sslbrain vs GlobalSign

Short answer

GlobalSign has five offerings: the ACME service on Atlas, TLS Connect Standard and Premium, Certificate Automation Manager (CAM) and LifeCycleX by GMO.^{1,2,3,4,5,6,7} Atlas ACME uses the customer's own ACME client. TLS Connect Premium renews and deploys on a schedule to servers with the TLS Connect agent and to integrated cloud platforms and network devices; in Standard, automatic renewal is through ACME only. CAM uses its own agent and Windows auto-enrollment through GPO. LifeCycleX uses a client on the web server and plugins.^{1,2,4,8,3,9,10,5,6,7} TLS Connect has public prices per installation with up to 100 certificates. The other offerings require a sales conversation.^3,4,2,6,11

sslbrain runs as an appliance in your own network. The catalogue has 72 integrations. On Windows and Linux servers, a service agent installs the certificate. To network equipment and cloud services, the appliance pushes over API or SSH. Where there is no integration, you use a custom agent or ACME.

How to read the table

Every answer about another vendor carries a small number. It leads to the source at the foot of the page, with the date the source was last checked.
"Not stated" means it does not appear in the sources we reviewed. It does not mean no.
Prices are in the vendor's own currency, not converted. Where only the yearly or the monthly price is stated, the other is calculated and marked.
The sslbrain column has no source numbers. It comes from our own prices and our integration catalogue and links to those pages.

Every edition of GlobalSign and sslbrain

The table scrolls sideways.

