sslbrain vs Sectigo Certificate Manager

Short answer

Sectigo Certificate Manager comes as SCM Pro in three plans, Basic, Plus and Advanced, and as SCM Enterprise. SCM Pro Plus and Advanced automate with the customer's own ACME client on the web server. Basic has manual issuance.^1,2 SCM Enterprise has an orchestration gateway and a network agent in the customer's network that install certificates locally and push them to other devices, and supports ACME, SCEP and EST.^3,4,5 SCM Pro has public prices per plan with a fixed number of domains. SCM Enterprise requires a sales conversation.^1,6

sslbrain runs as an appliance in your own network. The catalogue has 72 integrations. On Windows and Linux servers, a service agent installs the certificate. To network equipment and cloud services, the appliance pushes over API or SSH. Where there is no integration, you use a custom agent or ACME.

How to read the table

Every answer about another vendor carries a small number. It leads to the source at the foot of the page, with the date the source was last checked.
"Not stated" means it does not appear in the sources we reviewed. It does not mean no.
Prices are in the vendor's own currency, not converted. Where only the yearly or the monthly price is stated, the other is calculated and marked.
The sslbrain column has no source numbers. It comes from our own prices and our integration catalogue and links to those pages.

Every edition of Sectigo SCM and sslbrain

The table scrolls sideways.

