DigiCert
Certificate authority issuing and managing TLS/SSL trust for websites.
On the record
Checkpoint: Scope review of April 2026 code-signing breach and any Mozilla/Chrome/Apple distrust proceedings
The call
DigiCert still anchors trust for 90% of the Fortune 500, but the April 2026 breach and shrinking certificate lifespans are testing how much slack that trust allows.
DigiCert sells digital certificates that prove websites and software are legitimate, earning recurring revenue from enterprises and governments that need this verification. It is hard to replace because browsers and operating systems have built DigiCert into their core trust systems over decades, and regulations like eIDAS require audited, certified companies to do this work, meaning a startup or AI tool cannot simply copy the business. However, a major breach in April 2026 where attackers stole DigiCert's signing certificates and used them to sign malware directly threatens the one thing DigiCert sells: trust. If customers lose confidence, or if regulators force browsers to distrust DigiCert the way they did Symantec years ago, the entire business collapses regardless of regulatory barriers.
Why
01
AI pressure: None apparent. AI agents and machine workloads need more certificates, not fewer, so automation growth feeds DigiCert rather than replacing it. Could AI do the core job? Unlikely.
02
Bigger players: Cloudflare (free SSL bundled with DNS/CDN) and Google/Apple (Browser Forum lifespan rules). Cloudflare bundles free certificates at scale, squeezing DigiCert's low end while browser makers force shorter certificate lifespans. Could a giant copy it? No, they are blocked.
03
What protects it. Root-of-trust status baked into every browser and OS, plus decades of audit history and eIDAS Qualified standing that can't be copied quickly.
What would change this call
Mozilla, Chrome, or Apple opens a formal distrust ticket against a DigiCert root certificate. Would show the April 2026 breach damaged DigiCert's core trust status, echoing Symantec's fate.
Clearlake, Crosspoint, or TA Associates announce a sale, IPO filing, or exit process for DigiCert. Would resolve years of overdue PE-hold uncertainty and clarify ownership stability.
DigiCert discloses scope/revocation details of the GoldenEyeDog code-signing breach or faces new litigation like the Alegeus case. Would indicate whether the breach stayed contained or triggered customer and legal fallout.
Clearlake, Crosspoint, or TA Associates announce a sale, IPO filing, or exit process for DigiCert. Would resolve years of overdue PE-hold uncertainty and clarify ownership stability.
DigiCert discloses scope/revocation details of the GoldenEyeDog code-signing breach or faces new litigation like the Alegeus case. Would indicate whether the breach stayed contained or triggered customer and legal fallout.
Key numbers
- Revenue estimated $419.7M-$440.8M
- FY2025 Q4 hit 104% of new contract value target
- Public TLS certificates now valid only 199 days
Named risks
- April 2026 breach involving stolen code-signing certificates used to sign malware, echoing Symantec/DigiNotar precedent.
- Browser distrust action against a DigiCert root would be existential given trust is the entire product.
- Shrinking certificate lifespans (199 days now, 47 days by 2029) could pressure manual-renewal revenue.
- PE ownership since 2015/2019/2021 overdue for exit, creating liquidity and organizational uncertainty within 6 to 18 months.
- Legal precedent from 2024 Alegeus lawsuit over forced certificate revocation exposes DigiCert to further litigation.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Cloudflare | losing to | Bundles free SSL and DNS at scale, compressing DigiCert's low end as of 2026 |
| Let's Encrypt | losing to | Free automated CA continues commoditizing domain-validated certificates through 2026 |
| Microsoft and Google | contesting | Both run native CA offerings and steer CA/Browser Forum policy affecting DigiCert's rules |
| Symantec (historical) | gaining on | DigiCert bought Symantec's distrusted SSL business for $1B in 2017 after browser distrust killed it |
| Entrust, GlobalSign, Sectigo, Keyfactor | contesting | Named as closest enterprise PKI competitors per July 13, 2026 compworth listing |
Questions people ask
- Is DigiCert profitable in 2026?
- DigiCert does not publicly disclose audited financials as a private company. Third-party estimates from ZoomInfo (July 2026) put annual revenue around $419.7M to $440.8M, but these are unaudited aggregator figures, not confirmed profit numbers from DigiCert itself.
- Who owns DigiCert?
- DigiCert is privately held. Thoma Bravo took a majority stake in 2015; Clearlake Capital Group and TA Associates became equal partners in 2019; Crosspoint Capital Partners joined as an owner in December 2021. No IPO plans are publicly reported as of mid-2026.
- Could AI replace DigiCert?
- AI can automate domain validation, issuance decisions, and support triage, but it cannot acquire root-of-trust status embedded in browser and OS trust stores or DigiCert's eIDAS Qualified Trust Service Provider standing, both required for enterprise PKI and unreplicable by a model alone.
- Was DigiCert breached in 2026?
- Yes. In April 2026, threat actors tracked as GoldenEyeDog compromised a DigiCert support analyst's device via a malicious chat-channel file and stole code-signing certificates later used to sign malware, reported by The Hacker News on July 20, 2026.
- Who is DigiCert's biggest competitor?
- Cloudflare pressures DigiCert's low end by bundling free SSL and DNS at scale, while Let's Encrypt commoditizes basic domain-validated certificates. Enterprise PKI rivals include Entrust, GlobalSign, Sectigo, and Keyfactor, per a July 13, 2026 competitor listing.
- What happened with DigiCert's code-signing certificates in the 2026 breach?
- Stolen code-signing certificates from the April 2, 2026 breach were used by attackers to sign malware, per a July 20, 2026 Hacker News report attributing the intrusion to a subgroup called GoldenEyeDog/CylindricalCanine.
Timeline
- 2026-07-20GoldenEyeDog breach linking stolen DigiCert code-signing certs to malware reported
- 2026-05-17DigiCert introduces AI Trust architecture across DigiCert ONE for AI agent verification
- 2026-05-12DigiCert wins Frost and Sullivan 2026 leadership recognition in DNS Security
- 2026-04-02GoldenEyeDog breach incident occurs, DigiCert code-signing certs stolen
- 2026-03-01Code-signing certificate validity reduced to 460 days industry-wide
- 2026-02-24DigiCert moves to 199-day validity for public TLS certificates
- 2025-10DigiCert raises $9.3M debt financing led by Runway Growth Capital
- 2025-09-16DigiCert acquires Valimail, adding zero-trust email authentication
- 2025-04-17DigiCert announces record FY2025 Q4 growth, 104% of NNACV target
- 2024-08-14DigiCert announces acquisition of Vercara, adding managed DNS/DDoS via UltraDNS
Revision history
21 July 2026
First assessed. Defensible for now. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- DigiCert - Overview, News & Similar companies (2026-07-13)
- DigiCert Achieves Record Growth in FY2025 (2025-04-17)
- DigiCert Receives Frost & Sullivan 2026 Recognition (2026-05-12)
- DigiCert Acquires Valimail (2025-09-16)
- Bad Certificate Revocation: DigiCert Offers Temporary Pause (2024-07-31)
- DigiCert Number of Employees 2026 (2026-06-29)
- DigiCert - Headcount, Funding & Open Jobs (2026-07-08)
- Crosspoint Capital Partners Completes Significant Strategic Investment in DigiCert (2021-12-14)
- DigiCert to Acquire Vercara (2024-08-14)
- Moving to 199-day validity for public TLS certificates (2026-02-27)
- Understanding the New Code-Signing Certificate Validity Change (2025-05-15)
- GoldenEyeDog Subgroup Linked to DigiCert Breach (2026-07-20)