Question	sslbrain	Atlas ACME	TLS Connect Standard	TLS Connect Premium	Certificate Automation Manager	LifeCycleX
Price
Price per year and per month	Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint. See the prices	Not public, requires a sales conversation²	$699 per year^3,4 $58.25 per month (calculated) Unit: licence for one TLS Connect installation (machine-bound licence key), up to 100 certificates, list price excl. VAT Minimum: 1 licence	$3,000 per year^3,4 $250 per month (calculated) Unit: licence for one TLS Connect installation (machine-bound licence key), up to 100 certificates, list price excl. VAT Minimum: 1 licence	Not public, requires a sales conversation⁶	Not public, requires a sales conversation¹¹
Automation
How the certificate gets there	Both agents/push and ACME Full answer a service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH.	ACME/SCEP only^1,2 Full answer the customer's own ACME client connects via External Account Binding to the Atlas account and retrieves certificates from GlobalSign's ACME server; no GlobalSign agent or push	ACME/SCEP only^4,9,10 Full answer automatic renewal occurs only through TLS Connect's ACME solution (simple-acme on the same server); other issuance and deployment to endpoints is manual in Standard	Both agents/push and ACME^4,8,3 Full answer Automation Service on the TLS Connect server renews and deploys on a schedule to servers with a TLS Connect agent and to integrated cloud platforms and network devices (push); also ACME via simple-acme	Both agents/push and ACME^5,6 Full answer Cross-Platform Agent (XPA) on Windows, macOS and Linux and Windows auto-enrollment via GPO to CAM; also ACME and SCEP. Push to devices without an agent is not described	Agents and push⁷ Full answer LifeCycleX client on the web server and plugins for network devices and Azure Key Vault; GlobalSign states that ACME is not yet supported
Direct agents and connectors	72 integrations in the catalogue See the integrations	Not stated	5^12,13,9 Full answer IIS on the TLS Connect server and four integrations: F5 BIG-IP, AWS, Azure Key Vault, Google Cloud; delivery outside ACME is manual	10^12,14 Full answer IIS/Windows certificate store, Linux server with agent, nginx, Apache, HAProxy, Tomcat/JKS, F5 BIG-IP, AWS, Azure Key Vault, Google Cloud	3^5,15 Full answer Windows via GPO auto-enrollment and XPA, macOS and Linux via XPA; GlobalSign names no TLS server applications for CAM	4⁷ Full answer web server with a LifeCycleX client, F5 BIG-IP, Citrix NetScaler, Azure Key Vault
Without a direct agent	Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME	The customer's own ACME client¹⁶ Full answer GlobalSign has confirmed Certbot, win-acme, simple-acme, dehydrated, Certify The Web, acme.sh, Lego and Acmebot. Domains that cannot be validated via ACME can be validated by email in the Atlas portal	Manual deployment from TLS Connect, export of the certificate (PFX, PEM or JKS) or a custom script run after issuance in the ACME flow^13,8 Full answer automation with an agent and agentless scripts requires Premium	Agentless script (curl or PowerShell) that the customer runs and schedules on the target server, also for network equipment and load balancers that can run curl/PowerShell^14,3 Full answer PowerShell for other destinations	SCEP for mobile devices and network equipment and MDM (Intune, JAMF), ACME for the customer's own clients and CAM's API⁵	API or script as a workaround (e.g. AWS and Google Cloud)^7,17 Full answer Kubernetes via cert-manager; LifeCycleX's REST API
Named systems
FortiGate	Yes Full answer Fortinet FortiGate: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Not stated	Not stated
F5 BIG-IP	Yes Full answer F5 BIG-IP: push from the appliance over the API, port 443	Not stated	Yes^12,9 Full answer manual deployment from TLS Connect via the BIG-IP integration with the device's credentials	Yes^12,9 Full answer BIG-IP integration; an automation task on the TLS Connect server deploys	Not stated	Yes⁷ Full answer direct plugin in LifeCycleX
NetScaler	Yes Full answer Citrix NetScaler / ADC: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Not stated	Yes⁷ Full answer direct plugin in LifeCycleX
SonicWall	Yes Full answer SonicWall SonicOS: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Not stated	Not stated
Palo Alto	Yes Full answer Palo Alto Networks PAN-OS: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Not stated	Not stated
Check Point	Yes Full answer Check Point HTTPS Inspection: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Not stated	Not stated
Kemp LoadMaster	Yes Full answer Kemp LoadMaster: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Not stated	Not stated
Cisco	Yes Full answer Cisco Secure Firewall (FDM): push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Not stated	Not stated
IIS	Yes Full answer Microsoft IIS: service agent on the server	Yes¹⁸ Full answer the customer's ACME client; GlobalSign's Japanese guide: simple-acme installs and renews on IIS 10	Yes¹³ Full answer ACME via simple-acme with "Install to IIS automatically" on the TLS Connect server; otherwise manual binding	Yes^13,14 Full answer ACME with IIS installation, a TLS Connect agent, or an agentless PFX script that imports into Windows certificate store; the IIS binding is set manually the first time	Not stated	Not stated
Exchange	Yes Full answer Microsoft Exchange: service agent on the server	Not stated	Not stated	Not stated	Not stated	Not stated
nginx and Apache	Yes Full answer Nginx: service agent on the server; Apache HTTP Server: service agent on the server	Yes¹⁹ Full answer the customer's ACME client Certbot with --nginx or --apache; GlobalSign guides for Apache and nginx	Not stated	Yes¹⁴ Full answer agentless PEM script on the server, scheduled with cron, retrieves renewed server.pem and server.key and reloads nginx; initial configuration is manual	Not stated	Not stated
Tomcat (JKS)	Yes Full answer Apache Tomcat: service agent on the server	Not stated	Not stated	Yes¹⁴ Full answer agentless JKS script, scheduled with cron or Scheduled Task, retrieves a new keystore.jks and restarts Tomcat	Not stated	Not stated
Azure Key Vault	Yes Full answer Azure Key Vault: push from the appliance over the API, port 443	Yes^16,20 Full answer the customer's ACME client: Acmebot or az-acme CLI; GlobalSign has a Japanese guide for az-acme	Yes^13,10 Full answer Azure Key Vault integration; manual deployment or "Store in Azure Key Vault" in the ACME flow via a simple-acme plugin	Yes^13,9 Full answer Azure Key Vault integration; automation task or the ACME flow	Not stated	Yes⁷ Full answer direct plugin in LifeCycleX
AWS Certificate Manager	Yes Full answer AWS Certificate Manager: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Not stated	Not stated
Push without an agent
Push with no software on the destination	50 destinations Show the list Akamai CPS (push from the appliance over the API, port 443) Aruba/HPE ClearPass (push from the appliance over the API, port 443) AWS Certificate Manager (push from the appliance over the API, port 443) AWS CloudFront (push from the appliance over the API, port 443) AWS ELB & API Gateway (push from the appliance over the API, port 443) Azure App Service (push from the appliance over the API, port 443) Azure Application Gateway (push from the appliance over the API, port 443) Azure Front Door (push from the appliance over the API, port 443) Azure Key Vault (push from the appliance over the API, port 443) Barracuda CloudGen Firewall (push from the appliance over the API, port 8443) Barracuda Web Application Firewall (push from the appliance over the API, port 8443) Bunny.net CDN (push from the appliance over the API, port 443) Check Point HTTPS Inspection (push from the appliance over the API, port 443) Cisco ASA / ASAv (push from the appliance over SSH, port 22) Cisco ISE (push from the appliance over the API, port 443) Cisco Secure Firewall (FDM) (push from the appliance over the API, port 443) Cisco Secure Firewall (FMC) (push from the appliance over the API, port 443) Citrix NetScaler / ADC (push from the appliance over the API, port 443) Cloudflare (push from the appliance over the API, port 443) Dell iDRAC (push from the appliance over the API, port 443) F5 BIG-IP (push from the appliance over the API, port 443) Fortinet FortiADC (push from the appliance over the API, port 443) Fortinet FortiGate (push from the appliance over the API, port 443) Fortinet FortiMail (push from the appliance over SSH, port 22) Fortinet FortiManager (push from the appliance over the API, port 443) Fortinet FortiNAC (push from the appliance over the API, port 8443) Fortinet FortiWeb WAF (push from the appliance over the API, port 443) Google Cloud Certificate Manager (push from the appliance over the API, port 443) HPE iLO (push from the appliance over the API, port 443) Infoblox NIOS Grid Manager (push from the appliance over the API, port 443) Ivanti Connect Secure (push from the appliance over the API, port 443) Juniper SRX / vSRX (push from the appliance over SSH, port 22) Kemp LoadMaster (push from the appliance over the API, port 443) Kubernetes (push from the appliance over the API, port 6443) NetApp ONTAP (push from the appliance over the API, port 443) OPNsense (push from the appliance over the API, port 443) Palo Alto Networks PAN-OS (push from the appliance over the API, port 443) pfSense (push from the appliance over SSH, port 22) Proxmox Backup Server (push from the appliance over the API, port 8007) Proxmox Mail Gateway (push from the appliance over the API, port 8006) Proxmox VE (push from the appliance over