Question	sslbrain	SCM Pro Basic	SCM Pro Plus	SCM Pro Advanced	SCM Enterprise
Price
Price per year and per month	Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint. See the prices	$250 per year¹ $25 per month Unit: plan with 3 domains (FQDN), priced per domain Minimum: 1 plan	$1,000 per year¹ $100 per month Unit: plan with 5 domains (FQDN) and 1 wildcard domain, priced per domain Minimum: 1 plan	$2,250 per year¹ $225 per month Unit: plan with 10 domains (FQDN) and 1 wildcard domain, priced per domain Minimum: 1 plan	Not public, requires a sales conversation⁶
Automation
How the certificate gets there	Both agents/push and ACME Full answer a service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH.	No automatic installation¹ Full answer The Basic plan has manual issuance; ACME automation and automatic renewals are marked as not included, and agents/push are not mentioned for SCM Pro	ACME/SCEP only^1,2 Full answer the customer's ACME client on the web server connects to an ACME account in SCM Pro; agents/push are not mentioned for SCM Pro	ACME/SCEP only^1,2 Full answer the customer's ACME client on the web server connects to an ACME account in SCM Pro; agents/push are not mentioned for SCM Pro	Both agents/push and ACME^3,4,5 Full answer orchestration gateway and network agent on the customer's network install certificates locally and remotely (push), and ACME, SCEP and EST for the customer's own clients
Direct agents and connectors	72 integrations in the catalogue See the integrations	Not stated	Not stated	Not stated	21^3,7 Full answer 11 endpoint types for orchestration gateway/network agent, Azure Key Vault directly from SCM and 9 destinations with a standalone Sectigo Connector
Without a direct agent	Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME	Manual issuance with the customer's own CSR and installation, or SCM Enterprise^8,1	Manual issuance with the customer's own CSR and installation, or SCM Enterprise^8,1	Manual issuance with the customer's own CSR and installation, or SCM Enterprise^8,1	Standalone Sectigo Connectors (available through an account manager or support), custom scripts after installation in the Windows certificate store and on P12/JKS/PEM endpoints, ACME/SCEP/EST for the customer's clients, or the SCM REST API^9,3,5
Named systems
FortiGate	Yes Full answer Fortinet FortiGate: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Not stated
F5 BIG-IP	Yes Full answer F5 BIG-IP: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Yes^3,10 Full answer orchestration gateway and network agent install remotely; also Sectigo Connector for F5 BIG-IP built on a Certbot plugin
NetScaler	Yes Full answer Citrix NetScaler / ADC: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Yes^3,11 Full answer orchestration gateway installs remotely; also Sectigo Connector for Citrix via the NITRO REST API
SonicWall	Yes Full answer SonicWall SonicOS: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Not stated
Palo Alto	Yes Full answer Palo Alto Networks PAN-OS: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Yes¹² Full answer Sectigo Connector for Palo Alto Firewall: Python script at the customer, SCM enrollment API and PAN-OS XML API; VM-Series and Panorama
Check Point	Yes Full answer Check Point HTTPS Inspection: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Not stated
Kemp LoadMaster	Yes Full answer Kemp LoadMaster: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Yes¹³ Full answer Sectigo Connector for Kemp: script at the customer, LoadMaster RESTful API
Cisco	Yes Full answer Cisco Secure Firewall (FDM): push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Yes⁹ Full answer Cisco FTD via Sectigo Connector and the FDM REST API; Cisco ASA and ISE not stated
IIS	Yes Full answer Microsoft IIS: service agent on the server	Not stated	Not stated	Not stated	Yes^3,14 Full answer orchestration gateway locally or remotely; network agent
Exchange	Yes Full answer Microsoft Exchange: service agent on the server	Not stated	Not stated	Not stated	Not stated
nginx and Apache	Yes Full answer Nginx: service agent on the server; Apache HTTP Server: service agent on the server	Not stated	Not stated	Not stated	Yes³ Full answer orchestration gateway locally or remotely via SSH; network agent for Apache
Tomcat (JKS)	Yes Full answer Apache Tomcat: service agent on the server	Not stated	Not stated	Not stated	Yes^3,15 Full answer orchestration gateway for Tomcat and JKS locally or remotely; also Sectigo Connector for Java
Azure Key Vault	Yes Full answer Azure Key Vault: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Yes⁷ Full answer SCM integration directly to Azure Key Vault: the CSR is created in Key Vault, the certificate is stored there; must be enabled on the account
AWS Certificate Manager	Yes Full answer AWS Certificate Manager: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Yes^16,17 Full answer Sectigo Connector for AWS: a Lambda function in the customer's AWS account retrieves the certificate via ACME and imports it into ACM; SCM's own ACM integration is discovery
Push without an agent
Push with no software on the destination	50 destinations Show the list Akamai CPS (push from the appliance over the API, port 443) Aruba/HPE ClearPass (push from the appliance over the API, port 443) AWS Certificate Manager (push from the appliance over the API, port 443) AWS CloudFront (push from the appliance over the API, port 443) AWS ELB & API Gateway (push from the appliance over the API, port 443) Azure App Service (push from the appliance over the API, port 443) Azure Application Gateway (push from the appliance over the API, port 443) Azure Front Door (push from the appliance over the API, port 443) Azure Key Vault (push from the appliance over the API, port 443) Barracuda CloudGen Firewall (push from the appliance over the API, port 8443) Barracuda Web Application Firewall (push from the appliance over the API, port 8443) Bunny.net CDN (push from the appliance over the API, port 443) Check Point HTTPS Inspection (push from the appliance over the API, port 443) Cisco ASA / ASAv (push from the appliance over SSH, port 22) Cisco ISE (push from the appliance over the API, port 443) Cisco Secure Firewall (FDM) (push from the appliance over the API, port 443) Cisco Secure Firewall (FMC) (push from the appliance over the