Certificate automation

Certificate automation and CLM: our solutions

FairSSL has developed two solutions for certificate automation, also known as Certificate Lifecycle Management (CLM). We also resell CLM solutions directly from the CAs GlobalSign and DigiCert.

This page gives the overview: what the three options are, which one suits which environment, and where you start. Both of our own solutions begin with a free account. At FairSSL you talk to engineers. We have no sales staff.

Three options

FairSSL ACME and sslbrain each cover their own kind of environment, and they can be used together. The CLM platforms from the CAs are for those who want the CA's own platform.

Cloud service

FairSSL ACME

Quick to start. You run an ACME client on each server, and the client orders, validates and renews the certificate with FairSSL. No appliance, no inbound ports to open and nothing to install besides the client.

Read about FairSSL ACME

Suited to: A smaller number of servers and devices where an ACME client is easy to keep running, or where the device has ACME built in.
What you operate yourself: One ACME client per server, or the device's built-in ACME. Domain validation runs through a single CNAME to AutoDNS, so no DNS keys sit on the servers.
Certificates: Paid DV and OV certificates from DigiCert, Thawte, GeoTrust and RapidSSL, as single-domain, SAN and wildcard.
Price: €33 per certificate per year on top of the certificate price. One fee covers up to 25 servers using the certificate. Reissues and SAN changes are included.
Getting started: Create a free FairSSL account, set up the CNAME and install the client following our guide. Then you are running.

Software in your network

sslbrain

Central management of a lot, mixed and difficult. sslbrain runs in your network as an appliance or in Docker and renews and installs certificates on servers, network devices and cloud services from one place.

How sslbrain renews and installs certificates automatically

Suited to: Those with a more complex environment or bigger demands on time savings and on managing devices: many servers, devices without ACME support or compliance requirements.
What you operate yourself: sslbrain as an appliance or in Docker, connected to sslbrain Cloud. Service agents on the servers, and API or SSH to network devices and cloud services without an agent. Private keys stay with you.
Certificates: Let's Encrypt, Google, DigiCert, Sectigo and GlobalSign built in, all other CAs with ACME through your own ACME source, and Windows CA and MitID Erhverv as add-ons.
Price: Free covers 5 servers, 10 installation plans, up to 2 domains and 1 user. Paid from EUR 2,990 per year excluding VAT for 50 servers. A server, load balancer, firewall or cloud service counts as one.
Getting started: Allow time to get started: the appliance has to be set up and configured before the first server is connected. Free uses sslbrain's preset certificate profile, and on the paid plans you choose your own CA sources. In return, the work per server drops from then on.

Resold by FairSSL

CLM directly from the CAs

The CAs' own platforms, for those who want the platform from the CA they already buy certificates from, or need discovery, a connection to their local CA and SCEP for devices in the same tool.

See the five levels of certificate management

DigiCert Trust Lifecycle Manager

A container-based platform in DigiCert ONE with separate managers for TLS, code signing, devices and documents. Runs in the cloud, in-country, on-premises or hybrid.

GlobalSign

Atlas as the issuance layer with ACME and EAB, TLS Connect with discovery and agent or agentless deployment, and LifeCycleX, which also collects certificates from Microsoft CA and EJBCA. The only one with a jurisdiction outside the US among the CAs we work with.

Price

The price is agreed individually and usually tracks your certificate volume with that CA. FairSSL supplies both platforms. Contact us for price and setup.

Which one suits you

There is no fixed limit on the number of servers. sslbrain becomes the right choice when the work of maintaining each server exceeds the price of central management, and that happens sooner when there are compliance requirements, devices without ACME support or difficult servers.

FairSSL ACME fits when

The servers can run an ACME client, or the device has ACME built in.
You want to get started without installing a central appliance and without opening inbound ports.
You want to validate domains through AutoDNS with one CNAME per domain, so the servers need no DNS API credentials.
Many certificates are concentrated on load balancers, firewalls or reverse proxy servers running an ACME client.
Devices without ACME can be handled from a server running an ACME client, or by hand following our guide.

sslbrain fits when

There are many servers, and the agent can be rolled out on Windows through MSI/GPO.
Certificates have to reach several push destinations, where sslbrain installs them without an agent.
There are difficult destinations such as F5, Kemp, FortiGate and Cisco.
The servers vary a great deal.
You have compliance requirements that private keys stay in your network, or need certificates from your Windows CA or MitID Erhverv alongside the public ones.
You can allow time to install the sslbrain appliance, connect the servers and set up certificate installation.

Every platform sslbrain installs certificates on (opens sslbrain.com in a new tab)

Devices with ACME: what the guides cover

FairSSL ACME reaches these devices either with built-in ACME or through a host running an ACME client. Each guide describes the limitation the device has.

FortiGate Built-in ACME for a single FQDN. Wildcards and multiple SAN names go through a host running lego or simple-acme.
Cisco ASA Has a field for the ACME server URL but no fields for EAB. Each device enrols with its own one-time URL.
Kemp LoadMaster Can use only one ACME server. If you have certificates from both Let's Encrypt and FairSSL/DigiCert, Kemp moves them all to that one. The guide has a host fetch the certificate and transfer it through Kemp's API.
NetScaler In our guide NetScaler does not fetch the certificates itself: a Windows server with simple-acme orders them and transfers them through the NITRO API. NetScaler Console with ACME or Zero Touch is a separate setup.

