sslbrain vs FairSSL ACME

Short answer

FairSSL ACME is an ACME server: the customer's own ACME client on the server or device obtains and installs the certificate.^1,2 The price is a yearly fee per main certificate that covers up to 25 servers and is added to the certificate price.^3,4 FairSSL is a Danish limited company, and its primary systems run at AWS in the EU.^5,6,7

sslbrain runs as an appliance in your own network. The catalogue has 72 integrations. On Windows and Linux servers, a service agent installs the certificate. To network equipment and cloud services, the appliance pushes over API or SSH. Where there is no integration, you use a custom agent or ACME.

How to read the table

Every answer about another vendor carries a small number. It leads to the source at the foot of the page, with the date the source was last checked.
"Not stated" means it does not appear in the sources we reviewed. It does not mean no.
Prices are in the vendor's own currency, not converted. Where only the yearly or the monthly price is stated, the other is calculated and marked.
The sslbrain column has no source numbers. It comes from our own prices and our integration catalogue and links to those pages.

Every edition of FairSSL ACME and sslbrain

The table scrolls sideways.

Question	sslbrain	FairSSL ACME
Price
Price per year and per month	Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint. See the prices	250 DKK per year^3,4 20.83 DKK per month (calculated) Unit: main certificate, covers up to 25 servers and is added to the certificate price (e.g. RapidSSL from 350 DKK per year) Minimum: 1 certificate, no minimum order
Automation
How the certificate gets there	Both agents/push and ACME Full answer a service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH.	ACME/SCEP only^1,2 Full answer FairSSL ACME is an ACME server (RFC 8555 with EAB and ARI); the customer's ACME client on the server or device retrieves and installs the certificate; for devices without ACME, the customer runs the client themselves on another host with a deployment script
Direct agents and connectors	72 integrations in the catalogue See the integrations	Not stated
Without a direct agent	Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME	The customer runs an ACME client on another Linux or Windows host, and a deployment script (FairSSL example scripts) sends the certificate to the device via API or SSH² Full answer for appliances without guidance, FairSSL refers to support. The control panel guide names 25 platforms for the customer's ACME client (list in kilder/2026-10-12-installationsmaal-liste.txt); they are not counted in 3.antal, as with the other CA-ACME packages
Named systems
FortiGate	Yes Full answer Fortinet FortiGate: push from the appliance over the API, port 443	Yes^2,8 Full answer FortiOS 7.6.3+: the device's built-in ACME client with EAB; older FortiOS: the customer's simple-acme or lego host sends the certificate to the device
F5 BIG-IP	Yes Full answer F5 BIG-IP: push from the appliance over the API, port 443	Yes² Full answer BIG-IP 21.1.0+: built-in ACME client with EAB, the FairSSL guide is awaiting feedback; older: lego and iControl REST from the customer's host
NetScaler	Yes Full answer Citrix NetScaler / ADC: push from the appliance over the API, port 443	Yes² Full answer simple-acme on the customer's Windows host deploys via NITRO REST API
SonicWall	Yes Full answer SonicWall SonicOS: push from the appliance over the API, port 443	Not stated
Palo Alto	Yes Full answer Palo Alto Networks PAN-OS: push from the appliance over the API, port 443	Not stated
Check Point	Yes Full answer Check Point HTTPS Inspection: push from the appliance over the API, port 443	Not stated
Kemp LoadMaster	Yes Full answer Kemp LoadMaster: push from the appliance over the API, port 443	Yes² Full answer lego on the customer's Linux host imports and binds the certificate via KEMP API
Cisco	Yes Full answer Cisco Secure Firewall (FDM): push from the appliance over the API, port 443	Yes³ Full answer Cisco ASA: built-in ACME client with a one-time URL without EAB; Cisco FDM/FTD 6.4+: lego on the customer's Linux host
IIS	Yes Full answer Microsoft IIS: service agent on the server	Yes⁹ Full answer simple-acme on the server with automatic IIS binding
Exchange	Yes Full answer Microsoft Exchange: service agent on the server	Yes⁹ Full answer simple-acme on the Exchange server with ImportExchange.v3.ps1
nginx and Apache	Yes Full answer Nginx: service agent on the server; Apache HTTP Server: service agent on the server	Yes¹⁰ Full answer lego, Certbot or acme.sh on the server; installation and reload
Tomcat (JKS)	Yes Full answer Apache Tomcat: service agent on the server	Yes³ Full answer Tomcat 8.5-11.x on Windows: simple-acme with ImportTomcat.ps1
Azure Key Vault	Yes Full answer Azure Key Vault: push from the appliance over the API, port 443	Yes^1,11 Full answer the third-party client Azure Key Vault Acmebot; simple-acme can also save the certificate in Azure Key Vault
AWS Certificate Manager	Yes Full answer AWS Certificate Manager: push from the appliance over the API, port 443	Yes¹ Full answer the customer's AWS Lambda runs lego and imports into ACM
Push without an agent