the API, port 8006) SonicWall SonicOS (push from the appliance over the API, port 443) Sophos Firewall (push from the appliance over the API, port 4444) Synology DSM (push from the appliance over the API, port 5001) TrueNAS SCALE / CORE (push from the appliance over the API, port 443) Ubiquiti UniFi (push from the appliance over SSH, port 22) VMware Avi / NSX ALB (push from the appliance over the API, port 443) VMware ESXi (push from the appliance over SSH, port 22) VMware vCenter (push from the appliance over the API, port 443) WatchGuard Firebox (Local: SSH 4118 · Cloud: HTTPS 443) See the integrations	Not stated	4 destinations Show the list F5 BIG-IP (manual deployment from TLS Connect with the device's credentials; no scheduled automation in Standard)^12,9 AWS (manual deployment from TLS Connect via the cloud account's credentials; the service is not named)^12,9 Microsoft Azure Key Vault (manual deployment from TLS Connect via the integration)^12,9 Google Cloud (manual deployment via the integration; the service is not named)^12,9 What the list covers: The integration page is TLS Connect's consolidated list (F5 BIG-IP under Network Devices; AWS, Azure Key Vault and Google Cloud under Cloud Providers) and the data sheet mentions the same four for both licences. Not included: servers with a TLS Connect agent (software at the destination), agentless scripts that the customer runs and schedules themselves (see 3.antal and 3.mangler), and "Deploy Remote" to IIS, whose mechanism is not described^12,3	4 destinations Show the list F5 BIG-IP (an automation task on the TLS Connect server deploys with saved credentials)^12,8 AWS (automation task; the service is not named)^12,8 Microsoft Azure Key Vault (automation task on the TLS Connect server via the integration)^12,8 Google Cloud (automation task; the service is not named)^12,8 What the list covers: The integration page is TLS Connect's consolidated list (F5 BIG-IP under Network Devices; AWS, Azure Key Vault and Google Cloud under Cloud Providers) and the data sheet mentions the same four for both licences. Not included: servers with a TLS Connect agent (software at the destination), agentless scripts that the customer runs and schedules themselves (see 3.antal and 3.mangler), and "Deploy Remote" to IIS, whose mechanism is not described^12,3	Not stated	Not stated
Private keys
Where the private key is kept	On-prem appliance See the architecture	The destination^21,19	On-prem at the customer⁴	On-prem at the customer⁴	Not stated	Not stated
Network
Servers with an agent or ACME	The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports	The customer's ACME client connects outbound to GlobalSign's ACME server (HTTPS URL; port not stated).^21,19 Full answer For http-01, the ACME server retrieves a token over HTTP from the web server (inbound from the internet); dns-01 requires no inbound connection	The TLS Connect server (Windows) must have outbound internet access, and its IP address must be manually allowlisted by GlobalSign^10,4,13 Full answer ACME with http-01 requires the IIS site to be publicly accessible. Ports are not stated	As in Standard^14,10 Full answer the agents and agentless scripts also poll the TLS Connect hub on the internal network (port 5086), so the TLS Connect server must be able to receive inbound connections from endpoints. The agent checks every 3 seconds by default	Windows clients contact CAM’s enrollment policy server over HTTPS (XCEP)^15,22,23 Full answer XPA communicates with CAM via ACME or SCEP; CAM connects to a SQL database (the documentation’s example is TCP 1433). Ports to Atlas are not specified	Not stated
Equipment without an agent	The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet	Not stated	The TLS Connect server on the customer's network deploys to F5 and cloud accounts using the credentials stored in TLS Connect^24,12,14 Full answer protocol, ports and connection direction are not stated. Servers without an agent retrieve the certificate from the TLS Connect hub themselves (port 5086)	The TLS Connect server on the customer's network deploys to F5 and cloud accounts using the credentials stored in TLS Connect^24,12,14 Full answer protocol, ports and connection direction are not stated. Servers without an agent retrieve the certificate from the TLS Connect hub themselves (port 5086)	Not stated	Not stated
Windows and Linux
Windows	Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports	The customer's ACME client on Windows (e.g. simple-acme, win-acme, Certify The Web)^18,16 Full answer GlobalSign's Japanese guide shows installation and automatic renewal on IIS 10 with simple-acme	TLS Connect runs on Windows^4,13 Full answer The ACME flow can install in an IIS site on the server, otherwise the certificate is manually bound to local IIS sites or manually deployed with "Deploy Remote"	As in Standard¹⁴ Full answer also a TLS Connect agent (agent.exe as a Windows service) or an agentless PowerShell script with Scheduled Task, which retrieves PFX to C:\certs\server.pfx and imports into the Windows certificate store	Windows auto-enrollment via GPO with CAM as the enrollment policy server (XCEP)^15,5 Full answer alternatively the XPA agent	The LifeCycleX server requires an Active Directory domain and issues via AD certificate templates^7,25 Full answer The LifeCycleX client on the web server automates provisioning and configuration (the client’s OS is not specified)
Linux	Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports	The customer's ACME client (Certbot, acme.sh, dehydrated, Lego)¹⁹ Full answer Certbot can install in Apache and nginx	Manual export from TLS Connect (e.g. PEM or JKS) and copying to the server^13,8 Full answer automatic Linux deployment (agent, agentless) is under Automation, which requires Premium	TLS Connect agent on Linux or an agentless curl script with cron, which retrieves server.pem and server.key (or JKS for Tomcat) and reloads the web server¹⁴	The XPA agent on Linux⁵ Full answer ACME for the customer’s own clients on Linux servers	Not stated
Branch offices
Remote sites and branch offices	One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports	Not stated	One TLS Connect installation per machine with its own licence key⁴ Full answer multiple installations are permitted. Requirements for sites without a direct connection are not stated	The agent's target server must be on the same network as the TLS Connect server^14,4 Full answer other sites require their own TLS Connect installation with their own licence key or network access to the hub (VPN is not mentioned)	Multiple Active Directory forests require two-way trust for cross-forest enrollment^26,27 Full answer CAM can be installed on-premises, hybrid or in the cloud on the customer’s virtual machines	Multi-forest and multi-domain via proxy and remote LifeCycleX servers^7,25 Full answer scanning certificates in remote networks
Vendor and EU
Vendor	FairSSL A/S, Denmark	GMO GlobalSign NV/SA, Leuven, Belgium, is the data controller in the EU (GMO GlobalSign Ltd in the UK)^28,29,30,31 Full answer The GlobalSign companies are subsidiaries of GMO GlobalSign Holdings K.K. (Japan), which is a member of GMO Internet Group. Product announcements are issued by GMO GlobalSign, Inc. (USA)	GMO GlobalSign NV/SA, Leuven, Belgium, is the data controller in the EU (GMO GlobalSign Ltd in the UK)^28,29,30,31 Full answer The GlobalSign companies are subsidiaries of GMO GlobalSign Holdings K.K. (Japan), which is a member of GMO Internet Group. Product announcements are issued by GMO GlobalSign, Inc. (USA)	GMO GlobalSign NV/SA, Leuven, Belgium, is the data controller in the EU (GMO GlobalSign Ltd in the UK)^28,29,30,31 Full answer The GlobalSign companies are subsidiaries of GMO GlobalSign Holdings K.K. (Japan), which is a member of GMO Internet Group. Product announcements are issued by GMO GlobalSign, Inc. (USA)	GMO GlobalSign NV/SA, Leuven, Belgium, is the data controller in the EU (GMO GlobalSign Ltd in the UK)^28,29,30,31 Full answer The GlobalSign companies are subsidiaries of GMO GlobalSign Holdings K.K. (Japan), which is a member of GMO Internet Group. Product announcements are issued by GMO GlobalSign, Inc. (USA)	GMO GlobalSign NV/SA, Leuven, Belgium, is the data controller in the EU (GMO GlobalSign Ltd in the UK)^28,29,30,31 Full answer The GlobalSign companies are subsidiaries of GMO GlobalSign Holdings K.K. (Japan), which is a member of GMO Internet Group. Product announcements are issued by GMO GlobalSign, Inc. (USA)
Hosting and the EU	EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud) See the infrastructure	Atlas runs on AWS infrastructure²⁹ Full answer the subprocessor list states the location United Kingdom for Atlas customers (Japan for TrustLogIn customers) and Okta in Germany/Ireland for the Atlas portal login. GlobalSign's data centres are Tokyo, Singapore and London. An EU region for Atlas is not stated	TLS Connect runs on-prem on the customer's network^24,4 Full answer certificate orders, metadata and credentials are sent to Atlas or GCC (Atlas hosting: see the acme edition). GCC's hosting is not stated	TLS Connect runs on-prem on the customer's network^24,4 Full answer certificate orders, metadata and credentials are sent to Atlas or GCC (Atlas hosting: see the acme edition). GCC's hosting is not stated	Customer-installed (not SaaS in 2024) on virtual machines on-prem, hybrid or in the cloud, with Atlas as the CA platform (Atlas hosting: see the acme edition)^27,6	Only on-prem⁷ Full answer no SaaS edition. Certificate packages are purchased in GCC, whose hosting is not specified

sslbrain

Price

Price per year and per month: Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint.

See the prices

Automation

How the certificate gets there: Both agents/push and ACME

Full answer

a service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH.
Direct agents and connectors: 72 integrations in the catalogue

See the integrations
Without a direct agent: Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME

Named systems

FortiGate: Yes

Full answer

Fortinet FortiGate: push from the appliance over the API, port 443
F5 BIG-IP: Yes

Full answer

F5 BIG-IP: push from the appliance over the API, port 443
NetScaler: Yes

Full answer

Citrix NetScaler / ADC: push from the appliance over the API, port 443
SonicWall: Yes

Full answer

SonicWall SonicOS: push from the appliance over the API, port 443
Palo Alto: Yes

Full answer

Palo Alto Networks PAN-OS: push from the appliance over the API, port 443
Check Point: Yes

Full answer

Check Point HTTPS Inspection: push from the appliance over the API, port 443
Kemp LoadMaster: Yes

Full answer

Kemp LoadMaster: push from the appliance over the API, port 443
Cisco: Yes

Full answer

Cisco Secure Firewall (FDM): push from the appliance over the API, port 443
IIS: Yes

Full answer

Microsoft IIS: service agent on the server
Exchange: Yes

Full answer

Microsoft Exchange: service agent on the server
nginx and Apache: Yes

Full answer

Nginx: service agent on the server; Apache HTTP Server: service agent on the server
Tomcat (JKS): Yes

Full answer

Apache Tomcat: service agent on the server
Azure Key Vault: Yes

Full answer

Azure Key Vault: push from the appliance over the API, port 443
AWS Certificate Manager: Yes

