Companies Using IdenTrust

I look after the crawler that reads the DNS of every domain we visit. A domain counts here when a TXT record contains identrust, which in practice means identrust_validate= or identrust_validation= followed by a code. Our October 2026 crawl puts that at 1,778 domains, 1,281 matched to a company, 9th in SSL/TLS Certificates. On 15 October 2026 I re-read the DNS of all 1,783 domains in our clean set and opened a TLS connection to each one, to see which validations are still in use.

What the record proves

Before a CA issues a certificate it has to confirm control of the domain, and the CA/Browser Forum's Baseline Requirements allow a random value published in a DNS TXT record for that (method 3.2.2.4.7). The value is good for 30 days, and a validation can be reused for at most 200 days. IdenTrust's version uses the identrust_validate prefix, and owners keep adding codes: 1,164 of the 1,783 domains carry two or more. The rule matches only IdenTrust's own records; I found no other TXT value containing the name.

Sales signal: a domain with several codes has renewed with IdenTrust more than once. That's a repeat buyer.

How much of it is current

1,754 of the 1,783 domains still carried the record, and 1,690 answered a TLS handshake. 1,046 (61.89%) served an IdenTrust certificate, 1,021 from the HydrantID Server CA O1 intermediate, 24 from TrustID Server CA O1 and 1 from another IdenTrust CA. Let's Encrypt served 239, Google Trust Services 169 and Amazon 106. A random draw of 50 gave 32 of 48, the same rate. That's high for a DNS record that outlives its certificate. One customer explains it.

"Most CA records I check are history. IdenTrust's are mostly live, because one hospital group keeps renewing hundreds of sites at once." - David Thomson, CTO at TechnologyChecker.io

Sales signal: IdenTrust is the incumbent on these domains. Expect renewal cycles and few open seats.

One customer is 42% of the count

HCA Healthcare runs its hospitals' and physician practices' websites centrally. 708 domains serve an IdenTrust certificate issued to HCA Information Technology and Services, shared certificates named after dotcms-*.hcahealthcare.com hosts, and 704 domains use the medcity.net nameservers that HCA's sites share. 656 show both, and together they cover 756 domains, 42.4% of the clean set. That's why health care is 47.71% of the industry chart and why 34.17% of matched companies have 10 or fewer staff: each practice has its own small LinkedIn page. Outside HCA, 338 of the 982 answering domains (34.42%) served IdenTrust, closer to what other CAs show.

Sales signal: treat HCA as one account with about 750 domains. A pitch to a single practice site won't reach the buyer, because the decision sits with HCA's IT organisation.

The rest of the base

The other subscribers are large and regulated. ING's certificates appear on 84 domains across its country banks, Xylem's on 41, Hub International's on 34 and Cisco's on 24. The US Department of Health and Human Services holds 18, including fda.gov. Insurers are 9.72% of matched companies, and 16.48% have more than 1,000 staff. The United States has 1,077 of the 1,203 matched companies.

Sales signal: this is an enterprise OV/EV list. Certificate lifecycle tools and managed PKI fit it better than cheap DV certificates.

No switching to report

We publish no migration table for IdenTrust. Only 13 domains dropped the record since we began tracking on 17 March 2026, and none still shows it on another hostname. Some domains carry other CAs' records as well: 133 have a QuoVadis record, 88 SwissSign and 65 GlobalSign. Those are parallel validations, not moves.

"Thirteen domains dropped the record in seven months. That's how slowly enterprise PKI changes." - David Thomson, CTO at TechnologyChecker.io

Sales signal: the 644 answering domains that kept the record but serve another issuer are the realistic openings, most of them now on Let's Encrypt, Google or Amazon certificates behind a CDN.

Records that point at ACME

Two domains carry a different kind of IdenTrust value: identrust.com; accounturi= followed by an IdenTrust ACME account address. That's CAA-style syntax, which restricts which CA account may issue for a domain, placed in a TXT record instead of a CAA record. It's rare, but it tells you IdenTrust also issues through ACME automation, the same protocol free CAs use. Everything else in the count is the identrust_validate family: 3,482 identrust_validate codes and 187 identrust_validation codes across the clean set.

Sales signal: a domain with an ACME account reference is already automating renewals, so pitch tooling, not certificates.

The stack around it

Across the 1,783 domains, Google Analytics runs on 55.13%, Snowplow Analytics on 23.16%, Securiti consent on 22.66% and Vercel Analytics on 11.33%, all heavily HCA. OneTrust (19.57%), Akamai (9.7%), Adobe Experience Manager (5.95%) and Sitecore (4.15%) describe the enterprise sites outside it.

Sales signal: a buyer with a consent platform, an enterprise CMS and a CDN contract is a buyer with a procurement process. Plan for long cycles.

What it costs

IdenTrust's TLS/SSL page lists an OV certificate from $199 and EV from $399, each for 184 days, and an ECA TLS/SSL OV certificate at $612 a year. Wildcards go to enterprise customers through HID PKIaaS. IdenTrust, part of HID Global and based in Salt Lake City, says on its about page that it has worked in digital trust for over 25 years.

Sales signal: IdenTrust's website sells no DV-only certificate, so most domains here were validated for an OV or EV order.

Key takeaways

1. 1,778 domains validated with IdenTrust; 61.89% of those answering still serve its certificate.

2. HCA Healthcare is 756 domains, 42.4% of the clean set.

3. Outside HCA, 34.42% still serve IdenTrust.

4. US, regulated, large: 1,077 of 1,203 matched companies are American.

5. Thirteen exits since March 2026.

How to use this list

Remove HCA's 756 domains first, then filter by industry and size. Our certificate authority market share report covers IdenTrust from the issuance side. The full list of 1,778 domains, with 1,281 matched companies, is on TechnologyChecker.io.