Push with no software on the destination	50 destinations Show the list Akamai CPS (push from the appliance over the API, port 443) Aruba/HPE ClearPass (push from the appliance over the API, port 443) AWS Certificate Manager (push from the appliance over the API, port 443) AWS CloudFront (push from the appliance over the API, port 443) AWS ELB & API Gateway (push from the appliance over the API, port 443) Azure App Service (push from the appliance over the API, port 443) Azure Application Gateway (push from the appliance over the API, port 443) Azure Front Door (push from the appliance over the API, port 443) Azure Key Vault (push from the appliance over the API, port 443) Barracuda CloudGen Firewall (push from the appliance over the API, port 8443) Barracuda Web Application Firewall (push from the appliance over the API, port 8443) Bunny.net CDN (push from the appliance over the API, port 443) Check Point HTTPS Inspection (push from the appliance over the API, port 443) Cisco ASA / ASAv (push from the appliance over SSH, port 22) Cisco ISE (push from the appliance over the API, port 443) Cisco Secure Firewall (FDM) (push from the appliance over the API, port 443) Cisco Secure Firewall (FMC) (push from the appliance over the API, port 443) Citrix NetScaler / ADC (push from the appliance over the API, port 443) Cloudflare (push from the appliance over the API, port 443) Dell iDRAC (push from the appliance over the API, port 443) F5 BIG-IP (push from the appliance over the API, port 443) Fortinet FortiADC (push from the appliance over the API, port 443) Fortinet FortiGate (push from the appliance over the API, port 443) Fortinet FortiMail (push from the appliance over SSH, port 22) Fortinet FortiManager (push from the appliance over the API, port 443) Fortinet FortiNAC (push from the appliance over the API, port 8443) Fortinet FortiWeb WAF (push from the appliance over the API, port 443) Google Cloud Certificate Manager (push from the appliance over the API, port 443) HPE iLO (push from the appliance over the API, port 443) Infoblox NIOS Grid Manager (push from the appliance over the API, port 443) Ivanti Connect Secure (push from the appliance over the API, port 443) Juniper SRX / vSRX (push from the appliance over SSH, port 22) Kemp LoadMaster (push from the appliance over the API, port 443) Kubernetes (push from the appliance over the API, port 6443) NetApp ONTAP (push from the appliance over the API, port 443) OPNsense (push from the appliance over the API, port 443) Palo Alto Networks PAN-OS (push from the appliance over the API, port 443) pfSense (push from the appliance over SSH, port 22) Proxmox Backup Server (push from the appliance over the API, port 8007) Proxmox Mail Gateway (push from the appliance over the API, port 8006) Proxmox VE (push from the appliance over the API, port 8006) SonicWall SonicOS (push from the appliance over the API, port 443) Sophos Firewall (push from the appliance over the API, port 4444) Synology DSM (push from the appliance over the API, port 5001) TrueNAS SCALE / CORE (push from the appliance over the API, port 443) Ubiquiti UniFi (push from the appliance over SSH, port 22) VMware Avi / NSX ALB (push from the appliance over the API, port 443) VMware ESXi (push from the appliance over SSH, port 22) VMware vCenter (push from the appliance over the API, port 443) WatchGuard Firebox (Local: SSH 4118 · Cloud: HTTPS 443) See the integrations	Not stated
Private keys
Where the private key is kept	On-prem appliance See the architecture	The destination¹² On-prem at the customer^2,13
Network
Servers with an agent or ACME	The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports	The customer's ACME client initiates an outbound connection over HTTPS to https://fairssl.dk/acme.^12,3 Full answer With AutoDNS, no inbound internet access is required; HTTP-01 requires port 80 to be open, TLS-ALPN-01 uses port 443
Equipment without an agent	The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet	No push from FairSSL.² Full answer With proxy + push, the customer's host initiates the connection to the device's management port and must have outbound internet access; port numbers are not stated
Windows and Linux
Windows	Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports	simple-acme 2.4.0+ in the FairSSL edition on Windows Server 2012 or later^14,11 Full answer the control panel generates the command, which also creates the daily scheduled task; FairSSL scripts for Exchange, RDS, SQL Server and others; ports only as required by the validation method
Linux	Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports	lego 5.0.4+ (recommended), Certbot or acme.sh on the server¹⁰ Full answer renewal via cron or systemd timer, reload via renew-hook; ports only as required by the validation method
Branch offices
Remote sites and branch offices	One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports	No gateway per site: each server runs its own ACME client with outbound HTTPS^3,2 Full answer with AutoDNS, neither DNS keys nor open ports are required. Devices without ACME require a host with network access to the device's management port. VPN requirements are not stated
Vendor and EU
Vendor	FairSSL A/S, Denmark	FairSSL A/S, a Danish public limited company, CVR 33075782, Åbrovej 29, 8586 Ørum Djurs, Denmark^5,6
Hosting and the EU	EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud) See the infrastructure	AWS in the EU: primary systems and database in eu-central-1 (Frankfurt, Germany), encrypted backups in eu-north-1 (Stockholm, Sweden)⁷ Full answer covers fairssl.dk, the control panel and the API. Other vendors may process data outside the EU

sslbrain

Price

Price per year and per month: Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint.

See the prices

Automation

How the certificate gets there: Both agents/push and ACME

Full answer

a service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH.
Direct agents and connectors: 72 integrations in the catalogue

See the integrations
Without a direct agent: Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME

Named systems

FortiGate: Yes

Full answer

Fortinet FortiGate: push from the appliance over the API, port 443
F5 BIG-IP: Yes

Full answer

F5 BIG-IP: push from the appliance over the API, port 443
NetScaler: Yes

Full answer

Citrix NetScaler / ADC: push from the appliance over the API, port 443
SonicWall: Yes

Full answer

SonicWall SonicOS: push from the appliance over the API, port 443
Palo Alto: Yes

Full answer

Palo Alto Networks PAN-OS: push from the appliance over the API, port 443
Check Point: Yes

Full answer

Check Point HTTPS Inspection: push from the appliance over the API, port 443
Kemp LoadMaster: Yes

Full answer

Kemp LoadMaster: push from the appliance over the API, port 443
Cisco: Yes

Full answer

Cisco Secure Firewall (FDM): push from the appliance over the API, port 443
IIS: Yes

Full answer

Microsoft IIS: service agent on the server
Exchange: Yes

Full answer

Microsoft Exchange: service agent on the server
nginx and Apache: Yes

Full answer

Nginx: service agent on the server; Apache HTTP Server: service agent on the server
Tomcat (JKS): Yes

Full answer

Apache Tomcat: service agent on the server
Azure Key Vault: Yes

Full answer

Azure Key Vault: push from the appliance over the API, port 443
AWS Certificate Manager: Yes

