HID Sells Its PKI Business to Vista Equity Partners

X (Twitter) Facebook Pinterest LinkedIn E-mail

HID, the identity and access control brand owned by Sweden’s ASSA ABLOY, has signed an agreement to sell its public key infrastructure (PKI) business unit to US investment firm Vista Equity Partners. The deal, announced on October 16, 2026, includes certificate authority IdenTrust, HydrantID, and SSL certificate issuer ZeroSSL. Neither side has disclosed the price, and the deal is expected to close in the fourth quarter of 2026.

HID’s PKI sale to Vista Equity Partners in 30 seconds

ASSA ABLOY is selling HID’s PKI unit to Vista: IdenTrust, HydrantID, and ZeroSSL.
The business generated $58 million in revenue in 2025, about 570 million Swedish kronor. The price has not been disclosed.
The deal is expected to close in the fourth quarter of 2026, pending customary closing conditions, regulatory approvals, and employee consultation.
HID is promising continuity for customers just as the maximum validity of TLS certificates begins to shrink.

ASSA ABLOY details the scope of the sale in its statement to the Stockholm Stock Exchange. Under the PKI-as-a-service (SaaS) label are IdenTrust and HydrantID, covering the issuance and management of public and private certificates. Added to that are on-premises credential and smart card lifecycle management, and ZeroSSL, the self-service SSL certificate service. The rest of HID — its cards, readers, and access control systems — stays within the group.

A small business within ASSA ABLOY

The numbers largely explain the decision. According to ASSA ABLOY, the unit being sold generated $58 million in revenue in 2025 with an operating margin it describes as “strong,” without giving a percentage. That’s a modest sum for a group whose core business is locks, doors, and access systems, and which has grown through acquisitions for decades. The statement doesn’t mention the number of employees affected or the accounting impact of the deal.

The assets came to the group through successive acquisitions. ASSA ABLOY acquired IdenTrust in January 2014, and in January 2024 HID added ZeroSSL, an Austrian company founded in 2020 that, according to HID, was issuing more than 500,000 certificates a month at the time and had more than 2.4 million user accounts. When announcing that acquisition, HID described it as another step in expanding its PKI and Internet of Things business. Less than three years later, that business is changing hands.

IdenTrust is no minor name in the recent history of the encrypted web. Its DST Root CA X3 root cross-signed Let’s Encrypt’s certificates during its early years, letting them work on older browsers and devices until that root expired in September 2021. To understand what role a certificate authority plays in the chain of trust, Cloud News explains what PKI is and why it matters for internet security.

What HID and Vista are saying, and what changes for customers

Björn Lidefelt, executive vice president and head of HID, said “our PKI team has built a strong business with a strong customer base” and that Vista “has the expertise to take it forward” as the market evolves. On the buyer’s side, Patrick Severson, senior managing director and co-head of Vista’s Foundation Fund, said the platform offers trusted identity solutions for regulated, compliance-focused organizations, and that the firm wants to build on that foundation.

The message to customers and partners is one of continuity: the same products, the same service, and the same commitments. Vista also says it will invest in the business’s people, products, and relationships. These are generic commitments, typical of this kind of announcement, and the statement doesn’t specify investment plans, rebranding, or the structure under which IdenTrust, HydrantID, and ZeroSSL will operate after closing. Vista, which manages more than $100 billion according to its own figures as of June 30, 2026, has been investing in software companies for more than 25 years.

A sale amid a sweeping cut to certificate lifespans

The deal comes at a delicate moment for the industry. The CA/Browser Forum, which brings together certificate authorities and browser makers, approved a staged reduction in 2025 to the maximum validity of public TLS certificates: 200 days starting March 15, 2026, 100 days starting March 2027, and 47 days starting March 2029. With renewals that frequent, managing certificates by hand stops being viable, and automation through protocols like ACME becomes mandatory in practice.

That context is what gives value to businesses like ZeroSSL, which competes with Let’s Encrypt in automated issuance, and to managed enterprise PKI platforms. Neither HID nor Vista explicitly ties the deal to that shift, but anyone relying on these services would do well to review their contracts and renewal automation during the transition, even if the public commitment is to keep everything the same. For systems teams managing certificates in their own environments, the sale is also a reminder that the provider behind the chain of trust can change owners without anything visibly changing in the browser.

Frequently asked questions

What did HID sell to Vista Equity Partners?

Its PKI business unit, which includes certificate authority IdenTrust, HydrantID, credential and smart card management, and the ZeroSSL SSL certificate service.

How much did Vista pay for HID’s PKI business?

The price hasn’t been made public. ASSA ABLOY has only disclosed that the unit generated $58 million in revenue in 2025.

When will the deal close?

It’s expected in the fourth quarter of 2026, subject to customary closing conditions, regulatory approvals, and employee consultation.

Does anything change for IdenTrust or ZeroSSL certificate users?

HID says customers will keep the same products, service, and commitments. No rebranding or changes to terms have been announced.

Sources: