Choosing a CLM solution: five levels from free ACME to enterprise

Level 1

Free ACME, where you build it yourself

Why free ACME

The certificates are free, the clients are mature, and for a public website with ACME built in it works well. Small and large organisations alike use it, and in a good share of cases it is the right answer.

Cost and complexity at level 1

No licence. In return you build validation, monitoring and management yourself, and there is nobody to call. The configuration lives on each server.

• Domain validation is the biggest risk. HTTP-01 needs port 80 reachable from the internet, which internal servers are not. DNS-01 avoids the port but needs an API token for your DNS provider on every server that renews, and that token can usually edit the whole zone.
• No central management and no monitoring. Every server has its own client and its own cron line. When a renewal fails, nothing happens, and a cron job that has stopped running looks exactly like one that is running.
• No fallback. Hit a rate limit, or find the issuer down just as a certificate needs renewing, and there is no second source to draw on.
• Restoring from backup hits a wall. Adding certificates a few at a time is easy enough, but replacing all of them at once, after a restore for instance, runs into the issuer's per-domain rate limits. The sites then will not open, and there is nothing to do but wait.
• Appliances are a job of their own. F5, FortiGate, NetScaler and much Cisco equipment do not have ACME built in yet, and where it has arrived the client is often locked to Let's Encrypt and needs an open port or DNS keys. Until they can do it themselves, the route goes through another server running scripts that push the certificate in over SSH or a REST API.
• Issuing is not installing. The certificate still has to reach the IIS binding, go into the keystore, be converted to PFX or JKS, land on the load balancer, and the service has to be restarted. That is work per system and per piece of software.

Solutions at level 1

• Let's Encrypt is the most widely used. DV only, 90-day validity, no account needed.
• Google Trust Services runs the same model on Google's infrastructure.
• ZeroSSL offers ACME plus a web interface for those who would rather click.
• cert-manager and AWS Certificate Manager are not a choice you make: if you run Kubernetes with cert-manager or sit behind an AWS load balancer, renewal is already handled there.

Move up to level 2 when

the certificate sits on something internal or critical, it needs monitoring, or it cannot validate over port 80 without you placing DNS keys on the server.

Level 4

The CAs' own platforms

Why the CA's own platform

The platform comes from the CA you already buy certificates from, and that is what sets this level apart. Where it runs varies: most are delivered as a service, but DigiCert ONE can also run on-premises, in-country or hybrid.

This is not just ACME in their cloud. The large platforms discover certificates across your network, run local agents on the servers that can take one and ACME for the rest, use proxy components to reach in behind the firewall, connect to your local CA, and offer SCEP for devices. They are also increasingly able to take in other CAs, not only their own.

Cost and complexity at level 4

The price is agreed individually and usually tracks your certificate volume with that CA, so it can look low if you already buy a lot there. In return you tie yourself to their ecosystem. When they say they support other CAs, ask in each case whether that means discovery, import, issuance or deployment, because those are not the same thing.

Solutions at level 4

• DigiCert ONE and Trust Lifecycle Manager form a container-based platform with separate managers for TLS, code signing, devices and documents, deployable in the cloud, in-country, on-premises or hybrid. Contact us for price and setup.
• GlobalSign has Atlas as the issuance layer, TLS Connect with discovery and agent or agentless deployment, and LifeCycleX, which also collects certificates from Microsoft CA and EJBCA. The only one with a jurisdiction outside the US among the CAs we are active on. Contact us for price and setup.
• Sectigo Certificate Manager has been marketed as CA-agnostic since 2021, and their universal ACME endpoint can issue from any ACME-compliant CA, provided validation is completed first.

Move up to level 5 when

certificate management has to be bought as part of a larger package, because PKI operations, signing, SSH keys or network automation belong in the same decision.

Level 5

Enterprise identity platform

Why an enterprise identity platform

Here certificate management is one module in a larger package covering machine identity and PKI, and the certificate part is rarely bought on its own. What else the package holds differs from vendor to vendor, and that is where the comparison belongs.

Cost and complexity at level 5

A negotiation and a design phase before anything is set up, at a price level that does not scale down. The purchase usually becomes a company decision about automation in general, not a technical decision about certificates.

Solutions at level 5

• Keyfactor goes wide on PKI. Command is a multi-CA CLM spanning public and private CAs, EJBCA is the CA software behind it with EST, SCEP, ACME and CMPv2, and PKI can be bought as a managed service.
• Venafi goes towards identity security. The product now sits in Palo Alto Networks' Idira platform, after CyberArk acquired Venafi and Palo Alto acquired CyberArk, alongside privileged access, secrets management and AI agent governance.
• AppViewX goes towards infrastructure automation. Certificate management is one module beside PKI, SSH keys, code signing and automation of load balancers and ADCs, with more than 200 integrations.

There is no level above this

Below a few hundred servers you pay for a platform substantially larger than the job. Price on request.