If you run into one of the limitations, sslbrain is easier for FortiGate, Kemp LoadMaster and NetScaler, because it installs the certificate on the device through its API.

Certificates and CAs

FairSSL ACME

Paid DV and OV certificates from DigiCert, Thawte, GeoTrust and RapidSSL, as single-domain, SAN and wildcard. The product is chosen centrally per profile, without touching the servers.

€33 per certificate per year on top of the certificate price. One fee covers up to 25 servers using the same certificate. That is an allowance for the fee, not a limit of the solution.

sslbrain

sslbrain uses both free and paid certificates and fails over automatically to another CA if the primary one fails.

Built in: Let's Encrypt, Google, DigiCert, Sectigo and GlobalSign.
Via ACME: All other CAs with ACME, such as ZeroSSL, Actalis, HARICA and Certum, as your own ACME source from Professional.
Windows CA (AD CS): Certificates from your own Windows CA for internal systems. Add-on to Enterprise.
MitID Erhverv: Server certificates from MitID Erhverv. Add-on to Enterprise.

Free certificates on all plans. Paid DV certificates from Basic, with certificate units bought in addition. Your own ACME source and a local ACME source from Professional. Windows CA and MitID Erhverv as add-ons to Enterprise.

sslbrain pricing

Four examples

Four environments as we know them from customers. The destinations and the work of looking after them decide the choice, not a particular number of servers.

FairSSL ACME

The usual choice when the destinations can use ACME.

7 servers and one firewall

6 Windows servers run IIS, Exchange, SharePoint, AD, ADFS, WAP and NAV/BC/CRM. There is also 1 Linux server and 1 firewall. A simple setup.

Why FairSSL ACME: with AutoDNS (one CNAME per domain) there are no DNS API credentials on the servers, and no firewall ports need opening to the internal servers.
1-2 proxy servers with 40+ certificates

1-2 servers act as load balancer, firewall or reverse proxy and handle 40+ certificates. There are also 5-7 ordinary Windows servers.

Why FairSSL ACME: the client on the proxy server renews all the certificates in one place, leaving only a few servers to look after.

A firewall or appliance without ACME support gets its certificate installed by following our guide, from a server running an ACME client or by hand. Once you have several of those, sslbrain starts to make sense. Guides: FortiGate, Cisco ASA, Kemp LoadMaster, NetScaler.

sslbrain

When central management saves more time than it takes to get started.

40 servers, 5 of them appliances

28 Windows servers, 7 Linux servers and 5 appliances. Without central management a general change takes more than a day, and the differences between the systems mean some servers and appliances need outside help.

Why sslbrain: certificates are managed centrally, the Windows agent can be rolled out through MSI/GPO, and supported devices get their certificate by push.
MSP with 40 servers across many sites

A small MSP runs 10 local servers, mainly for customers. There are also 10 external sites or DMZs with 2-4 servers per customer.

Why sslbrain: customers' certificates and renewals are managed in one place across local servers, external sites and DMZs.

They can be used together

You can use FairSSL ACME for destinations with ACME and sslbrain for the rest of the environment. sslbrain can both use free certificates and order paid DV certificates on the paid plans. If you already use FairSSL ACME, sslbrain may become relevant as the work on individual servers or the need for integrations grows.

Getting started

Both of our own solutions start free, and you can try them without talking to anyone. If in doubt, we go through your environment and say what fits, including when the answer is that you should not buy anything. At FairSSL you talk to engineers. We have no sales staff.

Create a free FairSSL account Install sslbrain Free Contact us

Questions about choosing

The questions we hear most when a customer is choosing between the solutions.

When is FairSSL ACME the right choice?

When you want to get started quickly without an appliance or opening inbound ports, want paid DV certificates from DigiCert, Thawte, GeoTrust or RapidSSL, and your destinations can use ACME. FairSSL ACME fits when an ACME client is easy to keep running on each server and there are not many destinations that need separate integrations. You run the ACME clients on the servers or use the device's built-in ACME.

When should we choose sslbrain over FairSSL ACME?

When you want to bring certificate management together across many, mixed or difficult destinations, or install on devices without an ACME client through sslbrain's integrations. It becomes relevant when maintaining each server costs more than central management, and that happens sooner with compliance requirements, devices without ACME support and difficult servers. Free certificates are included on all plans, and Let's Encrypt, Google, DigiCert, Sectigo and GlobalSign are built in. Your own ACME source requires Professional or Enterprise, and Windows CA and MitID Erhverv require Enterprise with the add-on.

Is there a limit to how many servers FairSSL ACME can be used for?

No. There is no fixed limit on the number of servers. The fee of €33 per certificate per year covers up to 25 servers using the same certificate, and that is an allowance for the fee, not for the solution. The limit lies in the work: when keeping an ACME client running on each server costs more than central management, sslbrain is the right choice.

Can we use FairSSL ACME and sslbrain at the same time?

Yes. FairSSL ACME for destinations with ACME and sslbrain for the rest of the environment. sslbrain can both use free certificates and order paid DV certificates on the paid plans, so you can also bring everything into sslbrain later if the work on individual servers grows.

When does a CLM platform from DigiCert or GlobalSign make sense?

When you want the platform from the CA you already buy certificates from, or need discovery, a connection to your local CA and SCEP for devices in the same tool. The price is agreed individually and usually tracks your certificate volume with that CA. FairSSL supplies DigiCert's and GlobalSign's platforms and helps you choose, including when the answer is that you should not buy a platform.