sslbrain vs DigiCert Trust Lifecycle Manager

Short answer

DigiCert Trust Lifecycle Manager comes as Essentials, Advanced and Premium. Essentials automates with ACME, SCEP, Windows autoenrollment or APIs. Agents and sensors that install on servers, appliances and cloud services come with Advanced.^1,2,3,4 Essentials has a public price per seat with a minimum of 25 seats. Advanced and Premium require a sales conversation.^1,5 Data can be hosted in the EU by agreement.^6,7

sslbrain runs as an appliance in your own network. The catalogue has 65 integrations. On Windows and Linux servers, a service agent installs the certificate. To network equipment and cloud services, the appliance pushes over API or SSH. Where there is no integration, you use a custom agent or ACME.

How to read the table

Every answer about another vendor carries a small number. It leads to the source at the foot of the page, with the date the source was last checked.
"Not stated" means it does not appear in the sources we reviewed. It does not mean no.
Prices are in the vendor's own currency, not converted. Where only the yearly or the monthly price is stated, the other is calculated and marked.
The sslbrain column has no source numbers. It comes from our own prices and our integration catalogue and links to those pages.

Every edition of DigiCert TLM and sslbrain

The table scrolls sideways.

sslbrain

Price

Price per year and per month: Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint.

See the prices

Automation

How the certificate gets there: Both agents/push and ACME

Full answer

a service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH.
Direct agents and connectors: 65 integrations in the catalogue

See the integrations
Without a direct agent: Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME

Named systems

FortiGate: Yes

Full answer

Fortinet FortiGate: push from the appliance over the API, port 443
F5 BIG-IP: Yes

Full answer

F5 BIG-IP: push from the appliance over the API, port 443
NetScaler: Yes

Full answer

Citrix NetScaler / ADC: push from the appliance over the API, port 443
SonicWall: Yes

Full answer

SonicWall SonicOS: push from the appliance over the API, port 443
Palo Alto: Yes

Full answer

Palo Alto Networks PAN-OS: push from the appliance over the API, port 443
Check Point: Yes

Full answer

Check Point HTTPS Inspection: push from the appliance over the API, port 443
Kemp LoadMaster: Yes

Full answer

Kemp LoadMaster: push from the appliance over the API, port 443
Cisco: Yes

Full answer

Cisco Secure Firewall (FDM): push from the appliance over the API, port 443
IIS: Yes

Full answer

Microsoft IIS: service agent on the server
Exchange: Yes

Full answer

Microsoft Exchange: service agent on the server
nginx and Apache: Yes

Full answer

Nginx: service agent on the server; Apache HTTP Server: service agent on the server
Tomcat (JKS): Yes

Full answer

Apache Tomcat: service agent on the server
Azure Key Vault: Yes

Full answer

Azure Key Vault: push from the appliance over the API, port 443
AWS Certificate Manager: Yes

Full answer

AWS Certificate Manager: push from the appliance over the API, port 443

Push without an agent

Push with no software on the destination: 46 destinations

Show the list

Akamai CPS (push from the appliance over the API, port 443)
AWS Certificate Manager (push from the appliance over the API, port 443)
AWS CloudFront (push from the appliance over the API, port 443)
AWS ELB & API Gateway (push from the appliance over the API, port 443)
Azure App Service (push from the appliance over the API, port 443)
Azure Application Gateway (push from the appliance over the API, port 443)
Azure Front Door (push from the appliance over the API, port 443)
Azure Key Vault (push from the appliance over the API, port 443)
Barracuda CloudGen Firewall (push from the appliance over the API, port 8443)
Barracuda Web Application Firewall (push from the appliance over the API, port 8443)
Bunny.net CDN (push from the appliance over the API, port 443)
Check Point HTTPS Inspection (push from the appliance over the API, port 443)
Cisco ASA / ASAv (push from the appliance over SSH, port 22)
Cisco ISE (push from the appliance over the API, port 443)
Cisco Secure Firewall (FDM) (push from the appliance over the API, port 443)
Cisco Secure Firewall (FMC) (push from the appliance over the API, port 443)
Citrix NetScaler / ADC (push from the appliance over the API, port 443)
Cloudflare (push from the appliance over the API, port 443)
Dell iDRAC (push from the appliance over the API, port 443)
F5 BIG-IP (push from the appliance over the API, port 443)
Fortinet FortiADC (push from the appliance over the API, port 443)
Fortinet FortiGate (push from the appliance over the API, port 443)
Fortinet FortiMail (push from the appliance over SSH, port 22)
Fortinet FortiManager (push from the appliance over the API, port 443)
Fortinet FortiNAC (push from the appliance over the API, port 8443)
Google Cloud Certificate Manager (push from the appliance over the API, port 443)
HPE iLO (push from the appliance over the API, port 443)
Infoblox NIOS Grid Manager (push from the appliance over the API, port 443)
Juniper SRX / vSRX (push from the appliance over SSH, port 22)
Kemp LoadMaster (push from the appliance over the API, port 443)
Kubernetes (push from the appliance over the API, port 6443)
NetApp ONTAP (push from the appliance over the API, port 443)
OPNsense (push from the appliance over the API, port 443)
Palo Alto Networks PAN-OS (push from the appliance over the API, port 443)
pfSense (push from the appliance over SSH, port 22)
Proxmox Backup Server (push from the appliance over the API, port 8007)
Proxmox Mail Gateway (push from the appliance over the API, port 8006)
Proxmox VE (push from the appliance over the API, port 8006)
SonicWall SonicOS (push from the appliance over the API, port 443)
Sophos Firewall (push from the appliance over the API, port 4444)
Synology DSM (push from the appliance over the API, port 5001)
TrueNAS SCALE / CORE (push from the appliance over the API, port 443)
Ubiquiti UniFi (push from the appliance over SSH, port 22)
VMware ESXi (push from the appliance over SSH, port 22)
VMware vCenter (push from the appliance over the API, port 443)
WatchGuard Firebox (Local: SSH 4118 · Cloud: HTTPS 443)