Full answer

AWS Certificate Manager: push from the appliance over the API, port 443

Push without an agent

Push with no software on the destination: 50 destinations

Show the list

Akamai CPS (push from the appliance over the API, port 443)
Aruba/HPE ClearPass (push from the appliance over the API, port 443)
AWS Certificate Manager (push from the appliance over the API, port 443)
AWS CloudFront (push from the appliance over the API, port 443)
AWS ELB & API Gateway (push from the appliance over the API, port 443)
Azure App Service (push from the appliance over the API, port 443)
Azure Application Gateway (push from the appliance over the API, port 443)
Azure Front Door (push from the appliance over the API, port 443)
Azure Key Vault (push from the appliance over the API, port 443)
Barracuda CloudGen Firewall (push from the appliance over the API, port 8443)
Barracuda Web Application Firewall (push from the appliance over the API, port 8443)
Bunny.net CDN (push from the appliance over the API, port 443)
Check Point HTTPS Inspection (push from the appliance over the API, port 443)
Cisco ASA / ASAv (push from the appliance over SSH, port 22)
Cisco ISE (push from the appliance over the API, port 443)
Cisco Secure Firewall (FDM) (push from the appliance over the API, port 443)
Cisco Secure Firewall (FMC) (push from the appliance over the API, port 443)
Citrix NetScaler / ADC (push from the appliance over the API, port 443)
Cloudflare (push from the appliance over the API, port 443)
Dell iDRAC (push from the appliance over the API, port 443)
F5 BIG-IP (push from the appliance over the API, port 443)
Fortinet FortiADC (push from the appliance over the API, port 443)
Fortinet FortiGate (push from the appliance over the API, port 443)
Fortinet FortiMail (push from the appliance over SSH, port 22)
Fortinet FortiManager (push from the appliance over the API, port 443)
Fortinet FortiNAC (push from the appliance over the API, port 8443)
Fortinet FortiWeb WAF (push from the appliance over the API, port 443)
Google Cloud Certificate Manager (push from the appliance over the API, port 443)
HPE iLO (push from the appliance over the API, port 443)
Infoblox NIOS Grid Manager (push from the appliance over the API, port 443)
Ivanti Connect Secure (push from the appliance over the API, port 443)
Juniper SRX / vSRX (push from the appliance over SSH, port 22)
Kemp LoadMaster (push from the appliance over the API, port 443)
Kubernetes (push from the appliance over the API, port 6443)
NetApp ONTAP (push from the appliance over the API, port 443)
OPNsense (push from the appliance over the API, port 443)
Palo Alto Networks PAN-OS (push from the appliance over the API, port 443)
pfSense (push from the appliance over SSH, port 22)
Proxmox Backup Server (push from the appliance over the API, port 8007)
Proxmox Mail Gateway (push from the appliance over the API, port 8006)
Proxmox VE (push from the appliance over the API, port 8006)
SonicWall SonicOS (push from the appliance over the API, port 443)
Sophos Firewall (push from the appliance over the API, port 4444)
Synology DSM (push from the appliance over the API, port 5001)
TrueNAS SCALE / CORE (push from the appliance over the API, port 443)
Ubiquiti UniFi (push from the appliance over SSH, port 22)
VMware Avi / NSX ALB (push from the appliance over the API, port 443)
VMware ESXi (push from the appliance over SSH, port 22)
VMware vCenter (push from the appliance over the API, port 443)
WatchGuard Firebox (Local: SSH 4118 · Cloud: HTTPS 443)

See the integrations

Private keys

Where the private key is kept: On-prem appliance

See the architecture

Network

Servers with an agent or ACME: The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports
Equipment without an agent: The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet

Windows and Linux

Windows: Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports
Linux: Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports

Branch offices

Remote sites and branch offices: One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports

Vendor and EU

Vendor: FairSSL A/S, Denmark
Hosting and the EU: EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud)

See the infrastructure

Atlas ACME

Price

Price per year and per month: Not public, requires a sales conversation²

Automation

How the certificate gets there: ACME/SCEP only^1,2

Full answer

the customer's own ACME client connects via External Account Binding to the Atlas account and retrieves certificates from GlobalSign's ACME server; no GlobalSign agent or push
Direct agents and connectors: Not stated
Without a direct agent: The customer's own ACME client¹⁶

Full answer

GlobalSign has confirmed Certbot, win-acme, simple-acme, dehydrated, Certify The Web, acme.sh, Lego and Acmebot. Domains that cannot be validated via ACME can be validated by email in the Atlas portal

Named systems

FortiGate: Not stated
F5 BIG-IP: Not stated
NetScaler: Not stated
SonicWall: Not stated
Palo Alto: Not stated
Check Point: Not stated
Kemp LoadMaster: Not stated
Cisco: Not stated
IIS: Yes¹⁸

Full answer

the customer's ACME client; GlobalSign's Japanese guide: simple-acme installs and renews on IIS 10
Exchange: Not stated
nginx and Apache: Yes¹⁹

Full answer

the customer's ACME client Certbot with --nginx or --apache; GlobalSign guides for Apache and nginx
Tomcat (JKS): Not stated
Azure Key Vault: Yes^16,20

Full answer

the customer's ACME client: Acmebot or az-acme CLI; GlobalSign has a Japanese guide for az-acme
AWS Certificate Manager: Not stated

Push without an agent

Push with no software on the destination: Not stated

Private keys

Where the private key is kept: The destination^21,19

Network

Servers with an agent or ACME: The customer's ACME client connects outbound to GlobalSign's ACME server (HTTPS URL; port not stated).^21,19

Full answer

For http-01, the ACME server retrieves a token over HTTP from the web server (inbound from the internet); dns-01 requires no inbound connection
Equipment without an agent: Not stated

Windows and Linux

Windows: The customer's ACME client on Windows (e.g. simple-acme, win-acme, Certify The Web)^18,16

Full answer

GlobalSign's Japanese guide shows installation and automatic renewal on IIS 10 with simple-acme
Linux: The customer's ACME client (Certbot, acme.sh, dehydrated, Lego)¹⁹

Full answer

Certbot can install in Apache and nginx

Branch offices

Remote sites and branch offices: Not stated

Vendor and EU

Vendor: GMO GlobalSign NV/SA, Leuven, Belgium, is the data controller in the EU (GMO GlobalSign Ltd in the UK)^28,29,30,31

Full answer

The GlobalSign companies are subsidiaries of GMO GlobalSign Holdings K.K. (Japan), which is a member of GMO Internet Group. Product announcements are issued by GMO GlobalSign, Inc. (USA)
Hosting and the EU: Atlas runs on AWS infrastructure²⁹

Full answer

the subprocessor list states the location United Kingdom for Atlas customers (Japan for TrustLogIn customers) and Okta in Germany/Ireland for the Atlas portal login. GlobalSign's data centres are Tokyo, Singapore and London. An EU region for Atlas is not stated

TLS Connect Standard

Price

Price per year and per month

$699 per year^3,4

$58.25 per month (calculated)