API, port 443) Citrix NetScaler / ADC (push from the appliance over the API, port 443) Cloudflare (push from the appliance over the API, port 443) Dell iDRAC (push from the appliance over the API, port 443) F5 BIG-IP (push from the appliance over the API, port 443) Fortinet FortiADC (push from the appliance over the API, port 443) Fortinet FortiGate (push from the appliance over the API, port 443) Fortinet FortiMail (push from the appliance over SSH, port 22) Fortinet FortiManager (push from the appliance over the API, port 443) Fortinet FortiNAC (push from the appliance over the API, port 8443) Fortinet FortiWeb WAF (push from the appliance over the API, port 443) Google Cloud Certificate Manager (push from the appliance over the API, port 443) HPE iLO (push from the appliance over the API, port 443) Infoblox NIOS Grid Manager (push from the appliance over the API, port 443) Ivanti Connect Secure (push from the appliance over the API, port 443) Juniper SRX / vSRX (push from the appliance over SSH, port 22) Kemp LoadMaster (push from the appliance over the API, port 443) Kubernetes (push from the appliance over the API, port 6443) NetApp ONTAP (push from the appliance over the API, port 443) OPNsense (push from the appliance over the API, port 443) Palo Alto Networks PAN-OS (push from the appliance over the API, port 443) pfSense (push from the appliance over SSH, port 22) Proxmox Backup Server (push from the appliance over the API, port 8007) Proxmox Mail Gateway (push from the appliance over the API, port 8006) Proxmox VE (push from the appliance over the API, port 8006) SonicWall SonicOS (push from the appliance over the API, port 443) Sophos Firewall (push from the appliance over the API, port 4444) Synology DSM (push from the appliance over the API, port 5001) TrueNAS SCALE / CORE (push from the appliance over the API, port 443) Ubiquiti UniFi (push from the appliance over SSH, port 22) VMware Avi / NSX ALB (push from the appliance over the API, port 443) VMware ESXi (push from the appliance over SSH, port 22) VMware vCenter (push from the appliance over the API, port 443) WatchGuard Firebox (Local: SSH 4118 · Cloud: HTTPS 443) See the integrations	Not stated	Not stated	Not stated	12 destinations Show the list Apache HTTP Server 2.4 (remote from gateway; SSH from network agent)^3,18 Apache Tomcat 9.x, 10.x, 11.x³ Microsoft IIS 10 (remote from gateway; network agent via RPC)^3,18 Windows certificate store³ F5 BIG-IP^3,14 F5 Distributed Cloud (XC)³ Imperva³ Nginx³ P12, JKS and PEM files on servers³ Citrix (product not named)³ Cloudflare³ Microsoft Azure Key Vault (SCM directly via Azure API; CSR is created in Key Vault)⁷ What the list covers: The endpoint table for orchestration gateway (11 types, the same server types as the network agent) plus Azure Key Vault. Excluded: standalone Sectigo Connectors that the customer installs and runs manually or via cron/serverless (Kemp, A10, Cisco FTD, Palo Alto, Avi, HAProxy, AWS ACM, GCP, Akamai; see 3.antal and 5.*). The vendor has no single consolidated catalogue, and available server types depend on the account configuration.^14,9
Private keys
Where the private key is kept	On-prem appliance See the architecture	Not stated	The destination⁸	The destination⁸	On-prem at the customer^19,20 The destination^4,7
Network
Servers with an agent or ACME	The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports	Not stated	The customer's ACME client on the web server connects to SCM Pro's ACME account² Full answer ports and inbound access requirements are not stated	The customer's ACME client on the web server connects to SCM Pro's ACME account² Full answer ports and inbound access requirements are not stated	The network agent and orchestration gateway initiate the outbound connection to SCM on TCP 443 themselves^18,21 Full answer no inbound connection from the internet. ACME clients connect to Sectigo’s ACME server themselves; ports for HTTP-01/TLS-ALPN-01 are not stated
Equipment without an agent	The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet	Not stated	Not stated	Not stated	From orchestration gateway or network agent on the customer’s network to the target: WinRM TCP 5985, SSH TCP 22 or REST TCP 443^21,22 Full answer the network agent’s legacy connection uses TCP 135 and 445. Azure Key Vault is controlled directly from SCM-cloud via Azure API (port not stated)
Windows and Linux
Windows	Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports	Not stated	Not stated	Not stated	Gateway installed on Windows installs locally on IIS 10 and in the Windows certificate store^3,14 Full answer remote via WinRM (HTTP 5985 or HTTPS) or SSH. The network agent uses PowerShell, legacy connection via TCP 135/445
Linux	Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports	Not stated	Not stated	Not stated	Gateway on Linux installs locally on Apache, Tomcat, Nginx and P12/JKS/PEM, or remote via SSH TCP 22^3,21,14 Full answer Apache/Tomcat is restarted after installation
Branch offices
Remote sites and branch offices	One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports	Not stated	Not stated	Not stated	Gateways are installed on the customer’s network for the organisations and departments to be served^19,4 Full answer one gateway or network agent can install on other servers it can reach over the network. Requirements for sites without a direct connection (e.g. VPN) are not stated
Vendor and EU
Vendor	FairSSL A/S, Denmark	Sectigo Limited, registered in the United Kingdom, with subsidiaries such as Sectigo, Inc.^23,24 Full answer headquarters in Scottsdale, Arizona, USA	Sectigo Limited, registered in the United Kingdom, with subsidiaries such as Sectigo, Inc.^23,24 Full answer headquarters in Scottsdale, Arizona, USA	Sectigo Limited, registered in the United Kingdom, with subsidiaries such as Sectigo, Inc.^23,24 Full answer headquarters in Scottsdale, Arizona, USA	Sectigo Limited, registered in the United Kingdom, with subsidiaries such as Sectigo, Inc.^23,24 Full answer headquarters in Scottsdale, Arizona, USA
Hosting and the EU	EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud) See the infrastructure	Not stated	Not stated	Not stated	EU Cloud Platform with an EU-hosted instance (eu.cert-manager.com)^25,22 Full answer data centre country and location of logs/backups are not stated