See the integrations

Private keys

Where the private key is kept: On-prem appliance

See the architecture

Network

Servers with an agent or ACME: The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports
Equipment without an agent: The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet

Windows and Linux

Windows: Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports
Linux: Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports

Branch offices

Remote sites and branch offices: One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports

Vendor and EU

Vendor: FairSSL A/S, Denmark
Hosting and the EU: EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud)

See the infrastructure

Essentials

Price

Price per year and per month

$40 per year^1,5

$3.33 per month (calculated)

Unit:: seat (server, site, user or device; a site is a combination of FQDN and IP address)
Minimum:: 25 seats (1000 $ for a 12-month subscription that renews automatically)

Automation

How the certificate gets there: ACME/SCEP only¹

Full answer

ACME, SCEP, Windows autoenrollment or APIs; fully managed automation with agents and sensors (servers, load balancers, appliances, cloud) is listed only from Advanced onwards
Direct agents and connectors: Not stated
Without a direct agent: ACME with a third-party client, SCEP, Windows autoenrollment or APIs¹

Full answer

agent and sensor automation requires Advanced

Named systems

FortiGate: Not stated
F5 BIG-IP: Not stated
NetScaler: Not stated
SonicWall: Not stated
Palo Alto: Not stated
Check Point: Not stated
Kemp LoadMaster: Not stated
Cisco: Not stated
IIS: Yes^4,1

Full answer

ACME with a third-party client
Exchange: Not stated
nginx and Apache: Yes^4,1

Full answer

ACME with a third-party client
Tomcat (JKS): Yes^4,1

Full answer

Apache Tomcat with a third-party ACME client
Azure Key Vault: Not stated
AWS Certificate Manager: Not stated

Push without an agent

Push with no software on the destination: Not stated

Private keys

Where the private key is kept: The destination⁴

Network

Servers with an agent or ACME: The ACME client on the server initiates the connection to DigiCert²⁴

Full answer

HTTP-01 validation requires inbound TCP 80 from DigiCert to the web server, DNS-01 via the DNS provider's API requires only outbound 443; TLS-ALPN-01 is not supported by DigiCert's ACME
Equipment without an agent: Not stated

Windows and Linux

Windows: ACME with a third-party client on IIS or Windows autoenrollment^4,1

Full answer

ports as in 7a
Linux: ACME with a third-party client on Apache, Nginx or Tomcat⁴

Full answer

ports as in 7a

Branch offices

Remote sites and branch offices: Not stated

Vendor and EU

Vendor: DigiCert, Inc., established in the USA with headquarters in Lehi, Utah²⁶
Hosting and the EU: Data can be hosted in the EU by agreement^6,7

Advanced

Price

Price per year and per month: Not public, requires a sales conversation^1,5

Automation

How the certificate gets there: Both agents/push and ACME^1,2,3,4

Full answer

DigiCert agent on the server and a DigiCert sensor at the customer, which installs on appliances and cloud services via API, plus ACME with third-party clients
Direct agents and connectors: 17^8,9,4

Full answer

9 destinations via sensor/connector and 8 server applications and keystores via the DigiCert agent
Without a direct agent: The agent's delivery to a local folder with the customer's own post-scripts, customer-built plugins in the sensor, scripts from DigiCert's GitHub repository product-solutions (28 additional platforms), ACME with a third-party client or REST API⁴

