Entrust
Hardware security modules, private PKI, certificate lifecycle management and identity verification — with nShield’s Security World managing keys across appliances. Entrust no longer sells public TLS certificates; this hub is your complete intel file on what it does sell.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Four intel pages. One cryptographic portfolio.
The Entrust portfolio TechBag covers — every linked card is a full intel page, from nShield hardware key custody to Onfido-based identity verification.
nShield HSM
Hardware key custody, managed by Security World.
Tamper-resistant appliance that generates and stores keys inside the device; Security World manages keys across HSMs for resilience.
Entrust PKI
The certificates inside your own estate.
Private CA and PKI for machine, device, internal TLS and code-signing certificates. Public TLS was sold to Sectigo in September 2025.
Certificate Manager
Forgotten certificates, found before they expire.
Discovery, inventory, automated renewal and revocation for certificates scattered across load balancers, services and appliances.
Entrust Identity Verification
Proving a remote person is who they claim to be.
Document and biometric identity verification built on Onfido, acquired April 2024: proves a remote person is who they claim to be.
Public TLS certificates
No separate pageSOLD to Sectigo, completed 18 Sept 2025 — Entrust no longer sells these
nShield as a Service
No separate pageManaged HSM — UK, US, Germany and Australia; no India region
Entrust is one of 21 encryption & rights management products TechBag carries. The Data Security & Privacy guide shows how the category splits and which part is yours. →
Why “BIS registered” will not decide it
Indian buyers often expect a certification to settle this comparison. It does not, because both nShield and Thales Luna network HSMs hold BIS registration under IS 13252— the IT-equipment safety standard in the Bureau of Indian Standards’ Compulsory Registration Scheme, a gate any HSM sold into Indian tenders must clear. It is a safety registration, not a security certification. Check it by model — the 2019 certificate covers nShield Connect XC, and we have not confirmed the nShield 5c — then compare on what differs: Security World architecture, portfolio fit, the analyst position (where Thales is stronger) and the software platform around the hardware.
BIS: a gate every HSM clears
IS 13252 is a safety registration, not a security certification, and both nShield Connect XC (2019) and Thales Luna hold it. Ask for your model’s certificate.
Keys that never leave hardware
Software keys sit in host memory and a compromised host can leak them. In an HSM the key is generated, used and kept inside the appliance; an attacker gets requests, not the key.
Security World resilience
Security World runs a group of HSMs as one logical unit, giving resilience, disaster recovery and key portability without moving key material by hand. A second site is designed in.
A narrower portfolio, stated
Entrust sold its public TLS business to Sectigo (completed 18 September 2025). Hardware key custody, private PKI, certificate lifecycle and identity verification remain: strong, but smaller.
Analyst standing, cautiously
Gartner has no Magic Quadrant here, and we could not verify an Entrust Leader placement with any analyst. Thales holds two 2025 KuppingerCole Overall Leader awards.
Start with the product your requirement names — a hardware-custody mandate, a private CA, an expiring certificate or a remote onboarding — then extend across the portfolio.
Peer & market recognition
Every claim on this hub traces to one of these public signals.
BIS registration
nShield Connect XC, IS 13252 — a safety registration
Bengaluru & Pune
Live engineering hiring, including PKI security roles
Onfido acquired
Now Entrust Identity Verification
Over $1B revenue
Per Entrust, July 2025 — roughly 3,000 staff
Private, Quandt family
Via Datacard — not Thoma Bravo, a common error
New CEO
Tony Ball, succeeding Todd Wilkinson after 17 years
Exited public TLS
Sold to Sectigo after browser distrust
Unverified
No HSM/key-management Leader placement confirmed
The company in six figures
See the platform, hear the pitch
Entrust nShield HSMs: On Another Level
The appliance, presented by Entrust.
What is a hardware security module (HSM)?
The category, explained.
What is Entrust PKI?
Private PKI, not public TLS.
Where Entrust sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Entrust Across Its Platform
Each dot is an Entrust product: competitive position vs category momentum.
Security World resilience — the portfolio's steadiest anchor.
The Platform Breadth × Key Custody Map
How broad the software platform around the keys is vs how deep the hardware key custody goes.
Deepest on hardware custody; analyst standing unverified.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Entrust?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What is driving this?
2. Do your keys need to stay in your own building?
3. Were you looking for public SSL certificates?
What BIS registration does, and does not, decide
Both nShield and Thales Luna hold BIS safety registration, so it is a gate to check by model, not a tie-breaker.
Read →Entrust no longer sells public SSL certificates
It sold that business to Sectigo in September 2025 after browser distrust. What it does still sell, and what it does not.
Read →Private PKI versus public TLS
Two different trust models that share a word, and only one of them is still an Entrust product.
Read →The certificate that took down production
Expired certificates cause a disproportionate share of outages, and the cause is never cryptography.
Read →Key custody, DPDP and RBI
What a regulator is actually asking when they ask about encryption, and what evidence answers it.
Read →nShield against Luna, honestly
Two credible hardware vendors, both BIS-registered. One has Security World, the other the stronger verified analyst position.
Read →The acronym decoder
Every term on these pages, in one place- HSM
- Hardware Security Module: a tamper-resistant appliance where keys are made and used, never leaving.
- BIS registration
- India’s IS 13252 safety registration for IT products; nShield and Thales Luna both hold it.
- Security World
- Entrust’s way of running a group of HSMs as one logical unit, building in resilience and key portability.