sslbrain

Price

Price per year and per month: Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint.

See the prices

Automation

How the certificate gets there: Both agents/push and ACME

Full answer

a service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH.
Direct agents and connectors: 72 integrations in the catalogue

See the integrations
Without a direct agent: Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME

Named systems

FortiGate: Yes

Full answer

Fortinet FortiGate: push from the appliance over the API, port 443
F5 BIG-IP: Yes

Full answer

F5 BIG-IP: push from the appliance over the API, port 443
NetScaler: Yes

Full answer

Citrix NetScaler / ADC: push from the appliance over the API, port 443
SonicWall: Yes

Full answer

SonicWall SonicOS: push from the appliance over the API, port 443
Palo Alto: Yes

Full answer

Palo Alto Networks PAN-OS: push from the appliance over the API, port 443
Check Point: Yes

Full answer

Check Point HTTPS Inspection: push from the appliance over the API, port 443
Kemp LoadMaster: Yes

Full answer

Kemp LoadMaster: push from the appliance over the API, port 443
Cisco: Yes

Full answer

Cisco Secure Firewall (FDM): push from the appliance over the API, port 443
IIS: Yes

Full answer

Microsoft IIS: service agent on the server
Exchange: Yes

Full answer

Microsoft Exchange: service agent on the server
nginx and Apache: Yes

Full answer

Nginx: service agent on the server; Apache HTTP Server: service agent on the server
Tomcat (JKS): Yes

Full answer

Apache Tomcat: service agent on the server
Azure Key Vault: Yes

Full answer

Azure Key Vault: push from the appliance over the API, port 443
AWS Certificate Manager: Yes