Named systems

FortiGate: Yes^4,10

Full answer

script from DigiCert's GitHub repository product-solutions, which the DigiCert agent runs after renewal and which uploads via the FortiOS REST API; FortiGate is on the list of verified platforms
F5 BIG-IP: Yes¹¹

Full answer

F5 BIG-IP LTM connector via DigiCert sensor
NetScaler: Yes¹²

Full answer

Citrix ADC connector via DigiCert sensor
SonicWall: Not stated
Palo Alto: Yes^4,13

Full answer

scripts from DigiCert's GitHub repository product-solutions, which the DigiCert agent runs after renewal; PAN-OS API
Check Point: Not stated
Kemp LoadMaster: Yes^4,14

Full answer

scripts from DigiCert's GitHub repository product-solutions, which the DigiCert agent runs after renewal; LoadMaster REST API
Cisco: Yes^15,16

Full answer

scripts from DigiCert's GitHub repository product-solutions for Cisco Firepower Management Center and Cisco ISE, run by the DigiCert agent; Cisco ASA not stated
IIS: Yes⁴

Full answer

DigiCert agent on the server or ACME with a third-party client
Exchange: Yes^4,17

Full answer

script from DigiCert's GitHub repository product-solutions, which the DigiCert agent runs after renewal
nginx and Apache: Yes⁴

Full answer

DigiCert agent on the server or ACME with a third-party client
Tomcat (JKS): Yes⁴

Full answer

DigiCert agent for Apache Tomcat and Java KeyStore; ACME with a third-party client for Tomcat
Azure Key Vault: Yes¹⁸

Full answer

Azure Key Vault connector controlled by a DigiCert sensor
AWS Certificate Manager: Yes^19,20

Full answer

AWS unified connector; delivery to ACM via Admin web request

Push without an agent

Push with no software on the destination: 9 destinations

Show the list

A10 (connector via DigiCert sensor)^8,21
Citrix ADC (NetScaler) (connector via DigiCert sensor, SSH 22 and HTTPS 443)^8,12
F5 BIG-IP LTM (connector via DigiCert sensor, SSH 22 and HTTPS 443)^8,11
AWS Certificate Manager (AWS unified connector via DigiCert sensor)^19,20
AWS Elastic Load Balancing (Application, Network and Classic Load Balancer)^19,9
Amazon CloudFront¹⁹
Google Cloud Certificate Manager²²
Google Cloud load balancers (6 types)^22,9
Microsoft Azure Key Vault (connector controlled by DigiCert sensor)¹⁸

What the list covers: The vendor’s connector lists for appliances (3), cloud services (AWS and GCP) and vaults (Azure Key Vault); one row per product or service. Excluded: 28 platforms under "Other vendors and platforms" with scripts and plugins in DigiCert’s GitHub repository product-solutions (e.g. FortiGate, Palo Alto, Kemp, Exchange), which run as the agent’s post-script or as a plugin in the sensor; they are listed in 3.mangler and 5.*. Release notes from 10-2025 to 10-2026 add no new destinations.⁴

Private keys

Where the private key is kept: The destination²
On-prem at the customer^3,23

Network

Servers with an agent or ACME: The DigiCert agent initiates the outbound connection on TCP 443 itself (pull) and requires no inbound access^7,25,24

Full answer

a sensor can act as a proxy for agents (inbound from local clients on port 48999). ACME as for Essentials: HTTP-01 requires inbound TCP 80
Equipment without an agent: From the DigiCert sensor in the customer’s network to the equipment: SSH TCP 22 and management HTTPS TCP 443 (Citrix ADC, F5)^12,25

Full answer

the sensor synchronises outbound with TLM on TCP 443 itself. Ports for cloud connectors are not stated

Windows and Linux

Windows: DigiCert agent on the Windows server installs the certificate and configures IIS (outbound 443, no inbound)^3,4,7

Full answer

alternatively a third-party ACME client
Linux: DigiCert agent on the Linux server installs on Apache, Nginx, Tomcat, IBM HTTP Server or JKS (outbound 443)^2,4,7

Full answer

alternatively a third-party ACME client

Branch offices

Remote sites and branch offices: Sensor per network segment or geographical location that can reach both the equipment and TLM^25,21

Full answer

agents without their own internet access can use a sensor as a proxy. VPN requirements are not stated

Vendor and EU

Vendor: DigiCert, Inc., established in the USA with headquarters in Lehi, Utah²⁶
Hosting and the EU: Data can be hosted in the EU by agreement^6,7