Unit:: licence for one TLS Connect installation (machine-bound licence key), up to 100 certificates, list price excl. VAT
Minimum:: 1 licence

Automation

How the certificate gets there: ACME/SCEP only^4,9,10

Full answer

automatic renewal occurs only through TLS Connect's ACME solution (simple-acme on the same server); other issuance and deployment to endpoints is manual in Standard
Direct agents and connectors: 5^12,13,9

Full answer

IIS on the TLS Connect server and four integrations: F5 BIG-IP, AWS, Azure Key Vault, Google Cloud; delivery outside ACME is manual
Without a direct agent: Manual deployment from TLS Connect, export of the certificate (PFX, PEM or JKS) or a custom script run after issuance in the ACME flow^13,8

Full answer

automation with an agent and agentless scripts requires Premium

Named systems

FortiGate: Not stated
F5 BIG-IP: Yes^12,9

Full answer

manual deployment from TLS Connect via the BIG-IP integration with the device's credentials
NetScaler: Not stated
SonicWall: Not stated
Palo Alto: Not stated
Check Point: Not stated
Kemp LoadMaster: Not stated
Cisco: Not stated
IIS: Yes¹³

Full answer

ACME via simple-acme with "Install to IIS automatically" on the TLS Connect server; otherwise manual binding
Exchange: Not stated
nginx and Apache: Not stated
Tomcat (JKS): Not stated
Azure Key Vault: Yes^13,10

Full answer

Azure Key Vault integration; manual deployment or "Store in Azure Key Vault" in the ACME flow via a simple-acme plugin
AWS Certificate Manager: Not stated

Push without an agent

Push with no software on the destination: 4 destinations

Show the list

F5 BIG-IP (manual deployment from TLS Connect with the device's credentials; no scheduled automation in Standard)^12,9
AWS (manual deployment from TLS Connect via the cloud account's credentials; the service is not named)^12,9
Microsoft Azure Key Vault (manual deployment from TLS Connect via the integration)^12,9
Google Cloud (manual deployment via the integration; the service is not named)^12,9

What the list covers: The integration page is TLS Connect's consolidated list (F5 BIG-IP under Network Devices; AWS, Azure Key Vault and Google Cloud under Cloud Providers) and the data sheet mentions the same four for both licences. Not included: servers with a TLS Connect agent (software at the destination), agentless scripts that the customer runs and schedules themselves (see 3.antal and 3.mangler), and "Deploy Remote" to IIS, whose mechanism is not described^12,3

Private keys

Where the private key is kept: On-prem at the customer⁴

Network

Servers with an agent or ACME: The TLS Connect server (Windows) must have outbound internet access, and its IP address must be manually allowlisted by GlobalSign^10,4,13

Full answer

ACME with http-01 requires the IIS site to be publicly accessible. Ports are not stated
Equipment without an agent: The TLS Connect server on the customer's network deploys to F5 and cloud accounts using the credentials stored in TLS Connect^24,12,14

Full answer

protocol, ports and connection direction are not stated. Servers without an agent retrieve the certificate from the TLS Connect hub themselves (port 5086)

Windows and Linux

Windows: TLS Connect runs on Windows^4,13

Full answer

The ACME flow can install in an IIS site on the server, otherwise the certificate is manually bound to local IIS sites or manually deployed with "Deploy Remote"
Linux: Manual export from TLS Connect (e.g. PEM or JKS) and copying to the server^13,8

Full answer

automatic Linux deployment (agent, agentless) is under Automation, which requires Premium

Branch offices

Remote sites and branch offices: One TLS Connect installation per machine with its own licence key⁴

Full answer

multiple installations are permitted. Requirements for sites without a direct connection are not stated

Vendor and EU

Vendor: GMO GlobalSign NV/SA, Leuven, Belgium, is the data controller in the EU (GMO GlobalSign Ltd in the UK)^28,29,30,31

Full answer

The GlobalSign companies are subsidiaries of GMO GlobalSign Holdings K.K. (Japan), which is a member of GMO Internet Group. Product announcements are issued by GMO GlobalSign, Inc. (USA)
Hosting and the EU: TLS Connect runs on-prem on the customer's network^24,4

Full answer

certificate orders, metadata and credentials are sent to Atlas or GCC (Atlas hosting: see the acme edition). GCC's hosting is not stated

TLS Connect Premium

Price

Price per year and per month

$3,000 per year^3,4

$250 per month (calculated)

Unit:: licence for one TLS Connect installation (machine-bound licence key), up to 100 certificates, list price excl. VAT
Minimum:: 1 licence

Automation

How the certificate gets there: Both agents/push and ACME^4,8,3

Full answer

Automation Service on the TLS Connect server renews and deploys on a schedule to servers with a TLS Connect agent and to integrated cloud platforms and network devices (push); also ACME via simple-acme
Direct agents and connectors: 10^12,14

Full answer

IIS/Windows certificate store, Linux server with agent, nginx, Apache, HAProxy, Tomcat/JKS, F5 BIG-IP, AWS, Azure Key Vault, Google Cloud
Without a direct agent: Agentless script (curl or PowerShell) that the customer runs and schedules on the target server, also for network equipment and load balancers that can run curl/PowerShell^14,3

Full answer

PowerShell for other destinations

Named systems

FortiGate: Not stated
F5 BIG-IP: Yes^12,9

Full answer

BIG-IP integration; an automation task on the TLS Connect server deploys
NetScaler: Not stated
SonicWall: Not stated
Palo Alto: Not stated
Check Point: Not stated
Kemp LoadMaster: Not stated
Cisco: Not stated
IIS: Yes^13,14

Full answer

ACME with IIS installation, a TLS Connect agent, or an agentless PFX script that imports into Windows certificate store; the IIS binding is set manually the first time
Exchange: Not stated
nginx and Apache: Yes¹⁴