Full answer

AWS Certificate Manager: push from the appliance over the API, port 443

Push without an agent

Push with no software on the destination: 50 destinations

Show the list

Akamai CPS (push from the appliance over the API, port 443)
Aruba/HPE ClearPass (push from the appliance over the API, port 443)
AWS Certificate Manager (push from the appliance over the API, port 443)
AWS CloudFront (push from the appliance over the API, port 443)
AWS ELB & API Gateway (push from the appliance over the API, port 443)
Azure App Service (push from the appliance over the API, port 443)
Azure Application Gateway (push from the appliance over the API, port 443)
Azure Front Door (push from the appliance over the API, port 443)
Azure Key Vault (push from the appliance over the API, port 443)
Barracuda CloudGen Firewall (push from the appliance over the API, port 8443)
Barracuda Web Application Firewall (push from the appliance over the API, port 8443)
Bunny.net CDN (push from the appliance over the API, port 443)
Check Point HTTPS Inspection (push from the appliance over the API, port 443)
Cisco ASA / ASAv (push from the appliance over SSH, port 22)
Cisco ISE (push from the appliance over the API, port 443)
Cisco Secure Firewall (FDM) (push from the appliance over the API, port 443)
Cisco Secure Firewall (FMC) (push from the appliance over the API, port 443)
Citrix NetScaler / ADC (push from the appliance over the API, port 443)
Cloudflare (push from the appliance over the API, port 443)
Dell iDRAC (push from the appliance over the API, port 443)
F5 BIG-IP (push from the appliance over the API, port 443)
Fortinet FortiADC (push from the appliance over the API, port 443)
Fortinet FortiGate (push from the appliance over the API, port 443)
Fortinet FortiMail (push from the appliance over SSH, port 22)
Fortinet FortiManager (push from the appliance over the API, port 443)
Fortinet FortiNAC (push from the appliance over the API, port 8443)
Fortinet FortiWeb WAF (push from the appliance over the API, port 443)
Google Cloud Certificate Manager (push from the appliance over the API, port 443)
HPE iLO (push from the appliance over the API, port 443)
Infoblox NIOS Grid Manager (push from the appliance over the API, port 443)
Ivanti Connect Secure (push from the appliance over the API, port 443)
Juniper SRX / vSRX (push from the appliance over SSH, port 22)
Kemp LoadMaster (push from the appliance over the API, port 443)
Kubernetes (push from the appliance over the API, port 6443)
NetApp ONTAP (push from the appliance over the API, port 443)
OPNsense (push from the appliance over the API, port 443)
Palo Alto Networks PAN-OS (push from the appliance over the API, port 443)
pfSense (push from the appliance over SSH, port 22)
Proxmox Backup Server (push from the appliance over the API, port 8007)
Proxmox Mail Gateway (push from the appliance over the API, port 8006)
Proxmox VE (push from the appliance over the API, port 8006)
SonicWall SonicOS (push from the appliance over the API, port 443)
Sophos Firewall (push from the appliance over the API, port 4444)
Synology DSM (push from the appliance over the API, port 5001)
TrueNAS SCALE / CORE (push from the appliance over the API, port 443)
Ubiquiti UniFi (push from the appliance over SSH, port 22)
VMware Avi / NSX ALB (push from the appliance over the API, port 443)
VMware ESXi (push from the appliance over SSH, port 22)
VMware vCenter (push from the appliance over the API, port 443)
WatchGuard Firebox (Local: SSH 4118 · Cloud: HTTPS 443)

See the integrations

Private keys

Where the private key is kept: On-prem appliance

See the architecture

Network

Servers with an agent or ACME: The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports
Equipment without an agent: The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet

Windows and Linux

Windows: Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports
Linux: Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports

Branch offices

Remote sites and branch offices: One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports

Vendor and EU

Vendor: FairSSL A/S, Denmark
Hosting and the EU: EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud)

See the infrastructure

SCM Pro Basic

Price

Price per year and per month

$250 per year¹

$25 per month

Unit:: plan with 3 domains (FQDN), priced per domain
Minimum:: 1 plan

Automation

How the certificate gets there: No automatic installation¹

Full answer

The Basic plan has manual issuance; ACME automation and automatic renewals are marked as not included, and agents/push are not mentioned for SCM Pro
Direct agents and connectors: Not stated
Without a direct agent: Manual issuance with the customer's own CSR and installation, or SCM Enterprise^8,1

Named systems

FortiGate: Not stated
F5 BIG-IP: Not stated
NetScaler: Not stated
SonicWall: Not stated
Palo Alto: Not stated
Check Point: Not stated
Kemp LoadMaster: Not stated
Cisco: Not stated
IIS: Not stated
Exchange: Not stated
nginx and Apache: Not stated
Tomcat (JKS): Not stated
Azure Key Vault: Not stated
AWS Certificate Manager: Not stated