Premium

Price

Price per year and per month: Not public, requires a sales conversation^1,5

Automation

How the certificate gets there: Both agents/push and ACME^1,2,3,4

Full answer

DigiCert agent on the server and a DigiCert sensor at the customer, which installs on appliances and cloud services via API, plus ACME with third-party clients
Direct agents and connectors: 17^8,9,4

Full answer

9 destinations via sensor/connector and 8 server applications and keystores via the DigiCert agent
Without a direct agent: The agent's delivery to a local folder with the customer's own post-scripts, customer-built plugins in the sensor, scripts from DigiCert's GitHub repository product-solutions (28 additional platforms), ACME with a third-party client or REST API⁴

Named systems

FortiGate: Yes^4,10

Full answer

script from DigiCert's GitHub repository product-solutions, which the DigiCert agent runs after renewal and which uploads via the FortiOS REST API; FortiGate is on the list of verified platforms
F5 BIG-IP: Yes¹¹

Full answer

F5 BIG-IP LTM connector via DigiCert sensor
NetScaler: Yes¹²

Full answer

Citrix ADC connector via DigiCert sensor
SonicWall: Not stated
Palo Alto: Yes^4,13

Full answer

scripts from DigiCert's GitHub repository product-solutions, which the DigiCert agent runs after renewal; PAN-OS API
Check Point: Not stated
Kemp LoadMaster: Yes^4,14

Full answer

scripts from DigiCert's GitHub repository product-solutions, which the DigiCert agent runs after renewal; LoadMaster REST API
Cisco: Yes^15,16

Full answer

scripts from DigiCert's GitHub repository product-solutions for Cisco Firepower Management Center and Cisco ISE, run by the DigiCert agent; Cisco ASA not stated
IIS: Yes⁴

Full answer

DigiCert agent on the server or ACME with a third-party client
Exchange: Yes^4,17

Full answer

script from DigiCert's GitHub repository product-solutions, which the DigiCert agent runs after renewal
nginx and Apache: Yes⁴

Full answer

DigiCert agent on the server or ACME with a third-party client
Tomcat (JKS): Yes⁴

Full answer

DigiCert agent for Apache Tomcat and Java KeyStore; ACME with a third-party client for Tomcat
Azure Key Vault: Yes¹⁸

Full answer

Azure Key Vault connector controlled by a DigiCert sensor
AWS Certificate Manager: Yes^19,20

Full answer

AWS unified connector; delivery to ACM via Admin web request

Push without an agent

Push with no software on the destination: 9 destinations

Show the list

A10 (connector via DigiCert sensor)^8,21
Citrix ADC (NetScaler) (connector via DigiCert sensor, SSH 22 and HTTPS 443)^8,12
F5 BIG-IP LTM (connector via DigiCert sensor, SSH 22 and HTTPS 443)^8,11
AWS Certificate Manager (AWS unified connector via DigiCert sensor)^19,20
AWS Elastic Load Balancing (Application, Network and Classic Load Balancer)^19,9
Amazon CloudFront¹⁹
Google Cloud Certificate Manager²²
Google Cloud load balancers (6 types)^22,9
Microsoft Azure Key Vault (connector controlled by DigiCert sensor)¹⁸

What the list covers: The vendor’s connector lists for appliances (3), cloud services (AWS and GCP) and vaults (Azure Key Vault); one row per product or service. Excluded: 28 platforms under "Other vendors and platforms" with scripts and plugins in DigiCert’s GitHub repository product-solutions (e.g. FortiGate, Palo Alto, Kemp, Exchange), which run as the agent’s post-script or as a plugin in the sensor; they are listed in 3.mangler and 5.*. Release notes from 10-2025 to 10-2026 add no new destinations.⁴

Private keys

Where the private key is kept: The destination²
On-prem at the customer^3,23

Network

Servers with an agent or ACME: The DigiCert agent initiates the outbound connection on TCP 443 itself (pull) and requires no inbound access^7,25,24

Full answer

a sensor can act as a proxy for agents (inbound from local clients on port 48999). ACME as for Essentials: HTTP-01 requires inbound TCP 80
Equipment without an agent: From the DigiCert sensor in the customer’s network to the equipment: SSH TCP 22 and management HTTPS TCP 443 (Citrix ADC, F5)^12,25

Full answer

the sensor synchronises outbound with TLM on TCP 443 itself. Ports for cloud connectors are not stated

Windows and Linux

Windows: DigiCert agent on the Windows server installs the certificate and configures IIS (outbound 443, no inbound)^3,4,7

Full answer

alternatively a third-party ACME client
Linux: DigiCert agent on the Linux server installs on Apache, Nginx, Tomcat, IBM HTTP Server or JKS (outbound 443)^2,4,7

Full answer

alternatively a third-party ACME client

Branch offices

Remote sites and branch offices: Sensor per network segment or geographical location that can reach both the equipment and TLM^25,21

