VMC Certificate Chain Does Not Terminate at a Trusted BIMI Root CA
“VMC certificate chain does not terminate at a trusted BIMI root CA” means the constructed VMC path does not end at a root in the receiver's trusted BIMI root set. The VMC draft requires the path to l
The exact error
VMC certificate chain does not terminate at a trusted BIMI root CAWhat Does “VMC Certificate Chain Does Not Terminate at a Trusted BIMI Root CA” Mean?
“VMC certificate chain does not terminate at a trusted BIMI root CA” means the constructed VMC path does not end at a root in the receiver's trusted BIMI root set. The VMC draft requires the path to lead to a root in the receiver's trusted BIMI root set. Fetch and Validation of Verified Mark Certificates draft 11 documents the controlling requirement or boundary.
VMC path validation returns an error. Trusted BIMI root membership is explicitly receiver-specific and can change.
Why Does VMC Certificate Chain Does Not Terminate at a Trusted BIMI Root CA Appear?
VMC certificate chain does not terminate at a trusted BIMI root CA appears when the wrong chain was served or the intended root is not accepted by that receiver for VMC validation. The exact diagnostic should be read at the scope of VMC trust anchor rather than as proof that every BIMI layer failed.
How Do You Fix VMC Certificate Chain Does Not Terminate at a Trusted BIMI Root CA?
To fix VMC certificate chain does not terminate at a trusted BIMI root CA, publish the issuer's correct chain when the served chain is wrong, or obtain a new Mark Certificate from a provider-accepted CA when the correct root is not trusted.
Republishing a correct chain cannot change the receiver's trust set.
What Should You Verify After Fixing VMC Certificate Chain Does Not Terminate at a Trusted BIMI Root CA?
After fixing VMC certificate chain does not terminate at a trusted BIMI root CA, perform path validation with the receiver's current BIMI trust configuration. Verification should use the exact public selector, URL, record, or file evaluated by the receiver.
The correction clears only this condition; it does not guarantee that a receiver will display an indicator.
Key Takeaways
- The affected object is VMC trust anchor.
- The direct correction is to publish the issuer's correct chain when the served chain is wrong, or obtain a new Mark Certificate from a provider-accepted CA when the correct root is not trusted.
- Republishing a correct chain cannot change the receiver's trust set.