Push without an agent

Push with no software on the destination: Not stated

Private keys

Where the private key is kept: Not stated

Network

Servers with an agent or ACME: Not stated
Equipment without an agent: Not stated

Windows and Linux

Windows: Not stated
Linux: Not stated

Branch offices

Remote sites and branch offices: Not stated

Vendor and EU

Vendor: Sectigo Limited, registered in the United Kingdom, with subsidiaries such as Sectigo, Inc.^23,24

Full answer

headquarters in Scottsdale, Arizona, USA
Hosting and the EU: Not stated

SCM Pro Plus

Price

Price per year and per month

$1,000 per year¹

$100 per month

Unit:: plan with 5 domains (FQDN) and 1 wildcard domain, priced per domain
Minimum:: 1 plan

Automation

How the certificate gets there: ACME/SCEP only^1,2

Full answer

the customer's ACME client on the web server connects to an ACME account in SCM Pro; agents/push are not mentioned for SCM Pro
Direct agents and connectors: Not stated
Without a direct agent: Manual issuance with the customer's own CSR and installation, or SCM Enterprise^8,1

Named systems

FortiGate: Not stated
F5 BIG-IP: Not stated
NetScaler: Not stated
SonicWall: Not stated
Palo Alto: Not stated
Check Point: Not stated
Kemp LoadMaster: Not stated
Cisco: Not stated
IIS: Not stated
Exchange: Not stated
nginx and Apache: Not stated
Tomcat (JKS): Not stated
Azure Key Vault: Not stated
AWS Certificate Manager: Not stated

Push without an agent

Push with no software on the destination: Not stated

Private keys

Where the private key is kept: The destination⁸

Network

Servers with an agent or ACME: The customer's ACME client on the web server connects to SCM Pro's ACME account²

Full answer

ports and inbound access requirements are not stated
Equipment without an agent: Not stated

Windows and Linux

Windows: Not stated
Linux: Not stated

Branch offices

Remote sites and branch offices: Not stated

Vendor and EU

Vendor: Sectigo Limited, registered in the United Kingdom, with subsidiaries such as Sectigo, Inc.^23,24

Full answer

headquarters in Scottsdale, Arizona, USA
Hosting and the EU: Not stated

SCM Pro Advanced

Price

Price per year and per month

$2,250 per year¹

$225 per month

Unit:: plan with 10 domains (FQDN) and 1 wildcard domain, priced per domain
Minimum:: 1 plan

Automation

How the certificate gets there: ACME/SCEP only^1,2

Full answer

the customer's ACME client on the web server connects to an ACME account in SCM Pro; agents/push are not mentioned for SCM Pro
Direct agents and connectors: Not stated
Without a direct agent: Manual issuance with the customer's own CSR and installation, or SCM Enterprise^8,1

Named systems

FortiGate: Not stated
F5 BIG-IP: Not stated
NetScaler: Not stated
SonicWall: Not stated
Palo Alto: Not stated
Check Point: Not stated
Kemp LoadMaster: Not stated
Cisco: Not stated
IIS: Not stated
Exchange: Not stated
nginx and Apache: Not stated
Tomcat (JKS): Not stated
Azure Key Vault: Not stated
AWS Certificate Manager: Not stated

Push without an agent

Push with no software on the destination: Not stated

Private keys

Where the private key is kept: The destination⁸

Network

Servers with an agent or ACME: The customer's ACME client on the web server connects to SCM Pro's ACME account²

Full answer

ports and inbound access requirements are not stated
Equipment without an agent: Not stated

Windows and Linux

Windows: Not stated
Linux: Not stated

Branch offices

Remote sites and branch offices: Not stated

Vendor and EU

Vendor: Sectigo Limited, registered in the United Kingdom, with subsidiaries such as Sectigo, Inc.^23,24

Full answer

headquarters in Scottsdale, Arizona, USA
Hosting and the EU: Not stated

SCM Enterprise

Price

Price per year and per month: Not public, requires a sales conversation⁶

Automation

How the certificate gets there: Both agents/push and ACME^3,4,5

Full answer

orchestration gateway and network agent on the customer's network install certificates locally and remotely (push), and ACME, SCEP and EST for the customer's own clients
Direct agents and connectors: 21^3,7

Full answer

11 endpoint types for orchestration gateway/network agent, Azure Key Vault directly from SCM and 9 destinations with a standalone Sectigo Connector
Without a direct agent: Standalone Sectigo Connectors (available through an account manager or support), custom scripts after installation in the Windows certificate store and on P12/JKS/PEM endpoints, ACME/SCEP/EST for the customer's clients, or the SCM REST API^9,3,5

Named systems

FortiGate: Not stated
F5 BIG-IP: Yes^3,10

Full answer

orchestration gateway and network agent install remotely; also Sectigo Connector for F5 BIG-IP built on a Certbot plugin
NetScaler: Yes^3,11

Full answer

orchestration gateway installs remotely; also Sectigo Connector for Citrix via the NITRO REST API
SonicWall: Not stated
Palo Alto: Yes¹²

Full answer

Sectigo Connector for Palo Alto Firewall: Python script at the customer, SCM enrollment API and PAN-OS XML API; VM-Series and Panorama
Check Point: Not stated
Kemp LoadMaster: Yes¹³

Full answer

Sectigo Connector for Kemp: script at the customer, LoadMaster RESTful API
Cisco: Yes⁹

Full answer

Cisco FTD via Sectigo Connector and the FDM REST API; Cisco ASA and ISE not stated
IIS: Yes^3,14

Full answer

orchestration gateway locally or remotely; network agent
Exchange: Not stated
nginx and Apache: Yes³

Full answer

orchestration gateway locally or remotely via SSH; network agent for Apache
Tomcat (JKS): Yes^3,15

Full answer

orchestration gateway for Tomcat and JKS locally or remotely; also Sectigo Connector for Java
Azure Key Vault: Yes⁷

Full answer

SCM integration directly to Azure Key Vault: the CSR is created in Key Vault, the certificate is stored there; must be enabled on the account
AWS Certificate Manager: Yes^16,17

Full answer

Sectigo Connector for AWS: a Lambda function in the customer's AWS account retrieves the certificate via ACME and imports it into ACM; SCM's own ACM integration is discovery

Push without an agent

Push with no software on the destination: 12 destinations

Show the list

Apache HTTP Server 2.4 (remote from gateway; SSH from network agent)^3,18
Apache Tomcat 9.x, 10.x, 11.x³
Microsoft IIS 10 (remote from gateway; network agent via RPC)^3,18
Windows certificate store³
F5 BIG-IP^3,14
F5 Distributed Cloud (XC)³
Imperva³
Nginx³
P12, JKS and PEM files on servers³
Citrix (product not named)³
Cloudflare³
Microsoft Azure Key Vault (SCM directly via Azure API; CSR is created in Key Vault)⁷

What the list covers: The endpoint table for orchestration gateway (11 types, the same server types as the network agent) plus Azure Key Vault. Excluded: standalone Sectigo Connectors that the customer installs and runs manually or via cron/serverless (Kemp, A10, Cisco FTD, Palo Alto, Avi, HAProxy, AWS ACM, GCP, Akamai; see 3.antal and 5.*). The vendor has no single consolidated catalogue, and available server types depend on the account configuration.^14,9

Private keys

Where the private key is kept: On-prem at the customer^19,20
The destination^4,7

Network

Servers with an agent or ACME: The network agent and orchestration gateway initiate the outbound connection to SCM on TCP 443 themselves^18,21

Full answer

no inbound connection from the internet. ACME clients connect to Sectigo’s ACME server themselves; ports for HTTP-01/TLS-ALPN-01 are not stated
Equipment without an agent: From orchestration gateway or network agent on the customer’s network to the target: WinRM TCP 5985, SSH TCP 22 or REST TCP 443^21,22

Full answer

the network agent’s legacy connection uses TCP 135 and 445. Azure Key Vault is controlled directly from SCM-cloud via Azure API (port not stated)