Full answer

agents without their own internet access can use a sensor as a proxy. VPN requirements are not stated

Vendor and EU

Vendor: DigiCert, Inc., established in the USA with headquarters in Lehi, Utah²⁶
Hosting and the EU: Data can be hosted in the EU by agreement^6,7

When DigiCert TLM fits better

You want to issue with SCEP or Windows autoenrollment from the same platform as your ACME certificates.¹
You want to use Advanced or Premium with the scripts DigiCert has for 28 further platforms in its GitHub repository product-solutions.⁴

Sources

1. Trust Lifecycle Manager Pricing – Compare TLM Plans (digicert.com), checked 11-10-2026
2. DigiCert agents and sensors (docs.digicert.com), checked 10-10-2026
3. Track progress of certificate automation requests (docs.digicert.com), checked 10-10-2026
4. Integration guides for Trust Lifecycle Manager (docs.digicert.com), checked 11-10-2026
5. Licensing and plans (docs.digicert.com), checked 11-10-2026
6. Sign-in URL (docs.digicert.com), checked 11-10-2026
7. Quick start: Deploy a DigiCert agent — Windows (docs.digicert.com), checked 10-10-2026
8. Appliances (docs.digicert.com), checked 11-10-2026
9. Cloud services (docs.digicert.com), checked 11-10-2026
10. FortiGate Admin Web Request post-enrollment scripts (raw.githubusercontent.com), checked 11-10-2026
11. F5 BIG-IP LTM connector (docs.digicert.com), checked 10-10-2026
12. Citrix ADC connector (docs.digicert.com), checked 10-10-2026
13. Palo Alto Networks Certificate Automation Scripts (raw.githubusercontent.com), checked 11-10-2026
14. Kemp LoadMaster AWR Post-Enrollment Scripts (raw.githubusercontent.com), checked 11-10-2026
15. Cisco Firepower Management Center AWR Post-Enrollment Script (raw.githubusercontent.com), checked 11-10-2026
16. Cisco ISE Certificate Delivery AWR Post-Enrollment Script (raw.githubusercontent.com), checked 11-10-2026
17. Microsoft Exchange Server AWR Post-Enrollment Script (raw.githubusercontent.com), checked 11-10-2026
18. Azure Key Vault (docs.digicert.com), checked 11-10-2026
19. Amazon Web Services (AWS) (docs.digicert.com), checked 11-10-2026
20. Add an AWS unified connector (docs.digicert.com), checked 10-10-2026
21. A10 connector (docs.digicert.com), checked 11-10-2026
22. Google Cloud Platform (GCP) (docs.digicert.com), checked 11-10-2026
23. Fortinet FortiGate Automation Plugin (raw.githubusercontent.com), checked 11-10-2026
24. Dataflows and firewall rules (digicert.com), checked 10-10-2026
25. Quick start: Deploy a DigiCert sensor — Windows (docs.digicert.com), checked 10-10-2026
26. DigiCert Privacy Center (privacy.digicert.com), checked 10-10-2026

If you see an error about another vendor, write to us. We correct it and update the check date. Write to us

Try sslbrain

Start free. No credit card required.

Download sslbrain See the prices

Question	sslbrain	Essentials	Advanced	Premium
Price
Price per year and per month	Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint. See the prices	$40 per year^1,5 $3.33 per month (calculated) Unit: seat (server, site, user or device; a site is a combination of FQDN and IP address) Minimum: 25 seats (1000 $ for a 12-month subscription that renews automatically)	Not public, requires a sales conversation^1,5	Not public, requires a sales conversation^1,5
Automation
How the certificate gets there	Both agents/push and ACME Full answer a service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH.	ACME/SCEP only¹ Full answer ACME, SCEP, Windows autoenrollment or APIs; fully managed automation with agents and sensors (servers, load balancers, appliances, cloud) is listed only from Advanced onwards	Both agents/push and ACME^1,2,3,4 Full answer DigiCert agent on the server and a DigiCert sensor at the customer, which installs on appliances and cloud services via API, plus ACME with third-party clients	Both agents/push and ACME^1,2,3,4 Full answer DigiCert agent on the server and a DigiCert sensor at the customer, which installs on appliances and cloud services via API, plus ACME with third-party clients
Direct agents and connectors	65 integrations in the catalogue See the integrations	Not stated	17^8,9,4 Full answer 9 destinations via sensor/connector and 8 server applications and keystores via the DigiCert agent	17^8,9,4 Full answer 9 destinations via sensor/connector and 8 server applications and keystores via the DigiCert agent
Without a direct agent	Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME	ACME with a third-party client, SCEP, Windows autoenrollment or APIs¹ Full answer agent and sensor automation requires Advanced	The agent's delivery to a local folder with the customer's own post-scripts, customer-built plugins in the sensor, scripts from DigiCert's GitHub repository product-solutions (28 additional platforms), ACME with a third-party client or REST API⁴	The agent's delivery to a local folder with the customer's own post-scripts, customer-built plugins in the sensor, scripts from DigiCert's GitHub repository product-solutions (28 additional platforms), ACME with a third-party client or REST API⁴
Named systems
FortiGate	Yes Full answer Fortinet FortiGate: push from the appliance over the API, port 443	Not stated	Yes^4,10 Full answer script from DigiCert's GitHub repository product-solutions, which the DigiCert agent runs after renewal and which uploads via the FortiOS REST API; FortiGate is on the list of verified platforms	Yes^4,10 Full answer script from DigiCert's GitHub repository product-solutions, which the DigiCert agent runs after renewal and which uploads via the FortiOS REST API; FortiGate is on the list of verified platforms
F5 BIG-IP	Yes Full answer F5 BIG-IP: push from the appliance over the API, port 443	Not stated	Yes¹¹ Full answer F5 BIG-IP LTM connector via DigiCert sensor	Yes¹¹ Full answer F5 BIG-IP LTM connector via DigiCert sensor
NetScaler	Yes Full answer Citrix NetScaler / ADC: push from the appliance over the API, port 443	Not stated	Yes¹² Full answer Citrix ADC connector via DigiCert sensor	Yes¹² Full answer Citrix ADC connector via DigiCert sensor
SonicWall	Yes Full answer SonicWall SonicOS: push from the appliance over the API, port 443	Not stated	Not stated	Not stated
Palo Alto	Yes Full answer Palo Alto Networks PAN-OS: push from the appliance over the API, port 443	Not stated	Yes^4,13 Full answer scripts from DigiCert's GitHub repository product-solutions, which the DigiCert agent runs after renewal; PAN-OS API	Yes^4,13 Full answer scripts from DigiCert's GitHub repository product-solutions, which the DigiCert agent runs after renewal; PAN-OS API
Check Point	Yes Full answer Check Point HTTPS Inspection: push from the appliance over the API, port 443	Not stated	Not stated	Not stated
Kemp LoadMaster	Yes Full answer Kemp LoadMaster: push from the appliance over the API, port 443	Not stated	Yes^4,14 Full answer scripts from DigiCert's GitHub repository product-solutions, which the DigiCert agent runs after renewal; LoadMaster REST API	Yes^4,14 Full answer scripts from DigiCert's GitHub repository product-solutions, which the DigiCert agent runs after renewal; LoadMaster REST API
Cisco	Yes Full answer Cisco Secure Firewall (FDM): push from the appliance over the API, port 443	Not stated	Yes^15,16 Full answer scripts from DigiCert's GitHub repository product-solutions for Cisco Firepower Management Center and Cisco ISE, run by the DigiCert agent; Cisco ASA not stated	Yes^15,16 Full answer scripts from DigiCert's GitHub repository product-solutions for Cisco Firepower Management Center and Cisco ISE, run by the DigiCert agent; Cisco ASA not stated
IIS	Yes Full answer Microsoft IIS: service agent on the server	Yes^4,1 Full answer ACME with a third-party client	Yes⁴ Full answer DigiCert agent on the server or ACME with a third-party client	Yes⁴ Full answer DigiCert agent on the server or ACME with a third-party client