Full answer

agentless PEM script on the server, scheduled with cron, retrieves renewed server.pem and server.key and reloads nginx; initial configuration is manual
Tomcat (JKS): Yes¹⁴

Full answer

agentless JKS script, scheduled with cron or Scheduled Task, retrieves a new keystore.jks and restarts Tomcat
Azure Key Vault: Yes^13,9

Full answer

Azure Key Vault integration; automation task or the ACME flow
AWS Certificate Manager: Not stated

Push without an agent

Push with no software on the destination: 4 destinations

Show the list

F5 BIG-IP (an automation task on the TLS Connect server deploys with saved credentials)^12,8
AWS (automation task; the service is not named)^12,8
Microsoft Azure Key Vault (automation task on the TLS Connect server via the integration)^12,8
Google Cloud (automation task; the service is not named)^12,8

What the list covers: The integration page is TLS Connect's consolidated list (F5 BIG-IP under Network Devices; AWS, Azure Key Vault and Google Cloud under Cloud Providers) and the data sheet mentions the same four for both licences. Not included: servers with a TLS Connect agent (software at the destination), agentless scripts that the customer runs and schedules themselves (see 3.antal and 3.mangler), and "Deploy Remote" to IIS, whose mechanism is not described^12,3

Private keys

Where the private key is kept: On-prem at the customer⁴

Network

Servers with an agent or ACME: As in Standard^14,10

Full answer

the agents and agentless scripts also poll the TLS Connect hub on the internal network (port 5086), so the TLS Connect server must be able to receive inbound connections from endpoints. The agent checks every 3 seconds by default
Equipment without an agent: The TLS Connect server on the customer's network deploys to F5 and cloud accounts using the credentials stored in TLS Connect^24,12,14

Full answer

protocol, ports and connection direction are not stated. Servers without an agent retrieve the certificate from the TLS Connect hub themselves (port 5086)

Windows and Linux

Windows: As in Standard¹⁴

Full answer

also a TLS Connect agent (agent.exe as a Windows service) or an agentless PowerShell script with Scheduled Task, which retrieves PFX to C:\certs\server.pfx and imports into the Windows certificate store
Linux: TLS Connect agent on Linux or an agentless curl script with cron, which retrieves server.pem and server.key (or JKS for Tomcat) and reloads the web server¹⁴

Branch offices

Remote sites and branch offices: The agent's target server must be on the same network as the TLS Connect server^14,4

Full answer

other sites require their own TLS Connect installation with their own licence key or network access to the hub (VPN is not mentioned)

Vendor and EU

Vendor: GMO GlobalSign NV/SA, Leuven, Belgium, is the data controller in the EU (GMO GlobalSign Ltd in the UK)^28,29,30,31

Full answer

The GlobalSign companies are subsidiaries of GMO GlobalSign Holdings K.K. (Japan), which is a member of GMO Internet Group. Product announcements are issued by GMO GlobalSign, Inc. (USA)
Hosting and the EU: TLS Connect runs on-prem on the customer's network^24,4

Full answer

certificate orders, metadata and credentials are sent to Atlas or GCC (Atlas hosting: see the acme edition). GCC's hosting is not stated

Certificate Automation Manager

Price

Price per year and per month: Not public, requires a sales conversation⁶

Automation

How the certificate gets there: Both agents/push and ACME^5,6

Full answer

Cross-Platform Agent (XPA) on Windows, macOS and Linux and Windows auto-enrollment via GPO to CAM; also ACME and SCEP. Push to devices without an agent is not described
Direct agents and connectors: 3^5,15

Full answer

Windows via GPO auto-enrollment and XPA, macOS and Linux via XPA; GlobalSign names no TLS server applications for CAM
Without a direct agent: SCEP for mobile devices and network equipment and MDM (Intune, JAMF), ACME for the customer's own clients and CAM's API⁵

Named systems

FortiGate: Not stated
F5 BIG-IP: Not stated
NetScaler: Not stated
SonicWall: Not stated
Palo Alto: Not stated
Check Point: Not stated
Kemp LoadMaster: Not stated
Cisco: Not stated
IIS: Not stated
Exchange: Not stated
nginx and Apache: Not stated
Tomcat (JKS): Not stated
Azure Key Vault: Not stated
AWS Certificate Manager: Not stated

Push without an agent

Push with no software on the destination: Not stated

Private keys

Where the private key is kept: Not stated

Network

Servers with an agent or ACME: Windows clients contact CAM’s enrollment policy server over HTTPS (XCEP)^15,22,23

Full answer

XPA communicates with CAM via ACME or SCEP; CAM connects to a SQL database (the documentation’s example is TCP 1433). Ports to Atlas are not specified
Equipment without an agent: Not stated

Windows and Linux

Windows: Windows auto-enrollment via GPO with CAM as the enrollment policy server (XCEP)^15,5

Full answer

alternatively the XPA agent
Linux: The XPA agent on Linux⁵

Full answer

ACME for the customer’s own clients on Linux servers

Branch offices

Remote sites and branch offices: Multiple Active Directory forests require two-way trust for cross-forest enrollment^26,27

Full answer

CAM can be installed on-premises, hybrid or in the cloud on the customer’s virtual machines

Vendor and EU

Vendor: GMO GlobalSign NV/SA, Leuven, Belgium, is the data controller in the EU (GMO GlobalSign Ltd in the UK)^28,29,30,31

Full answer

The GlobalSign companies are subsidiaries of GMO GlobalSign Holdings K.K. (Japan), which is a member of GMO Internet Group. Product announcements are issued by GMO GlobalSign, Inc. (USA)
Hosting and the EU: Customer-installed (not SaaS in 2024) on virtual machines on-prem, hybrid or in the cloud, with Atlas as the CA platform (Atlas hosting: see the acme edition)^27,6

