Question 1

Does Entrust still sell SSL certificates?

Accepted Answer

No, and this is the first thing to establish because it is the most likely reason an evaluation here is wasted. Entrust sold its entire public TLS certificate business to Sectigo — announced January 2025, completed 18 September 2025 — after Chrome, Apple and Mozilla distrusted its public roots from November 2024 following a series of compliance failures. It did not rescue the business, partner its way out, or retain a portion. It exited. If what you need is publicly trusted SSL for an internet-facing site, Entrust is no longer the vendor and you should look at Sectigo or another public CA. Be careful here, because a great deal of material still says otherwise: documentation, blog posts, comparison articles and search summaries continue to describe Entrust as a public certificate authority, and much of it is well-ranked. It is out of date. What Entrust does still sell, and sells well, is different: private PKI for the certificates your own organisation issues and your own systems trust, certificate lifecycle management for discovering and renewing certificates across your estate, nShield hardware security modules, and identity verification built on Onfido. Private PKI in particular is easy to confuse with public TLS because they share vocabulary, and it was not part of the sale. If your requirement is internal machine identities, device certificates or internal TLS, you are in the right place.

Question 2

Does BIS certification settle the Thales comparison?

Accepted Answer

No, and it is worth being precise because this is widely misread. BIS registration under IS 13252 is the IT-equipment safety standard in the Bureau of Indian Standards' Compulsory Registration Scheme, mandatory for many IT products sold in India. Entrust's nShield Connect XC was registered in 2019, and Thales's Luna Network HSM product brief lists India BIS (IS 13252) as well. It is a safety registration rather than a security certification, and a gate both clear, so it cannot decide between them. Check it by model: ask for the certificate naming the exact appliance you will receive, since the 2019 certificate covers Connect XC and we have not confirmed the newer nShield 5c. The comparison turns on other things. Thales carries the stronger verified analyst position: two 2025 KuppingerCole Overall Leader awards, for Data Security Platforms and for Enterprise Secrets Management. Thales also has a broader software platform around the hardware — CipherTrust key management, transparent encryption and discovery — where Entrust's strength is more concentrated in the hardware, PKI and identity, with Security World's approach to resilience. Both have live India engineering. Neither has an India region for its managed HSM service, so the India answer for both is on-premises appliances with keys in your own building.

Question 3

Do we need hardware key custody at all, or is software enough?

Accepted Answer

Software key management under your control is genuinely sufficient for a large number of buyers, and we would rather say that plainly than sell you an appliance. It centralises keys, enforces access policy, handles rotation, and moves custody from a cloud provider to you — which covers most of what a general good-practice or DPDP-readiness driver actually requires. Hardware becomes the right answer when the requirement is that keys must never exist in software at all. That requirement usually arrives from one of three places: a regulator asking specifically about hardware key protection, a payments or PKI use case with an explicit HSM mandate, or an internal risk assessment concluding that a compromised host must not be able to yield key material. Indian BFSI, government and defence-adjacent buyers meet those conditions more often than most, which is why the question comes up here more than it would elsewhere. The honest cost of choosing hardware is that you are buying an appliance rather than software. There is a purchase price, a support contract, firmware maintenance on a security-critical device, backup of the Security World, separation-of-duties roles that did not previously exist, and a second unit elsewhere if you want to survive a site failure. All of it manageable, none of it free, and most of it absent from a first budget built around a hardware quote. If none of the three conditions applies to you, we will tell you so — that is a smaller sale for us and the right recommendation.

Question 4

Who runs Entrust, and is the company stable?

Accepted Answer

Tony Ball became chief executive on 31 March 2026, succeeding Todd Wilkinson, who led the company for seventeen years. We are stating this prominently because Wilkinson is still the answer most sources give, including search summaries and a good deal of secondary coverage, and a vendor assessment naming the wrong chief executive undermines confidence in everything else it says. Ownership is private and frequently got wrong too. Entrust is not owned by Thoma Bravo — that was true between 2009 and 2013, after which it was sold to Datacard. It is controlled through Datacard by Germany's Quandt family, with Stefan Quandt on the board since 1991. Entrust said in July 2025 that annual revenue had grown to over $1 billion; it has roughly 3,000 staff, and the company is headquartered in Shakopee, Minnesota. On stability, the honest picture is a company that took a serious hit and refocused rather than one in decline. Losing browser trust for its public roots in November 2024 ended a long-established certificate business, and selling it to Sectigo in September 2025 was a genuine narrowing of the portfolio. Against that, it completed the Onfido acquisition in April 2024, is actively hiring engineers in Bengaluru and Pune, and the remaining portfolio — HSMs, private PKI, certificate lifecycle, identity verification — is coherent rather than a collection of leftovers. Weigh it as a company that shed a business under pressure and still has a defensible one, not as a company being wound down.

Question 5

Can Entrust satisfy Indian data residency and DPDP?

