 15, 2024 has exceeded the current 398-day maximum mark-certificate validity. Treat any remaining reference to that PEM as expired configuration, replace it, and remove it only after the new BIMI record and rollback notes are complete.
For a new certificate, compare DigiCert, GlobalSign, or SSL.com as the issuers in the current BIMI Group directory. Sectigo also sells VMCs and CMCs, but confirm that each target mailbox provider accepts the exact certificate chain before committing. Validation workflow, mark eligibility, hosting, renewal handling, and support should decide between accepted options.
The certificate choice matters, but weak email authentication underneath it causes more failures. Get DMARC enforcement, aligned DKIM, clean SPF, sender inventory, BIMI file hosting, and provider testing under control first. Then the certificate change becomes a controlled migration.
