DigiCert and Entrust are the only two certificate authorities that issue BIMI Verified Mark Certificates. Both cost $1,000-1,500/year and require a registered trademark. DigiCert has a faster issuance process and better documentation. Entrust offers multi-year discounts. The certificates are functionally identical — choose based on your existing CA relationship and procurement process.
BIMI VMC: DigiCert vs Entrust — Which Certificate Authority to Choose
The Only Two Options
As of 2026, only DigiCert and Entrust issue Verified Mark Certificates for BIMI. No other certificate authority is authorized. The certificates are functionally identical — both satisfy Gmail's VMC requirement.
Side-by-Side Comparison
| Factor | DigiCert | Entrust |
|---|---|---|
| Annual cost | ~$1,299/yr | ~$1,299/yr |
| Multi-year discount | Limited | Yes |
| Issuance time | ~2 weeks | ~2-4 weeks |
| Trademark offices accepted | USPTO, EUIPO, CIPO, others | USPTO, EUIPO, CIPO, others |
| Documentation quality | Excellent | Good |
| Support | Strong | Strong |
| Portal experience | Modern, self-service | Enterprise-focused |
The VMC Process
Both CAs follow the same general process:
- Verify trademark ownership — your logo must be a registered trademark (not pending)
- Validate organization — similar to EV SSL validation
- Verify logo format — must be SVG Tiny PS
- Issue certificate — PEM file you host and reference in your BIMI record
The trademark verification is the bottleneck. Have your trademark registration number and documentation ready before you start.
Practitioner note: If your company already uses DigiCert for SSL/TLS certificates, go with DigiCert. Same portal, same billing, same support contacts. The convenience matters more than any minor pricing difference.
When to Choose DigiCert
- You already use DigiCert for other certificates
- You want the fastest possible issuance
- Your team prefers self-service portals
- Documentation and guides matter to you
When to Choose Entrust
- You already have an Entrust relationship
- You're purchasing multi-year and want volume discounts
- Your procurement team prefers enterprise sales processes
- You're buying VMCs for multiple domains
What You Need Before Ordering
Before starting with either CA:
- Registered trademark — active, not pending
- DMARC at enforcement —
p=quarantineorp=reject - SVG Tiny PS logo — formatted correctly (this causes the most delays)
- Organization validation docs — articles of incorporation, D-U-N-S number, etc.
Practitioner note: Logo format issues cause more VMC delays than anything else. Get your SVG Tiny PS validated with a BIMI checker tool before you submit to the CA. I've seen issuance stretch to 6 weeks because of repeated logo rejections.
The Bottom Line
Pick whichever CA you already work with. If you use neither, DigiCert has a slight edge on documentation and speed. But the certificate is identical — Gmail doesn't care which CA issued it.
If you need help with the full BIMI implementation — DMARC enforcement, logo formatting, VMC procurement, and DNS setup — reach out for a consultation.
Sources
- DigiCert: Verified Mark Certificates
- Entrust: Verified Mark Certificates
- BIMI Group: How to Get a VMC
v1.0 · April 2026
Frequently Asked Questions
How much does a BIMI VMC cost?
Both DigiCert and Entrust charge approximately $1,000-1,500 per year for a VMC. Multi-year purchases from Entrust may offer discounts. The VMC covers one trademark/logo per domain.
Do I need a trademark for a VMC?
Yes. Your logo must be a registered trademark with an intellectual property office recognized by the VMC issuer (like the USPTO, EUIPO, or CIPO). Pending applications don't qualify.
How long does VMC issuance take?
Typically 2-4 weeks. DigiCert averages closer to 2 weeks. Delays usually come from trademark verification or logo format issues, not the CA itself.
Want this handled for you?
Free 30-minute strategy call. Walk away with a plan either way.