Accepted Answer

Through on-premises deployment, yes, and the mechanism matters more than the marketing. nShield HSMs are physical appliances that live in your data centre, so keys are generated and held in hardware you own, in India, under your administrators. That is the strongest available answer to a residency question — the evidence is a serial number and an access log rather than a contract clause, and no cloud provider, vendor or administrator can extract the key material. Private PKI can equally be run on-premises. The constraint to know is that nShield as a Service, the managed HSM offering, has no India region — it runs in the UK, the US, Germany and Australia. So if you were hoping for a managed service inside Indian jurisdiction, that is not available, and the answer is appliances you operate. Practically this is the same conclusion as Thales, and for a regulated buyer it is usually the preferred one anyway. On DPDP specifically, the sequence matters more than the product: the Act's first practical question is where personal data lives, which is a discovery problem rather than a key-management one. Key custody addresses what happens once you have found it. And be precise about one thing this market blurs constantly — Entrust has live engineering hiring in Bengaluru and Pune, which is people in India, not data in India. Treating an engineering presence as a residency answer is the error that surfaces during an audit.

Question 6

Why buy Entrust through TechBag?

Accepted Answer

The pricing is the same. What changes is that we will tell you when this is the wrong purchase, and on this vendor there are three specific ways an evaluation goes wrong. First, you may be here for public SSL certificates, which Entrust stopped selling in September 2025. We will establish that in the first conversation rather than three demos in. Second, you may not need hardware at all — software key management under your control satisfies many requirements at a fraction of the cost and operational burden, and we sell products that do it. Third, Thales is a genuine alternative with a stronger verified analyst position — both hold BIS registration, so that will not decide it — and we sell that too. We are explicit about what we could not verify. Gartner publishes no Magic Quadrant for HSM or key management at all, so no vendor here has a Gartner Leader placement whatever a datasheet implies, and we could not confirm an HSM Leader placement for Entrust with any analyst. We would rather tell you a claim is unverified than repeat it. We budget the whole thing: appliance, support, firmware maintenance, Security World backup, separation-of-duties roles and the second unit for resilience — not just the hardware line. And the Indian commercials: INR invoicing from an Indian entity, GST charged correctly and available as input credit, no foreign remittance, no Form 15CA/CB, purchase-order handling, and renewal terms fixed contractually rather than left to float.

Product	Licensing model	How you enter	Best for
nShield HSM	Quote-only — appliance purchase plus support	A physical device in your data centre	Hardware key custody with Security World resilience
Entrust PKI	Quote-only — on-premises or PKI as a Service	Private certificate authority	Certificates your own systems trust
Certificate Manager	Quote-only	Discovery, inventory and renewal	Estates that have lost track of their certificates
Identity Verification	Quote-only — usage-based	Document and biometric checks	Remote onboarding, alongside regulated KYC

Entrust

Four intel pages. One cryptographic portfolio.

nShield HSM

Entrust PKI

Certificate Manager

Entrust Identity Verification

Public TLS certificates

nShield as a Service

Why “BIS registered” will not decide it

BIS registration, a gate every HSM must clear

Keys generated in hardware that never leaves your building

Security World, so resilience is designed in

The portfolio is narrower than it was, and we will say so

Analyst standing, stated conservatively

Peer & market recognition

BIS registration

Bengaluru & Pune

Onfido acquired

Over $1B revenue

Private, Quandt family

New CEO

Exited public TLS

Unverified

The company in six figures

See the platform, hear the pitch

Entrust nShield HSMs: On Another Level

What is a hardware security module (HSM)?

What is Entrust PKI?

Where Entrust sits — the grids

Entrust Across Its Platform

The Platform Breadth × Key Custody Map

New to this? Learn it properly.

Where should you start with Entrust?

What BIS registration does, and does not, decide

Entrust no longer sells public SSL certificates

Private PKI versus public TLS

The certificate that took down production

Key custody, DPDP and RBI

nShield against Luna, honestly

The acronym decoder

Buy it like you’ve done this before

Check BIS registration by model, then move on

Separate public TLS from private PKI before you scope

Decide whether hardware key custody is genuinely required

Plan Security World and the second appliance

Name the administrators and the approvers separately

Check the identity-verification regulatory boundary in writing

The licensing cheat-sheet

Five pitfalls that cost buyers quarters

Arriving for public SSL certificates

Assuming the CEO is still Todd Wilkinson

Treating an unverified analyst claim as a Leader placement

Budgeting the appliance and nothing around it

Confusing identity verification with authentication

The evaluation kit

Skip the homework entirely

The forces shaping this market

Category momentum — estimated market growth

Mandatory registrations checked before scoring

Certificate lifetimes shortening across the industry

Post-quantum readiness entering hardware refresh cycles

Machine identity outgrowing human identity

Remote onboarding under tightening scrutiny

Public CA trust proving fragile

Questions buyers ask about Entrust

Ready to shortlist Entrust?