Entrust CA Distrust: What It Means and How Cloudflare Is Responding

Both Chrome and Mozilla have announced they will stop trusting public TLS certificates issued by Entrust after November 12, 2024 and December 1, 2024, respectively. The decision follows repeated concerns about Entrust's compliance with CA/Browser Forum baseline requirements, particularly around incident response. Over the past six years, Google cited a "pattern of compliance failures" from Entrust, with specific issues around failure to report critical problems and timely revocation of mis-issued certificates. Mozilla echoed these findings, emphasizing the need for accountability to maintain public trust in the certificate ecosystem.

In response, Entrust has partnered with SSL.com — a CA trusted by all major browsers — to issue certificates from SSL.com's roots for its customers. Cloudflare is now adding SSL.com as an available certificate authority within its managed certificate pipeline, allowing affected customers to automate issuance and renewal rather than handling certificates manually.

Why Browsers Distrust a CA

Publicly trusted CAs must adhere to strict security and compliance standards defined by the CA/Browser Forum. These baseline requirements cover certificate issuance, validation, and revocation — all intended to secure data transmitted over the internet. When mis-issuance occurs, CAs are expected to communicate issues immediately so domain owners can replace compromised certificates, and to revoke bad certificates within five days. This transparency is critical, as improperly issued certificates can be exploited to impersonate legitimate websites and intercept sensitive data.

The distrust decisions from Chrome and Mozilla stem from Entrust's failure to meet these expectations in several instances. Both browsers noted a persistent lack of urgency and transparency in Entrust's incident handling, which undermined confidence in the CA's ability to respond appropriately to compliance failures. Entrust has since announced organizational changes, revised incident response policies, and a push toward automation, alongside its SSL.com partnership.

SSL.com Now Available Through Cloudflare

Cloudflare customers using Advanced Certificate Manager can now select SSL.com as their certificate authority for Advanced certificates and Total TLS certificates. Once a certificate is issued through this pipeline, Cloudflare handles all renewals automatically. SSL.com certificates issued by default carry a 90-day validity period, with options for 14- or 30-day periods available through Advanced Certificate Manager. Enterprise customers can also request 1-year SSL.com certificates. Each order includes both an RSA and an ECDSA certificate.

The rollout is gradual, with the CA expected to appear for customers through the end of September and into October.

Validation Requirements

For customers using Cloudflare as their DNS provider, no additional steps are required — Cloudflare handles domain ownership validation for issuance and renewal. Customers with external DNS providers and wildcard hostnames will need to use DNS-based validation, which requires adding TXT DCV tokens at their DNS provider. Because SSL.com issues separate RSA and ECDSA certificates, two tokens are returned for every hostname on the certificate.

To minimize management overhead, Cloudflare recommends setting up DCV Delegation, which allows Cloudflare to place validation tokens on your behalf. Once configured, Cloudflare automatically issues, renews, and deploys all future certificates.

Selecting SSL.com via UI or API

Advanced Certificate Manager users can choose SSL.com as their CA through the dashboard UI or by specifying ssl_com in the certificate_authority parameter of the Advanced Certificate API endpoint. For customers wanting SSL.com across all certificates, Total TLS can be configured to use SSL.com as the CA, issuing an individual certificate for each proxied hostname. Note that Total TLS is only available to customers using Cloudflare as their DNS provider.

Enterprise customers using SSL for SaaS can select SSL.com through the custom hostname creation UI or the Custom Hostnames API endpoint, again specifying ssl_com in the certificate_authority parameter. All custom hostname certificates from SSL.com have a 90-day validity period. For wildcard support on custom hostnames, DCV Delegation is recommended to keep issuance and renewal automatic.

Moving Away from Manual Entrust Management

Cloudflare does not currently integrate directly with Entrust, so affected customers have been managing certificate issuance manually — obtaining certificates from Entrust, uploading them to Cloudflare as custom certificates, and repeating the process at each renewal. With certificate lifetimes decreasing from one year to 90 days, this manual lifecycle becomes increasingly burdensome and error-prone.

As Entrust shifts to issuing from SSL.com roots, this manual process remains in place unless customers move to Cloudflare's managed pipeline. Switching allows customers to continue receiving SSL.com certificates without managing issuance and renewal themselves. In early October, Cloudflare will contact customers who have uploaded Entrust certificates to recommend migrating to the managed SSL.com pipeline.

To make the transition now, navigate to the SSL/TLS tab in the Cloudflare dashboard, click "Order Advanced Certificate," and select "SSL.com" as your certificate authority. Once the new certificate is issued, you can remove the Entrust certificate or simply let it expire. Cloudflare will serve the managed SSL.com certificate before the Entrust certificate expires, ensuring no downtime during the switch.