Thawte

Thawte
Name	Thawte
Founded	1995
Founder	Mark Shuttleworth
Headquarters	South Africa; later Canada; offices in United Kingdom, United States
Industry	Certificate Authority, Internet security
Products	SSL/TLS certificates, Code Signing, S/MIME
Fate	Acquired by VeriSign (1999); operations later part of Symantec and DigiCert

Thawte Thawte was a commercial certificate authority and digital certificate issuer founded in 1995 that played a formative role in the deployment of public key infrastructure on the World Wide Web. The organization issued SSL/TLS certificates, code-signing credentials, and S/MIME certificates, contributing to secure communications used by web browsers, e-commerce platforms, and software publishers. Through early adoption of internationalized operations and competitive pricing, the company influenced the practices of contemporaries and successors in the internet security industry.

History

Thawte was established in 1995 during the rise of the World Wide Web and Netscape Navigator era by entrepreneur Mark Shuttleworth and associates, positioning itself alongside entities such as RSA Security, Entrust, VeriSign, and CyberTrust. In the late 1990s Thawte expanded internationally to serve markets in South Africa, Canada, the United Kingdom, and the United States, competing with certificate authorities including Comodo, DigiCert, GlobalSign, and Let’s Encrypt predecessors. In 1999 Thawte was acquired by VeriSign in a transaction that paralleled other consolidation events in the dot-com period involving firms like Symantec Corporation and McAfee. Subsequent industry shifts saw assets and responsibilities related to Thawte integrated amid acquisitions by Symantec and later divestitures involving DigiCert and other incumbents such as GoDaddy and Sectigo. Throughout its trajectory, Thawte intersected with regulatory and standards bodies including the Internet Engineering Task Force and browser vendors such as Microsoft, Mozilla Foundation, Google, and Apple.

Products and Services

Thawte’s product line addressed website authentication, software publisher identity, and secure email. Flagship offerings included SSL/TLS certificates comparable to products from VeriSign and Entrust, as well as code-signing certificates used by developers working with ecosystems such as Microsoft Windows, Apple macOS, and open-source projects associated with Apache HTTP Server and Mozilla Firefox. Thawte supplied S/MIME certificates facilitating secure messaging interoperable with clients like Microsoft Outlook, Mozilla Thunderbird, and Apple Mail. The company provided validation levels—domain-validated, organization-validated, and extended validation—paralleling frameworks adopted by CA/Browser Forum participants such as DigiCert and GlobalSign. Thawte also offered management tools for certificate lifecycle tasks similar to those from Keyfactor and Venafi in later years.

Technology and Standards

Thawte implemented X.509 certificate structures standardized by the ITU-T and the IETF, aligning with protocols like TLS specified in RFCs authored by IETF working groups including the TLS Working Group and entities represented by contributors from OpenSSL and GnuTLS projects. The company supported cryptographic algorithms and key sizes consistent with guidance from bodies such as the National Institute of Standards and Technology and interoperated with browser root programs maintained by Mozilla Foundation, Microsoft, Apple, and Google. Thawte participated in industry dialogues at the CA/Browser Forum alongside peers like Symantec, Comodo, Entrust, and DigiCert to harmonize baseline requirements, certificate revocation mechanisms such as OCSP promoted by the IETF HTTPbis workstreams, and certificate transparency initiatives advocated by Google and implemented by log operators including Cloudflare and Akamai.

Security Incidents and Controversies

Over its lifespan, operations associated with Thawte were implicated in industry-wide security debates alongside incidents that affected other providers, including misissued certificates and trust-chain management controversies reminiscent of events involving DigiNotar, Comodo, Symantec, and Entrust. Browser vendors such as Google and Mozilla Foundation responded to CA misbehavior with policy changes that affected many legacy providers. Corporate decisions by parent companies like VeriSign and Symantec—and later remediation actions by DigiCert—triggered scrutiny from stakeholders including large platform operators such as Microsoft and enterprises reliant on certificate assurance for services deployed on infrastructures by Amazon Web Services and Google Cloud Platform.

Corporate Structure and Ownership

Initially privately held by founders including Mark Shuttleworth, Thawte’s ownership changed after its acquisition by VeriSign in 1999 for a transaction echoing consolidation in the late-1990s technology sector alongside deals involving firms like Netscape and AOL. Subsequent corporate reorganizations placed certificate operations under the umbrella of Symantec after additional mergers and purchases, and later ownership transitions resulted in certificate portfolios being transferred to entities such as DigiCert. These ownership changes involved interactions with corporate governance institutions and investor stakeholders comparable to high-profile transactions among Cisco Systems, Intel, and Microsoft divisions.

Market Impact and Legacy

Thawte influenced SSL/TLS adoption, pricing, and internationalization practices during the formative years of secure web commerce, alongside pioneers such as VeriSign, RSA Security, Entrust, and Comodo. Its competitive pricing and international roots helped spur broader acceptance of encrypted web traffic among platforms run by Yahoo!, eBay, Amazon merchants, and financial institutions like Bank of America and HSBC. Thawte-era practices informed subsequent CA/Browser Forum baseline requirements and contributed to the evolution toward automated issuance models championed by initiatives such as Let’s Encrypt. The legacy of Thawte persists in root certificates trusted by browser programs and in the commercial and technical precedents carried forward by successors including DigiCert and GlobalSign.

Category:Public key infrastructure Category:Certificate authorities