LifeCycleX

Price

Price per year and per month: Not public, requires a sales conversation¹¹

Automation

How the certificate gets there: Agents and push⁷

Full answer

LifeCycleX client on the web server and plugins for network devices and Azure Key Vault; GlobalSign states that ACME is not yet supported
Direct agents and connectors: 4⁷

Full answer

web server with a LifeCycleX client, F5 BIG-IP, Citrix NetScaler, Azure Key Vault
Without a direct agent: API or script as a workaround (e.g. AWS and Google Cloud)^7,17

Full answer

Kubernetes via cert-manager; LifeCycleX's REST API

Named systems

FortiGate: Not stated
F5 BIG-IP: Yes⁷

Full answer

direct plugin in LifeCycleX
NetScaler: Yes⁷

Full answer

direct plugin in LifeCycleX
SonicWall: Not stated
Palo Alto: Not stated
Check Point: Not stated
Kemp LoadMaster: Not stated
Cisco: Not stated
IIS: Not stated
Exchange: Not stated
nginx and Apache: Not stated
Tomcat (JKS): Not stated
Azure Key Vault: Yes⁷

Full answer

direct plugin in LifeCycleX
AWS Certificate Manager: Not stated

Push without an agent

Push with no software on the destination: Not stated

Private keys

Where the private key is kept: Not stated

Network

Servers with an agent or ACME: Not stated
Equipment without an agent: Not stated

Windows and Linux

Windows: The LifeCycleX server requires an Active Directory domain and issues via AD certificate templates^7,25

Full answer

The LifeCycleX client on the web server automates provisioning and configuration (the client’s OS is not specified)
Linux: Not stated

Branch offices

Remote sites and branch offices: Multi-forest and multi-domain via proxy and remote LifeCycleX servers^7,25

Full answer

scanning certificates in remote networks

Vendor and EU

Vendor: GMO GlobalSign NV/SA, Leuven, Belgium, is the data controller in the EU (GMO GlobalSign Ltd in the UK)^28,29,30,31

Full answer

The GlobalSign companies are subsidiaries of GMO GlobalSign Holdings K.K. (Japan), which is a member of GMO Internet Group. Product announcements are issued by GMO GlobalSign, Inc. (USA)
Hosting and the EU: Only on-prem⁷

Full answer

no SaaS edition. Certificate packages are purchased in GCC, whose hosting is not specified

When GlobalSign fits better

You want to roll out certificates through Windows auto-enrollment with GPO and an agent on Windows, macOS and Linux (CAM).^5,6,15
You need SCEP for mobile devices and network equipment, or MDM such as Intune and JAMF (Certificate Automation Manager).⁵

Sources

1. ACME (docs.globalsign.com), checked 11-10-2026
2. ACME - Automatic Certificate Management Environment (globalsign.com), checked 11-10-2026
3. TLS Connect Datasheet (storage.pardot.com), checked 11-10-2026
4. TLS Connect FAQs (docs.globalsign.com), checked 11-10-2026
5. Certificate Automation Manager Datasheet (storage.pardot.com), checked 11-10-2026
6. Certificate Automation Manager (globalsign.com), checked 11-10-2026
7. LifeCycleX FAQs (docs.globalsign.com), checked 11-10-2026
8. TLS Connect Automation (docs.globalsign.com), checked 11-10-2026
9. TLS Connect License Key Management with Product Packages (docs.globalsign.com), checked 11-10-2026
10. TLS Connect Software Installation (docs.globalsign.com), checked 11-10-2026
11. LifeCycleX by GMO (globalsign.com), checked 11-10-2026
12. TLS Connect Integrations (docs.globalsign.com), checked 11-10-2026
13. TLS Connect Certificate Management (docs.globalsign.com), checked 11-10-2026
14. TLS Connect Agent/Agentless Deployment (docs.globalsign.com), checked 11-10-2026
15. Edit a GPO for Certificate Enrollment (docs.globalsign.com), checked 11-10-2026
16. ACME FAQs (docs.globalsign.com), checked 11-10-2026
17. GMO GlobalSign Debuts LifeCycleX (globalsign.com), checked 11-10-2026
18. IIS + simple-acme (docs.globalsign.com), checked 11-10-2026
19. ACME Certificate Management (docs.globalsign.com), checked 11-10-2026
20. Azure Key Vault + AZ ACME (docs.globalsign.com), checked 11-10-2026
21. ACME Getting Started (docs.globalsign.com), checked 11-10-2026
22. GlobalSign's AEG 6.4 Features ... First Cross-Platform Enrollment Agent (globalsign.com), checked 11-10-2026
23. Test Connectivity and Permissions to Database Server (docs.globalsign.com), checked 11-10-2026
24. TLS Connect (docs.globalsign.com), checked 11-10-2026
25. LifeCycleX Datasheet (storage.pardot.com), checked 11-10-2026
26. Check the Functional Levels in Active Directory (docs.globalsign.com), checked 11-10-2026
27. Certificate management in a hybrid and multi-cloud environment (globalsign.com), checked 10-10-2026
28. Privacy Notice (globalsign.com), checked 11-10-2026
29. GlobalSign Subprocessor List and Processing Locations v2.4, opdateret 05-11-2025 (globalsign.com), checked 11-10-2026
30. GMO GlobalSign Expands TLS Connect by GMO Availability (globalsign.com), checked 11-10-2026
31. GMO GlobalSign Introduces TLS Connect (globalsign.com), checked 11-10-2026

If you see an error about another vendor, write to us. We correct it and update the check date. Write to us

Try sslbrain

Start free. No credit card required.

Download sslbrain See the prices