Exchange	Yes Full answer Microsoft Exchange: service agent on the server	Not stated	Yes^4,17 Full answer script from DigiCert's GitHub repository product-solutions, which the DigiCert agent runs after renewal	Yes^4,17 Full answer script from DigiCert's GitHub repository product-solutions, which the DigiCert agent runs after renewal
nginx and Apache	Yes Full answer Nginx: service agent on the server; Apache HTTP Server: service agent on the server	Yes^4,1 Full answer ACME with a third-party client	Yes⁴ Full answer DigiCert agent on the server or ACME with a third-party client	Yes⁴ Full answer DigiCert agent on the server or ACME with a third-party client
Tomcat (JKS)	Yes Full answer Apache Tomcat: service agent on the server	Yes^4,1 Full answer Apache Tomcat with a third-party ACME client	Yes⁴ Full answer DigiCert agent for Apache Tomcat and Java KeyStore; ACME with a third-party client for Tomcat	Yes⁴ Full answer DigiCert agent for Apache Tomcat and Java KeyStore; ACME with a third-party client for Tomcat
Azure Key Vault	Yes Full answer Azure Key Vault: push from the appliance over the API, port 443	Not stated	Yes¹⁸ Full answer Azure Key Vault connector controlled by a DigiCert sensor	Yes¹⁸ Full answer Azure Key Vault connector controlled by a DigiCert sensor
AWS Certificate Manager	Yes Full answer AWS Certificate Manager: push from the appliance over the API, port 443	Not stated	Yes^19,20 Full answer AWS unified connector; delivery to ACM via Admin web request	Yes^19,20 Full answer AWS unified connector; delivery to ACM via Admin web request
Push without an agent
Push with no software on the destination	46 destinations Show the list Akamai CPS (push from the appliance over the API, port 443) AWS Certificate Manager (push from the appliance over the API, port 443) AWS CloudFront (push from the appliance over the API, port 443) AWS ELB & API Gateway (push from the appliance over the API, port 443) Azure App Service (push from the appliance over the API, port 443) Azure Application Gateway (push from the appliance over the API, port 443) Azure Front Door (push from the appliance over the API, port 443) Azure Key Vault (push from the appliance over the API, port 443) Barracuda CloudGen Firewall (push from the appliance over the API, port 8443) Barracuda Web Application Firewall (push from the appliance over the API, port 8443) Bunny.net CDN (push from the appliance over the API, port 443) Check Point HTTPS Inspection (push from the appliance over the API, port 443) Cisco ASA / ASAv (push from the appliance over SSH, port 22) Cisco ISE (push from the appliance over the API, port 443) Cisco Secure Firewall (FDM) (push from the appliance over the API, port 443) Cisco Secure Firewall (FMC) (push from the appliance over the API, port 443) Citrix NetScaler / ADC (push from the appliance over the API, port 443) Cloudflare (push from the appliance over the API, port 443) Dell iDRAC (push from the appliance over the API, port 443) F5 BIG-IP (push from the appliance over the API, port 443) Fortinet FortiADC (push from the appliance over the API, port 443) Fortinet FortiGate (push from the appliance over the API, port 443) Fortinet FortiMail (push from the appliance over SSH, port 22) Fortinet FortiManager (push from the appliance over the API, port 443) Fortinet FortiNAC (push from the appliance over the API, port 8443) Google Cloud Certificate Manager (push from the appliance over the API, port 443) HPE iLO (push from the appliance over the API, port 443) Infoblox NIOS Grid Manager (push from the appliance over the API, port 443) Juniper SRX / vSRX (push from the appliance over SSH, port 22) Kemp LoadMaster (push from the appliance over the API, port 443) Kubernetes (push from the appliance over the API, port 6443) NetApp ONTAP (push from the appliance over the API, port 443) OPNsense (push from the appliance over the API, port 443) Palo Alto Networks PAN-OS (push from the appliance over the API, port 443) pfSense (push from the appliance over SSH, port 22) Proxmox Backup Server (push from the appliance over the API, port 8007) Proxmox Mail Gateway (push from the appliance over the API, port 8006) Proxmox VE (push from the appliance over the API, port 8006) SonicWall SonicOS (push from the appliance over the API, port 443) Sophos Firewall (push from the appliance over the API, port 4444) Synology DSM (push from the appliance over the API, port 5001) TrueNAS SCALE / CORE (push from the appliance over the API, port 443) Ubiquiti UniFi (push from the appliance over SSH, port 22) VMware ESXi (push from the appliance over SSH, port 22) VMware vCenter (push from the appliance over the API, port 443) WatchGuard Firebox (Local: SSH 4118 · Cloud: HTTPS 443) See the integrations	Not stated	9 destinations Show the list A10 (connector via DigiCert sensor)^8,21 Citrix ADC (NetScaler) (connector via DigiCert sensor, SSH 22 and HTTPS 443)^8,12 F5 BIG-IP LTM (connector via DigiCert sensor, SSH 22 and HTTPS 443)^8,11 AWS Certificate Manager (AWS unified connector via DigiCert sensor)^19,20 AWS Elastic Load Balancing (Application, Network and Classic Load Balancer)^19,9 Amazon CloudFront¹⁹ Google Cloud Certificate Manager²² Google Cloud load balancers (6 types)^22,9 Microsoft Azure Key Vault (connector controlled by DigiCert sensor)¹⁸ What the list covers: The vendor’s connector lists for appliances (3), cloud services (AWS and GCP) and vaults (Azure Key Vault); one row per product or service. Excluded: 28 platforms under "Other vendors and platforms" with scripts and plugins in DigiCert’s GitHub repository product-solutions (e.g. FortiGate, Palo Alto, Kemp, Exchange), which run as the agent’s post-script or as a plugin in the sensor; they are listed in 3.mangler and 5.*. Release notes from 10-2025 to 10-2026 add no new destinations.⁴	9 destinations Show the list A10 (connector via DigiCert sensor)^8,21 Citrix ADC (NetScaler) (connector via DigiCert sensor, SSH 22 and HTTPS 443)^8,12 F5 BIG-IP LTM (connector via DigiCert sensor, SSH 22 and HTTPS 443)^8,11 AWS Certificate Manager (AWS unified connector via DigiCert sensor)^19,20 AWS Elastic Load Balancing (Application, Network and Classic Load Balancer)^19,9 Amazon CloudFront¹⁹ Google Cloud Certificate Manager²² Google Cloud load balancers (6 types)^22,9 Microsoft Azure Key Vault (connector controlled by DigiCert sensor)¹⁸ What the list covers: The vendor’s connector lists for appliances (3), cloud services (AWS and GCP) and vaults (Azure Key Vault); one row per product or service. Excluded: 28 platforms under "Other vendors and platforms" with scripts and plugins in DigiCert’s GitHub repository product-solutions (e.g. FortiGate, Palo Alto, Kemp, Exchange), which run as the agent’s post-script or as a plugin in the sensor; they are listed in 3.mangler and 5.*. Release notes from 10-2025 to 10-2026 add no new destinations.⁴
Private keys
Where the private key is kept	On-prem appliance See the architecture	The destination⁴	The destination² On-prem at the customer^3,23	The destination² On-prem at the customer^3,23
Network
Servers with an agent or ACME	The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports	The ACME client on the server initiates the connection to DigiCert²⁴ Full answer HTTP-01 validation requires inbound TCP 80 from DigiCert to the web server, DNS-01 via the DNS provider's API requires only outbound 443; TLS-ALPN-01 is not supported by DigiCert's ACME	The DigiCert agent initiates the outbound connection on TCP 443 itself (pull) and requires no inbound access^7,25,24 Full answer a sensor can act as a proxy for agents (inbound from local clients on port 48999). ACME as for Essentials: HTTP-01 requires inbound TCP 80	The DigiCert agent initiates the outbound connection on TCP 443 itself (pull) and requires no inbound access^7,25,24 Full answer a sensor can act as a proxy for agents (inbound from local clients on port 48999). ACME as for Essentials: HTTP-01 requires inbound TCP 80
Equipment without an agent	The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet	Not stated	From the DigiCert sensor in the customer’s network to the equipment: SSH TCP 22 and management HTTPS TCP 443 (Citrix ADC, F5)^12,25 Full answer the sensor synchronises outbound with TLM on TCP 443 itself. Ports for cloud connectors are not stated	From the DigiCert sensor in the customer’s network to the equipment: SSH TCP 22 and management HTTPS TCP 443 (Citrix ADC, F5)^12,25 Full answer the sensor synchronises outbound with TLM on TCP 443 itself. Ports for cloud connectors are not stated
Windows and Linux
Windows	Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports	ACME with a third-party client on IIS or Windows autoenrollment^4,1 Full answer ports as in 7a	DigiCert agent on the Windows server installs the certificate and configures IIS (outbound 443, no inbound)^3,4,7 Full answer alternatively a third-party ACME client	DigiCert agent on the Windows server installs the certificate and configures IIS (outbound 443, no inbound)^3,4,7 Full answer alternatively a third-party ACME client
Linux	Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports	ACME with a third-party client on Apache, Nginx or Tomcat⁴ Full answer ports as in 7a	DigiCert agent on the Linux server installs on Apache, Nginx, Tomcat, IBM HTTP Server or JKS (outbound 443)^2,4,7 Full answer alternatively a third-party ACME client	DigiCert agent on the Linux server installs on Apache, Nginx, Tomcat, IBM HTTP Server or JKS (outbound 443)^2,4,7 Full answer alternatively a third-party ACME client
Branch offices
Remote sites and branch offices	One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports	Not stated	Sensor per network segment or geographical location that can reach both the equipment and TLM^25,21 Full answer agents without their own internet access can use a sensor as a proxy. VPN requirements are not stated	Sensor per network segment or geographical location that can reach both the equipment and TLM^25,21 Full answer agents without their own internet access can use a sensor as a proxy. VPN requirements are not stated
Vendor and EU
Vendor	FairSSL A/S, Denmark	DigiCert, Inc., established in the USA with headquarters in Lehi, Utah²⁶	DigiCert, Inc., established in the USA with headquarters in Lehi, Utah²⁶	DigiCert, Inc., established in the USA with headquarters in Lehi, Utah²⁶
Hosting and the EU	EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud) See the infrastructure	Data can be hosted in the EU by agreement^6,7	Data can be hosted in the EU by agreement^6,7	Data can be hosted in the EU by agreement^6,7