- Private PKI
- A certificate authority you run for certificates your own systems trust; not part of the Sectigo sale.
- Public TLS
- Publicly trusted SSL for websites. Entrust sold it to Sectigo, completed 18 September 2025.
- Browser distrust
- Chrome, Apple and Mozilla stopped trusting Entrust’s public roots from November 2024.
- Certificate lifecycle management
- Finding, inventorying, renewing and revoking certificates across an estate; needs automation as lifetimes shorten.
- Onfido
- The identity-verification company Entrust acquired in April 2024, now sold as Entrust Identity Verification.
- Identity verification
- Proving a remote person is who they claim at onboarding; authentication instead checks a returning user.
- Key custody
- Who physically holds and controls the keys — the question a regulator is really asking when they ask about encryption.
- Root of trust
- The hardware or component everything else's security depends on. An HSM is the strongest commonly available one.
- Gartner Market Guide
- A Gartner report that describes a market without ranking vendors, so it has no Leader quadrant.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Check BIS registration by model, then move on
nShield and Thales Luna both hold BIS (IS 13252), so it won’t decide. Get your exact model’s certificate (nShield 5c is unconfirmed), then compare what differs.
Separate public TLS from private PKI before you scope
Entrust sold public certificates to Sectigo in September 2025, but kept private PKI. Split the two first, because public SSL now means a different vendor.
Decide whether hardware key custody is genuinely required
Software key management is often enough. Buy hardware only if a regulator, a payments or PKI mandate, or your risk review requires it.
Plan Security World and the second appliance
Security World spreads keys across HSMs for resilience and disaster recovery. Surviving a site failure needs a second appliance; budget it and its site now.
Name the administrators and the approvers separately
Hardware key custody adds new roles: whoever administers the appliance should not approve key use. Assign them in the project, before delivery pressure waives it.
Check the identity-verification regulatory boundary in writing
For Indian financial services, get in writing which parts of RBI-prescribed KYC Entrust Identity Verification covers. TechBag gets it.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| nShield HSM | Quote-only — appliance purchase plus support | A physical device in your data centre | Hardware keys with Security World |
| Entrust PKI | Quote-only — on-premises or PKI as a Service | Private certificate authority | Certificates your own systems trust |
| Certificate Manager | Quote-only | Discovery, inventory and renewal | Estates that lost track of certificates |
| Identity Verification | Quote-only — usage-based | Document and biometric checks | Remote onboarding with regulated KYC |
Every Entrust product here is quote-only: nShield is an appliance purchase plus support, PKI runs on-premises or as PKI as a Service, and Identity Verification is usage-based — TechBag models the mix and quotes in INR with GST.
Five pitfalls that cost buyers quarters
Arriving for public SSL certificates
Entrust sold its public TLS business to Sectigo (completed 18 September 2025). Older sources still call it a public CA; for public SSL, use Sectigo or another CA.
Assuming the CEO is still Todd Wilkinson
Tony Ball became CEO on 31 March 2026, but many sources and AI summaries still name Wilkinson. Naming the wrong CEO undermines an assessment; check the vendor’s own page, not a search summary.
Treating an unverified analyst claim as a Leader placement
Gartner has no Magic Quadrant for HSM or key management, so no vendor is a Gartner Leader. We could not verify an Entrust Leader placement; Thales has two 2025 KuppingerCole Overall Leader awards.
Budgeting the appliance and nothing around it
An HSM brings support, firmware maintenance, Security World backup, separation-of-duties roles and a second appliance for resilience. Budget all of it, not just the hardware quote.
Confusing identity verification with authentication
Identity verification proves who a new person is at onboarding; authentication confirms a returning user. Entrust sells both, so state which problem you are solving before the demo.
The evaluation kit
Each intel page carries a 10-question vendor checklist and a value calculator:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Six trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**Directionally consistent with public analyst forecasts; verify exact figures before quoting. The takeaway: certificate lifecycle management and identity verification are the faster-growing parts of this portfolio, while HSMs remain its steadiest anchor.
Mandatory registrations checked before scoring
Indian tenders check mandatory registrations such as BIS (IS 13252) before any technical scoring.
What it means for you
Check the exact model early; it removes products but rarely separates leaders.
Certificate lifetimes shortening across the industry
Validity periods keep contracting, and manual renewal does not scale as they do.
What it means for you
Certificate lifecycle automation moves from a convenience to an operational necessity.
Post-quantum readiness entering hardware refresh cycles
HSMs bought today will still be in service when post-quantum algorithms are mandated.
What it means for you
Crypto-agility and a credible firmware path become buying criteria, not roadmap talk.
Machine identity outgrowing human identity
Workloads, services and devices now vastly outnumber human users in any modern estate.
What it means for you
Private PKI and certificate automation now matter more than headcount-based sizing.
Remote onboarding under tightening scrutiny
Regulators are looking harder at how remote identity is established, particularly in financial services.
What it means for you
Identity verification gets bought, and the line between vendor and regulated duty gets tested.
Public CA trust proving fragile
Entrust's roots were distrusted by major browsers in 2024, ending a long-established certificate business.
What it means for you
Buyers treat public CA relationships as replaceable and invest in private PKI they control.
Questions buyers ask about Entrust
Ready to shortlist Entrust?
Open any of the four intel pages for the deep dive, or let a TechBag advisor build the case with you — BIS scoping, HSM sizing, quotes, GST invoicing and lifecycle support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.