Windows and Linux

Windows: Gateway installed on Windows installs locally on IIS 10 and in the Windows certificate store^3,14

Full answer

remote via WinRM (HTTP 5985 or HTTPS) or SSH. The network agent uses PowerShell, legacy connection via TCP 135/445
Linux: Gateway on Linux installs locally on Apache, Tomcat, Nginx and P12/JKS/PEM, or remote via SSH TCP 22^3,21,14

Full answer

Apache/Tomcat is restarted after installation

Branch offices

Remote sites and branch offices: Gateways are installed on the customer’s network for the organisations and departments to be served^19,4

Full answer

one gateway or network agent can install on other servers it can reach over the network. Requirements for sites without a direct connection (e.g. VPN) are not stated

Vendor and EU

Vendor: Sectigo Limited, registered in the United Kingdom, with subsidiaries such as Sectigo, Inc.^23,24

Full answer

headquarters in Scottsdale, Arizona, USA
Hosting and the EU: EU Cloud Platform with an EU-hosted instance (eu.cert-manager.com)^25,22

Full answer

data centre country and location of logs/backups are not stated

When Sectigo SCM fits better

You have a few domains and an ACME client on each web server, and want the certificates for those domains and the ACME account in one plan from the CA (SCM Pro Plus or Advanced).^1,2
You want SCM Enterprise as an EU-hosted instance run by the vendor (eu.cert-manager.com).^25,22
You want to issue with SCEP or EST to your own clients from the same platform (SCM Enterprise).^3,4,5

Sources

1. SCM Pro plansammenligning (sectigo.com), checked 11-10-2026
2. Understanding ACME accounts (docs.sectigo.com), checked 11-10-2026
3. Managing SSL/TLS automation endpoints (docs.sectigo.com), checked 11-10-2026
4. Understanding network agents (docs.sectigo.com), checked 10-10-2026
5. What is SCM Enterprise? (docs.sectigo.com), checked 11-10-2026
6. Sectigo Certificate Manager (sectigo.com), checked 11-10-2026
7. Configuring Azure Key Vault (docs.sectigo.com), checked 11-10-2026
8. Request new certificates (docs.sectigo.com), checked 11-10-2026
9. Sectigo Connector for Cisco FTD: Overview (docs.sectigo.com), checked 10-10-2026
10. Sectigo Connector for F5 BIG-IP: Overview (docs.sectigo.com), checked 11-10-2026
11. Sectigo Connector for Citrix: Overview (docs.sectigo.com), checked 11-10-2026
12. Sectigo Connector for Palo Alto Firewall: Overview (docs.sectigo.com), checked 10-10-2026
13. Sectigo Connector for Kemp: Overview (docs.sectigo.com), checked 10-10-2026
14. Managing servers (docs.sectigo.com), checked 11-10-2026
15. Sectigo Connector for Java: Overview (docs.sectigo.com), checked 11-10-2026
16. Sectigo Connector for AWS: Overview (docs.sectigo.com), checked 11-10-2026
17. Configuring ACM discovery (docs.sectigo.com), checked 11-10-2026
18. Sectigo Network Agent: Frequently Asked Questions (sectigo.com), checked 10-10-2026
19. Understanding orchestration gateways (docs.sectigo.com), checked 11-10-2026
20. Understanding private key agents (docs.sectigo.com), checked 10-10-2026
21. Installing orchestration gateways (docs.sectigo.com), checked 11-10-2026
22. Installing network agents (docs.sectigo.com), checked 10-10-2026
23. Privacy policy (sectigo.com), checked 10-10-2026
24. Get in touch with Sectigo (sectigo.com), checked 10-10-2026
25. Sectigo Enables EU Customers to Retain Data Sovereignty in the Cloud (sectigo.com), checked 10-10-2026

If you see an error about another vendor, write to us. We correct it and update the check date. Write to us

Try sslbrain

Start free. No credit card required.

Download sslbrain See the prices