Full answer

AWS Certificate Manager: push from the appliance over the API, port 443

Push without an agent

Push with no software on the destination: 50 destinations

Show the list

Akamai CPS (push from the appliance over the API, port 443)
Aruba/HPE ClearPass (push from the appliance over the API, port 443)
AWS Certificate Manager (push from the appliance over the API, port 443)
AWS CloudFront (push from the appliance over the API, port 443)
AWS ELB & API Gateway (push from the appliance over the API, port 443)
Azure App Service (push from the appliance over the API, port 443)
Azure Application Gateway (push from the appliance over the API, port 443)
Azure Front Door (push from the appliance over the API, port 443)
Azure Key Vault (push from the appliance over the API, port 443)
Barracuda CloudGen Firewall (push from the appliance over the API, port 8443)
Barracuda Web Application Firewall (push from the appliance over the API, port 8443)
Bunny.net CDN (push from the appliance over the API, port 443)
Check Point HTTPS Inspection (push from the appliance over the API, port 443)
Cisco ASA / ASAv (push from the appliance over SSH, port 22)
Cisco ISE (push from the appliance over the API, port 443)
Cisco Secure Firewall (FDM) (push from the appliance over the API, port 443)
Cisco Secure Firewall (FMC) (push from the appliance over the API, port 443)
Citrix NetScaler / ADC (push from the appliance over the API, port 443)
Cloudflare (push from the appliance over the API, port 443)
Dell iDRAC (push from the appliance over the API, port 443)
F5 BIG-IP (push from the appliance over the API, port 443)
Fortinet FortiADC (push from the appliance over the API, port 443)
Fortinet FortiGate (push from the appliance over the API, port 443)
Fortinet FortiMail (push from the appliance over SSH, port 22)
Fortinet FortiManager (push from the appliance over the API, port 443)
Fortinet FortiNAC (push from the appliance over the API, port 8443)
Fortinet FortiWeb WAF (push from the appliance over the API, port 443)
Google Cloud Certificate Manager (push from the appliance over the API, port 443)
HPE iLO (push from the appliance over the API, port 443)
Infoblox NIOS Grid Manager (push from the appliance over the API, port 443)
Ivanti Connect Secure (push from the appliance over the API, port 443)
Juniper SRX / vSRX (push from the appliance over SSH, port 22)
Kemp LoadMaster (push from the appliance over the API, port 443)
Kubernetes (push from the appliance over the API, port 6443)
NetApp ONTAP (push from the appliance over the API, port 443)
OPNsense (push from the appliance over the API, port 443)
Palo Alto Networks PAN-OS (push from the appliance over the API, port 443)
pfSense (push from the appliance over SSH, port 22)
Proxmox Backup Server (push from the appliance over the API, port 8007)
Proxmox Mail Gateway (push from the appliance over the API, port 8006)
Proxmox VE (push from the appliance over the API, port 8006)
SonicWall SonicOS (push from the appliance over the API, port 443)
Sophos Firewall (push from the appliance over the API, port 4444)
Synology DSM (push from the appliance over the API, port 5001)
TrueNAS SCALE / CORE (push from the appliance over the API, port 443)
Ubiquiti UniFi (push from the appliance over SSH, port 22)
VMware Avi / NSX ALB (push from the appliance over the API, port 443)
VMware ESXi (push from the appliance over SSH, port 22)
VMware vCenter (push from the appliance over the API, port 443)
WatchGuard Firebox (Local: SSH 4118 · Cloud: HTTPS 443)

See the integrations

Private keys

Where the private key is kept: On-prem appliance

See the architecture

Network

Servers with an agent or ACME: The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports
Equipment without an agent: The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet

Windows and Linux

Windows: Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports
Linux: Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports

Branch offices

Remote sites and branch offices: One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports

Vendor and EU

Vendor: FairSSL A/S, Denmark
Hosting and the EU: EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud)

See the infrastructure

FairSSL ACME

Price

Price per year and per month

250 DKK per year^3,4

20.83 DKK per month (calculated)

Unit:: main certificate, covers up to 25 servers and is added to the certificate price (e.g. RapidSSL from 350 DKK per year)
Minimum:: 1 certificate, no minimum order

Automation

How the certificate gets there: ACME/SCEP only^1,2

Full answer

FairSSL ACME is an ACME server (RFC 8555 with EAB and ARI); the customer's ACME client on the server or device retrieves and installs the certificate; for devices without ACME, the customer runs the client themselves on another host with a deployment script
Direct agents and connectors: Not stated
Without a direct agent: The customer runs an ACME client on another Linux or Windows host, and a deployment script (FairSSL example scripts) sends the certificate to the device via API or SSH²

Full answer

for appliances without guidance, FairSSL refers to support. The control panel guide names 25 platforms for the customer's ACME client (list in kilder/2026-10-12-installationsmaal-liste.txt); they are not counted in 3.antal, as with the other CA-ACME packages

Named systems

FortiGate: Yes^2,8

Full answer

FortiOS 7.6.3+: the device's built-in ACME client with EAB; older FortiOS: the customer's simple-acme or lego host sends the certificate to the device
F5 BIG-IP: Yes²

Full answer

BIG-IP 21.1.0+: built-in ACME client with EAB, the FairSSL guide is awaiting feedback; older: lego and iControl REST from the customer's host
NetScaler: Yes²

Full answer

simple-acme on the customer's Windows host deploys via NITRO REST API
SonicWall: Not stated
Palo Alto: Not stated
Check Point: Not stated
Kemp LoadMaster: Yes²

Full answer

lego on the customer's Linux host imports and binds the certificate via KEMP API
Cisco: Yes³

