ASSA ABLOY has agreed to sell HID’s public key infrastructure unit, home of the IdenTrust, HydrantID and ZeroSSL brands, to private equity firm Vista Equity Partners. For UK organisations that rely on those certificate authorities, a change of owner is a supplier risk event that deserves attention before the deal completes.
What happened
On 16 October 2026 the Swedish access and identity group ASSA ABLOY announced that it had signed an agreement to sell the PKI business unit of its HID subsidiary to Vista Equity Partners. The unit, which handles certificate issuance and management alongside identity and encryption services, brings together three recognisable names: IdenTrust, HydrantID and the ZeroSSL certificate service.
The announcement is light on numbers. No purchase price was given. ASSA ABLOY said the unit generated sales of roughly USD 58 million (about SEK 570 million) in 2025 and described its operating margin as strong. Completion depends on customary closing conditions, and the company expects the transaction to close in the fourth quarter of 2026.
Nico Delvaux, ASSA ABLOY’s chief executive, framed Vista as a “committed long-term investor” for the unit, its staff and its customers. Björn Lidefelt, who heads HID, said Vista had the expertise to develop the business as the market changes.
The detail
To understand why a mid-sized divestment matters to security teams, it helps to look at what these brands actually do. A certificate authority sits at the top of a chain of trust. Browsers, operating systems and applications ship with a list of root certificates they will accept, and every TLS certificate on a public website, every signed document and many client authentication schemes trace their validity back to one of those roots. If the organisation running a root makes mistakes, loses the trust of browser vendors, or changes how it operates, the effects travel downstream to every customer.
The three brands in this sale serve different parts of the market. IdenTrust is a long-established authority with a presence in identity credentials as well as server certificates. HydrantID offers managed certificate issuance and lifecycle tooling to enterprises. ZeroSSL is better known among developers and smaller organisations, and supports the ACME protocol, which automates issuance and renewal.
The timing is notable because the rules governing public TLS certificates are in the middle of a significant shift. In April 2025 the CA/Browser Forum, the industry body that sets baseline requirements for publicly trusted certificates, adopted ballot SC-081. It sets out a schedule that reduces the maximum lifetime of a public TLS certificate from 398 days to 47 days, with the reductions starting in March 2026 and finishing in March 2029. It also cuts the period for which domain validation evidence can be reused, eventually to just 10 days. The forum’s published results show IdenTrust was one of five certificate issuers that abstained, while Apple, Google, Microsoft and Mozilla all voted in favour.
The practical consequence is that renewal is turning from an annual chore into a near-continuous process. Organisations that still request and install certificates by hand will find that model increasingly unworkable over the next few years, and their dependence on automation, and on the authority behind it, will grow.
Why it matters for UK organisations
Most UK businesses do not choose their certificate authority deliberately. It arrives bundled with a hosting package, a managed service provider, a web application firewall or a developer’s preferred ACME client. That means plenty of organisations will be customers of IdenTrust, HydrantID or ZeroSSL without anyone in the security or procurement team knowing it.
A sale to private equity is not, in itself, a cause for alarm. However, ownership changes routinely bring revised pricing, new terms of service, product consolidation, rebranding or the retirement of free tiers. For anyone using a free certificate service in production, any shift in what is offered at no cost is the outcome to plan for.
There is also a governance dimension. Supplier and third-party risk is now a central theme for UK regulators and auditors, from the operational resilience expectations placed on financial services firms to the supply chain provisions in the Cyber Security and Resilience Bill. A certificate authority is a critical dependency: if certificates cannot be renewed, services go offline. Treating it as an invisible utility rather than a named supplier is a gap that a change of control helps to expose.
Expert view
In my experience, expired certificates remain one of the most avoidable causes of outages I come across, and they are rarely a technical failure. They are an ownership failure: nobody knows where the certificate came from, who receives the renewal emails, or which system relies on it. When we test external estates, certificates from several different authorities on the same domain are common, often reflecting years of decisions by different teams and suppliers.
The shrinking certificate lifetime makes that disorder more expensive. A 47-day ceiling, combined with short reuse windows for domain validation, means every renewal pipeline has to work first time, repeatedly. An organisation whose automation is tightly wired to one provider’s endpoints, account keys or API quirks has quietly accepted a concentration risk. If that provider changes ownership, terms or capabilities at an awkward moment, switching becomes a project rather than a configuration change.
I would not advise anyone to move away from these brands because of this deal. The point is to use it as a prompt. Crypto-agility, the ability to change certificate authority or algorithm without drama, has been talked about for years, mostly in the context of post-quantum cryptography. This deal offers a simpler, commercial reason to test it.
What to do now
- Build a certificate inventory. Use certificate transparency logs, external scanning and internal discovery to list every certificate in use, its issuer, expiry date and owner. Flag anything issued by IdenTrust, HydrantID or ZeroSSL.
- Identify the commercial relationship. Establish whether each certificate comes from a direct contract, a reseller, a managed service provider or a free tier. Contracts should be reviewed for change of control, pricing and termination clauses.
- Automate renewal and alerting. Move remaining manual certificates onto ACME or a certificate lifecycle management platform, and make sure expiry alerts go to a monitored team mailbox rather than an individual. This supports the Cyber Essentials secure configuration control.
- Prove you can switch. Configure and test a second certificate authority in at least one non-critical pipeline, and record the steps. Check that CAA DNS records permit any alternative you might need.
- Add the CA to your supplier register. Assign an owner, record criticality and set a review point once the transaction completes, revisiting terms and roadmap at that stage.
- Brief procurement and risk teams. Ensure they understand that certificate lifetimes are falling sharply and that renewal volumes, and possibly costs, will rise.
Bottom line
Vista’s purchase of HID’s PKI unit is a modest deal in financial terms, and nothing in the announcement suggests customers will see immediate change. Its value for UK security leaders is as a reminder that certificate authorities are suppliers like any other, and that the move to much shorter certificate lifetimes makes the ability to automate renewals and change provider a resilience requirement rather than a nice-to-have.
Sources
- ASSA ABLOY: ASSA ABLOY sells PKI business unit to Vista Equity Partners (press release, 16 October 2026)
- Placera: ASSA ABLOY sells PKI business unit to Vista Equity Partners
- Inderes: ASSA ABLOY sells PKI business unit to Vista Equity Partners
- Fundz: Vista Equity Partners to acquire HID’s PKI unit
- CA/Browser Forum: Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods
