sslbrain vs DigiCert Trust Lifecycle Manager
Short answer
DigiCert Trust Lifecycle Manager comes as Essentials, Advanced and Premium. Essentials automates with ACME, SCEP, Windows autoenrollment or APIs. Agents and sensors that install on servers, appliances and cloud services come with Advanced.1,2,3,4 Essentials has a public price per seat with a minimum of 25 seats. Advanced and Premium require a sales conversation.1,5 Data can be hosted in the EU by agreement.6,7
sslbrain runs as an appliance in your own network. The catalogue has 72 integrations. On Windows and Linux servers, a service agent installs the certificate. To network equipment and cloud services, the appliance pushes over API or SSH. Where there is no integration, you use a custom agent or ACME.
How to read the table
- Every answer about another vendor carries a small number. It leads to the source at the foot of the page, with the date the source was last checked.
- "Not stated" means it does not appear in the sources we reviewed. It does not mean no.
- Prices are in the vendor's own currency, not converted. Where only the yearly or the monthly price is stated, the other is calculated and marked.
- The sslbrain column has no source numbers. It comes from our own prices and our integration catalogue and links to those pages.
Every edition of DigiCert TLM and sslbrain
| Question | sslbrain | Essentials | Advanced | Premium |
|---|---|---|---|---|
| Price | ||||
| Price per year and per month | Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint. | |||
| Automation | ||||
| How the certificate gets there | Both agents/push and ACME Full answera service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH. | ACME/SCEP only1 Full answerACME, SCEP, Windows autoenrollment or APIs; fully managed automation with agents and sensors (servers, load balancers, appliances, cloud) is listed only from Advanced onwards | ||
| Direct agents and connectors | 72 integrations in the catalogue | Not stated | ||
| Without a direct agent | Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME | ACME with a third-party client, SCEP, Windows autoenrollment or APIs1 Full answeragent and sensor automation requires Advanced | The agent's delivery to a local folder with the customer's own post-scripts, customer-built plugins in the sensor, scripts from DigiCert's GitHub repository product-solutions (28 additional platforms), ACME with a third-party client or REST API4 | The agent's delivery to a local folder with the customer's own post-scripts, customer-built plugins in the sensor, scripts from DigiCert's GitHub repository product-solutions (28 additional platforms), ACME with a third-party client or REST API4 |
| Named systems | ||||
| FortiGate | Yes Full answerFortinet FortiGate: push from the appliance over the API, port 443 | Not stated | ||
| F5 BIG-IP | Yes Full answerF5 BIG-IP: push from the appliance over the API, port 443 | Not stated | Yes11 Full answerF5 BIG-IP LTM connector via DigiCert sensor | Yes11 Full answerF5 BIG-IP LTM connector via DigiCert sensor |
| NetScaler | Yes Full answerCitrix NetScaler / ADC: push from the appliance over the API, port 443 | Not stated | Yes12 Full answerCitrix ADC connector via DigiCert sensor | Yes12 Full answerCitrix ADC connector via DigiCert sensor |
| SonicWall | Yes Full answerSonicWall SonicOS: push from the appliance over the API, port 443 | Not stated | Not stated | Not stated |
| Palo Alto | Yes Full answerPalo Alto Networks PAN-OS: push from the appliance over the API, port 443 | Not stated | ||
| Check Point | Yes Full answerCheck Point HTTPS Inspection: push from the appliance over the API, port 443 | Not stated | Not stated | Not stated |
| Kemp LoadMaster | Yes Full answerKemp LoadMaster: push from the appliance over the API, port 443 | Not stated | ||
| Cisco | Yes Full answerCisco Secure Firewall (FDM): push from the appliance over the API, port 443 | Not stated | ||
| IIS | Yes Full answerMicrosoft IIS: service agent on the server | Yes4 Full answerDigiCert agent on the server or ACME with a third-party client | Yes4 Full answerDigiCert agent on the server or ACME with a third-party client | |
| Exchange | Yes Full answerMicrosoft Exchange: service agent on the server | Not stated | ||
| nginx and Apache | Yes Full answerNginx: service agent on the server; Apache HTTP Server: service agent on the server | Yes4 Full answerDigiCert agent on the server or ACME with a third-party client | Yes4 Full answerDigiCert agent on the server or ACME with a third-party client | |
| Tomcat (JKS) | Yes Full answerApache Tomcat: service agent on the server | Yes4 Full answerDigiCert agent for Apache Tomcat and Java KeyStore; ACME with a third-party client for Tomcat | Yes4 Full answerDigiCert agent for Apache Tomcat and Java KeyStore; ACME with a third-party client for Tomcat | |
| Azure Key Vault | Yes Full answerAzure Key Vault: push from the appliance over the API, port 443 | Not stated | Yes18 Full answerAzure Key Vault connector controlled by a DigiCert sensor | Yes18 Full answerAzure Key Vault connector controlled by a DigiCert sensor |
| AWS Certificate Manager | Yes Full answerAWS Certificate Manager: push from the appliance over the API, port 443 | Not stated | ||
| Push without an agent | ||||
| Push with no software on the destination | 50 destinations Show the list
| Not stated | 9 destinations Show the list
What the list covers: The vendor’s connector lists for appliances (3), cloud services (AWS and GCP) and vaults (Azure Key Vault); one row per product or service. Excluded: 28 platforms under "Other vendors and platforms" with scripts and plugins in DigiCert’s GitHub repository product-solutions (e.g. FortiGate, Palo Alto, Kemp, Exchange), which run as the agent’s post-script or as a plugin in the sensor; they are listed in 3.mangler and 5.*. Release notes from 10-2025 to 10-2026 add no new destinations.4 | 9 destinations Show the list
What the list covers: The vendor’s connector lists for appliances (3), cloud services (AWS and GCP) and vaults (Azure Key Vault); one row per product or service. Excluded: 28 platforms under "Other vendors and platforms" with scripts and plugins in DigiCert’s GitHub repository product-solutions (e.g. FortiGate, Palo Alto, Kemp, Exchange), which run as the agent’s post-script or as a plugin in the sensor; they are listed in 3.mangler and 5.*. Release notes from 10-2025 to 10-2026 add no new destinations.4 |
| Private keys | ||||
| Where the private key is kept | On-prem appliance |
| ||
| Network | ||||
| Servers with an agent or ACME | The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports | The ACME client on the server initiates the connection to DigiCert24 Full answerHTTP-01 validation requires inbound TCP 80 from DigiCert to the web server, DNS-01 via the DNS provider's API requires only outbound 443; TLS-ALPN-01 is not supported by DigiCert's ACME | ||
| Equipment without an agent | The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet | Not stated | ||
| Windows and Linux | ||||
| Windows | Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports | |||
| Linux | Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports | ACME with a third-party client on Apache, Nginx or Tomcat4 Full answerports as in 7a | ||
| Branch offices | ||||
| Remote sites and branch offices | One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports | Not stated | ||
| Vendor and EU | ||||
| Vendor | FairSSL A/S, Denmark | DigiCert, Inc., established in the USA with headquarters in Lehi, Utah26 | DigiCert, Inc., established in the USA with headquarters in Lehi, Utah26 | DigiCert, Inc., established in the USA with headquarters in Lehi, Utah26 |
| Hosting and the EU | EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud) | |||
sslbrain
Price
- Price per year and per month
- See the prices
Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint.
Automation
- How the certificate gets there
Both agents/push and ACME
Full answer
a service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH.
- Direct agents and connectors
- See the integrations
72 integrations in the catalogue
- Without a direct agent
Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME
Named systems
- FortiGate
Yes
Full answer
Fortinet FortiGate: push from the appliance over the API, port 443
- F5 BIG-IP
Yes
Full answer
F5 BIG-IP: push from the appliance over the API, port 443
- NetScaler
Yes
Full answer
Citrix NetScaler / ADC: push from the appliance over the API, port 443
- SonicWall
Yes
Full answer
SonicWall SonicOS: push from the appliance over the API, port 443
- Palo Alto
Yes
Full answer
Palo Alto Networks PAN-OS: push from the appliance over the API, port 443
- Check Point
Yes
Full answer
Check Point HTTPS Inspection: push from the appliance over the API, port 443
- Kemp LoadMaster
Yes
Full answer
Kemp LoadMaster: push from the appliance over the API, port 443
- Cisco
Yes
Full answer
Cisco Secure Firewall (FDM): push from the appliance over the API, port 443
- IIS
Yes
Full answer
Microsoft IIS: service agent on the server
- Exchange
Yes
Full answer
Microsoft Exchange: service agent on the server
- nginx and Apache
Yes
Full answer
Nginx: service agent on the server; Apache HTTP Server: service agent on the server
- Tomcat (JKS)
Yes
Full answer
Apache Tomcat: service agent on the server
- Azure Key Vault
Yes
Full answer
Azure Key Vault: push from the appliance over the API, port 443
- AWS Certificate Manager
Yes
Full answer
AWS Certificate Manager: push from the appliance over the API, port 443
Push without an agent
- Push with no software on the destination
- See the integrations
50 destinations
Show the list
- Akamai CPS (push from the appliance over the API, port 443)
- Aruba/HPE ClearPass (push from the appliance over the API, port 443)
- AWS Certificate Manager (push from the appliance over the API, port 443)
- AWS CloudFront (push from the appliance over the API, port 443)
- AWS ELB & API Gateway (push from the appliance over the API, port 443)
- Azure App Service (push from the appliance over the API, port 443)
- Azure Application Gateway (push from the appliance over the API, port 443)
- Azure Front Door (push from the appliance over the API, port 443)
- Azure Key Vault (push from the appliance over the API, port 443)
- Barracuda CloudGen Firewall (push from the appliance over the API, port 8443)
- Barracuda Web Application Firewall (push from the appliance over the API, port 8443)
- Bunny.net CDN (push from the appliance over the API, port 443)
- Check Point HTTPS Inspection (push from the appliance over the API, port 443)
- Cisco ASA / ASAv (push from the appliance over SSH, port 22)
- Cisco ISE (push from the appliance over the API, port 443)
- Cisco Secure Firewall (FDM) (push from the appliance over the API, port 443)
- Cisco Secure Firewall (FMC) (push from the appliance over the API, port 443)
- Citrix NetScaler / ADC (push from the appliance over the API, port 443)
- Cloudflare (push from the appliance over the API, port 443)
- Dell iDRAC (push from the appliance over the API, port 443)
- F5 BIG-IP (push from the appliance over the API, port 443)
- Fortinet FortiADC (push from the appliance over the API, port 443)
- Fortinet FortiGate (push from the appliance over the API, port 443)
- Fortinet FortiMail (push from the appliance over SSH, port 22)
- Fortinet FortiManager (push from the appliance over the API, port 443)
- Fortinet FortiNAC (push from the appliance over the API, port 8443)
- Fortinet FortiWeb WAF (push from the appliance over the API, port 443)
- Google Cloud Certificate Manager (push from the appliance over the API, port 443)
- HPE iLO (push from the appliance over the API, port 443)
- Infoblox NIOS Grid Manager (push from the appliance over the API, port 443)
- Ivanti Connect Secure (push from the appliance over the API, port 443)
- Juniper SRX / vSRX (push from the appliance over SSH, port 22)
- Kemp LoadMaster (push from the appliance over the API, port 443)
- Kubernetes (push from the appliance over the API, port 6443)
- NetApp ONTAP (push from the appliance over the API, port 443)
- OPNsense (push from the appliance over the API, port 443)
- Palo Alto Networks PAN-OS (push from the appliance over the API, port 443)
- pfSense (push from the appliance over SSH, port 22)
- Proxmox Backup Server (push from the appliance over the API, port 8007)
- Proxmox Mail Gateway (push from the appliance over the API, port 8006)
- Proxmox VE (push from the appliance over the API, port 8006)
- SonicWall SonicOS (push from the appliance over the API, port 443)
- Sophos Firewall (push from the appliance over the API, port 4444)
- Synology DSM (push from the appliance over the API, port 5001)
- TrueNAS SCALE / CORE (push from the appliance over the API, port 443)
- Ubiquiti UniFi (push from the appliance over SSH, port 22)
- VMware Avi / NSX ALB (push from the appliance over the API, port 443)
- VMware ESXi (push from the appliance over SSH, port 22)
- VMware vCenter (push from the appliance over the API, port 443)
- WatchGuard Firebox (Local: SSH 4118 · Cloud: HTTPS 443)
Private keys
- Where the private key is kept
- See the architecture
On-prem appliance
Network
- Servers with an agent or ACME
The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports
- Equipment without an agent
The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet
Windows and Linux
- Windows
Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports
- Linux
Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports
Branch offices
- Remote sites and branch offices
One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports
Vendor and EU
- Vendor
FairSSL A/S, Denmark
- Hosting and the EU
- See the infrastructure
EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud)
Essentials
Price
Automation
- How the certificate gets there
ACME/SCEP only1
Full answer
ACME, SCEP, Windows autoenrollment or APIs; fully managed automation with agents and sensors (servers, load balancers, appliances, cloud) is listed only from Advanced onwards
- Direct agents and connectors
Not stated
- Without a direct agent
ACME with a third-party client, SCEP, Windows autoenrollment or APIs1
Full answer
agent and sensor automation requires Advanced
Named systems
- FortiGate
Not stated
- F5 BIG-IP
Not stated
- NetScaler
Not stated
- SonicWall
Not stated
- Palo Alto
Not stated
- Check Point
Not stated
- Kemp LoadMaster
Not stated
- Cisco
Not stated
- Exchange
Not stated
- Azure Key Vault
Not stated
- AWS Certificate Manager
Not stated
Push without an agent
- Push with no software on the destination
Not stated
Private keys
- Where the private key is kept
- The destination4
Network
- Servers with an agent or ACME
The ACME client on the server initiates the connection to DigiCert24
Full answer
HTTP-01 validation requires inbound TCP 80 from DigiCert to the web server, DNS-01 via the DNS provider's API requires only outbound 443; TLS-ALPN-01 is not supported by DigiCert's ACME
- Equipment without an agent
Not stated
Windows and Linux
- Windows
- Linux
ACME with a third-party client on Apache, Nginx or Tomcat4
Full answer
ports as in 7a
Branch offices
- Remote sites and branch offices
Not stated
Vendor and EU
- Vendor
DigiCert, Inc., established in the USA with headquarters in Lehi, Utah26
Advanced
Price
Automation
- How the certificate gets there
- Direct agents and connectors
- Without a direct agent
The agent's delivery to a local folder with the customer's own post-scripts, customer-built plugins in the sensor, scripts from DigiCert's GitHub repository product-solutions (28 additional platforms), ACME with a third-party client or REST API4
Named systems
- FortiGate
- F5 BIG-IP
Yes11
Full answer
F5 BIG-IP LTM connector via DigiCert sensor
- NetScaler
Yes12
Full answer
Citrix ADC connector via DigiCert sensor
- SonicWall
Not stated
- Palo Alto
- Check Point
Not stated
- Kemp LoadMaster
- Cisco
- IIS
Yes4
Full answer
DigiCert agent on the server or ACME with a third-party client
- Exchange
- nginx and Apache
Yes4
Full answer
DigiCert agent on the server or ACME with a third-party client
- Tomcat (JKS)
Yes4
Full answer
DigiCert agent for Apache Tomcat and Java KeyStore; ACME with a third-party client for Tomcat
- Azure Key Vault
Yes18
Full answer
Azure Key Vault connector controlled by a DigiCert sensor
Push without an agent
- Push with no software on the destination
9 destinations
Show the list
- A10 (connector via DigiCert sensor)8,21
- Citrix ADC (NetScaler) (connector via DigiCert sensor, SSH 22 and HTTPS 443)8,12
- F5 BIG-IP LTM (connector via DigiCert sensor, SSH 22 and HTTPS 443)8,11
- AWS Certificate Manager (AWS unified connector via DigiCert sensor)19,20
- AWS Elastic Load Balancing (Application, Network and Classic Load Balancer)19,9
- Amazon CloudFront19
- Google Cloud Certificate Manager22
- Google Cloud load balancers (6 types)22,9
- Microsoft Azure Key Vault (connector controlled by DigiCert sensor)18
What the list covers: The vendor’s connector lists for appliances (3), cloud services (AWS and GCP) and vaults (Azure Key Vault); one row per product or service. Excluded: 28 platforms under "Other vendors and platforms" with scripts and plugins in DigiCert’s GitHub repository product-solutions (e.g. FortiGate, Palo Alto, Kemp, Exchange), which run as the agent’s post-script or as a plugin in the sensor; they are listed in 3.mangler and 5.*. Release notes from 10-2025 to 10-2026 add no new destinations.4
Private keys
Network
- Servers with an agent or ACME
Windows and Linux
- Windows
Branch offices
Vendor and EU
- Vendor
DigiCert, Inc., established in the USA with headquarters in Lehi, Utah26
Premium
Price
Automation
- How the certificate gets there
- Direct agents and connectors
- Without a direct agent
The agent's delivery to a local folder with the customer's own post-scripts, customer-built plugins in the sensor, scripts from DigiCert's GitHub repository product-solutions (28 additional platforms), ACME with a third-party client or REST API4
Named systems
- FortiGate
- F5 BIG-IP
Yes11
Full answer
F5 BIG-IP LTM connector via DigiCert sensor
- NetScaler
Yes12
Full answer
Citrix ADC connector via DigiCert sensor
- SonicWall
Not stated
- Palo Alto
- Check Point
Not stated
- Kemp LoadMaster
- Cisco
- IIS
Yes4
Full answer
DigiCert agent on the server or ACME with a third-party client
- Exchange
- nginx and Apache
Yes4
Full answer
DigiCert agent on the server or ACME with a third-party client
- Tomcat (JKS)
Yes4
Full answer
DigiCert agent for Apache Tomcat and Java KeyStore; ACME with a third-party client for Tomcat
- Azure Key Vault
Yes18
Full answer
Azure Key Vault connector controlled by a DigiCert sensor
Push without an agent
- Push with no software on the destination
9 destinations
Show the list
- A10 (connector via DigiCert sensor)8,21
- Citrix ADC (NetScaler) (connector via DigiCert sensor, SSH 22 and HTTPS 443)8,12
- F5 BIG-IP LTM (connector via DigiCert sensor, SSH 22 and HTTPS 443)8,11
- AWS Certificate Manager (AWS unified connector via DigiCert sensor)19,20
- AWS Elastic Load Balancing (Application, Network and Classic Load Balancer)19,9
- Amazon CloudFront19
- Google Cloud Certificate Manager22
- Google Cloud load balancers (6 types)22,9
- Microsoft Azure Key Vault (connector controlled by DigiCert sensor)18
What the list covers: The vendor’s connector lists for appliances (3), cloud services (AWS and GCP) and vaults (Azure Key Vault); one row per product or service. Excluded: 28 platforms under "Other vendors and platforms" with scripts and plugins in DigiCert’s GitHub repository product-solutions (e.g. FortiGate, Palo Alto, Kemp, Exchange), which run as the agent’s post-script or as a plugin in the sensor; they are listed in 3.mangler and 5.*. Release notes from 10-2025 to 10-2026 add no new destinations.4
Private keys
Network
- Servers with an agent or ACME
Windows and Linux
- Windows
Branch offices
Vendor and EU
- Vendor
DigiCert, Inc., established in the USA with headquarters in Lehi, Utah26
Sources
- 1. Trust Lifecycle Manager Pricing – Compare TLM Plans (digicert.com), checked 11-10-2026
- 2. DigiCert agents and sensors (docs.digicert.com), checked 10-10-2026
- 3. Track progress of certificate automation requests (docs.digicert.com), checked 10-10-2026
- 4. Integration guides for Trust Lifecycle Manager (docs.digicert.com), checked 11-10-2026
- 5. Licensing and plans (docs.digicert.com), checked 11-10-2026
- 6. Sign-in URL (docs.digicert.com), checked 11-10-2026
- 7. Quick start: Deploy a DigiCert agent — Windows (docs.digicert.com), checked 10-10-2026
- 8. Appliances (docs.digicert.com), checked 11-10-2026
- 9. Cloud services (docs.digicert.com), checked 11-10-2026
- 10. FortiGate Admin Web Request post-enrollment scripts (raw.githubusercontent.com), checked 11-10-2026
- 11. F5 BIG-IP LTM connector (docs.digicert.com), checked 10-10-2026
- 12. Citrix ADC connector (docs.digicert.com), checked 10-10-2026
- 13. Palo Alto Networks Certificate Automation Scripts (raw.githubusercontent.com), checked 11-10-2026
- 14. Kemp LoadMaster AWR Post-Enrollment Scripts (raw.githubusercontent.com), checked 11-10-2026
- 15. Cisco Firepower Management Center AWR Post-Enrollment Script (raw.githubusercontent.com), checked 11-10-2026
- 16. Cisco ISE Certificate Delivery AWR Post-Enrollment Script (raw.githubusercontent.com), checked 11-10-2026
- 17. Microsoft Exchange Server AWR Post-Enrollment Script (raw.githubusercontent.com), checked 11-10-2026
- 18. Azure Key Vault (docs.digicert.com), checked 11-10-2026
- 19. Amazon Web Services (AWS) (docs.digicert.com), checked 11-10-2026
- 20. Add an AWS unified connector (docs.digicert.com), checked 10-10-2026
- 21. A10 connector (docs.digicert.com), checked 11-10-2026
- 22. Google Cloud Platform (GCP) (docs.digicert.com), checked 11-10-2026
- 23. Fortinet FortiGate Automation Plugin (raw.githubusercontent.com), checked 11-10-2026
- 24. Dataflows and firewall rules (digicert.com), checked 10-10-2026
- 25. Quick start: Deploy a DigiCert sensor — Windows (docs.digicert.com), checked 10-10-2026
- 26. DigiCert Privacy Center (privacy.digicert.com), checked 10-10-2026
If you see an error about another vendor, write to us. We correct it and update the check date. Write to us
Try sslbrain
Start free. No credit card required.