Full answer

Cisco ASA: built-in ACME client with a one-time URL without EAB; Cisco FDM/FTD 6.4+: lego on the customer's Linux host
IIS: Yes⁹

Full answer

simple-acme on the server with automatic IIS binding
Exchange: Yes⁹

Full answer

simple-acme on the Exchange server with ImportExchange.v3.ps1
nginx and Apache: Yes¹⁰

Full answer

lego, Certbot or acme.sh on the server; installation and reload
Tomcat (JKS): Yes³

Full answer

Tomcat 8.5-11.x on Windows: simple-acme with ImportTomcat.ps1
Azure Key Vault: Yes^1,11

Full answer

the third-party client Azure Key Vault Acmebot; simple-acme can also save the certificate in Azure Key Vault
AWS Certificate Manager: Yes¹

Full answer

the customer's AWS Lambda runs lego and imports into ACM

Push without an agent

Push with no software on the destination: Not stated

Private keys

Where the private key is kept: The destination¹²
On-prem at the customer^2,13

Network

Servers with an agent or ACME: The customer's ACME client initiates an outbound connection over HTTPS to https://fairssl.dk/acme.^12,3

Full answer

With AutoDNS, no inbound internet access is required; HTTP-01 requires port 80 to be open, TLS-ALPN-01 uses port 443
Equipment without an agent: No push from FairSSL.²

Full answer

With proxy + push, the customer's host initiates the connection to the device's management port and must have outbound internet access; port numbers are not stated

Windows and Linux

Windows: simple-acme 2.4.0+ in the FairSSL edition on Windows Server 2012 or later^14,11

Full answer

the control panel generates the command, which also creates the daily scheduled task; FairSSL scripts for Exchange, RDS, SQL Server and others; ports only as required by the validation method
Linux: lego 5.0.4+ (recommended), Certbot or acme.sh on the server¹⁰

Full answer

renewal via cron or systemd timer, reload via renew-hook; ports only as required by the validation method

Branch offices

Remote sites and branch offices: No gateway per site: each server runs its own ACME client with outbound HTTPS^3,2

Full answer

with AutoDNS, neither DNS keys nor open ports are required. Devices without ACME require a host with network access to the device's management port. VPN requirements are not stated

Vendor and EU

Vendor: FairSSL A/S, a Danish public limited company, CVR 33075782, Åbrovej 29, 8586 Ørum Djurs, Denmark^5,6
Hosting and the EU: AWS in the EU: primary systems and database in eu-central-1 (Frankfurt, Germany), encrypted backups in eu-north-1 (Stockholm, Sweden)⁷

Full answer

covers fairssl.dk, the control panel and the API. Other vendors may process data outside the EU

When FairSSL ACME fits better

Your servers and devices already have ACME clients, and you want to buy the certificates and ACME in one place.^1,2,3,4
You want an ACME client on each server without a central component; with AutoDNS, neither DNS keys nor open ports are needed.^3,2

Sources

1. ACME-klienter testet med FairSSL (fairssl.dk), checked 11-10-2026
2. ACME på enheder: native eller proxy (fairssl.dk), checked 11-10-2026
3. SSL Automatisering, ACME-forside med priser og understøttede versioner (fairssl.dk), checked 11-10-2026
4. Administration og overvågning (fairssl.dk), checked 11-10-2026
5. Om os (fairssl.dk), checked 11-10-2026
6. Salgsbetingelser, gældende fra 20-03-2026 (fairssl.dk), checked 11-10-2026
7. Privatlivspolitik (fairssl.dk), checked 11-10-2026
8. Vejledning: FortiGate med ACME (fairssl.dk), checked 11-10-2026
9. Windows-opsætning (fairssl.dk), checked 11-10-2026
10. Linux- og Kubernetes-opsætning (fairssl.dk), checked 11-10-2026
11. Vejledning: simple-acme på Windows (fairssl.dk), checked 11-10-2026
12. Sådan virker ACME-protokollen hos FairSSL (fairssl.dk), checked 11-10-2026
13. Vejledning: Kemp LoadMaster (fairssl.dk), checked 11-10-2026
14. Platformside: Windows, IIS og Exchange (fairssl.dk), checked 11-10-2026

If you see an error about another vendor, write to us. We correct it and update the check date. Write to us

Try sslbrain

Start free. No credit card required.

Download sslbrain See the prices