DigiCert Trust Lifecycle Manager
Trust Lifecycle Manager (TLM) is DigiCert's platform for central certificate and PKI management. It detects certificates in your infrastructure, monitors their expiration, and can automatically issue, renew, and deploy them. It is directly connected to the DigiCert Certificate Authority, and you can operate it in the cloud, on-premise, or in a hybrid setup.
Why automate right now
The validity of public TLS certificates is gradually shortening. Starting March 2026, the maximum validity will be 200 days, and starting March 2027, it will decrease to 100 days, and by March 2029 to 47 days. A certificate you renew yearly today will need renewal approximately eight times per year. Manual management in a spreadsheet thus becomes unsustainable, and any overlooked certificate means a service disruption.
Capabilities of Trust Lifecycle Manager
- Discovery: finds certificates in the network, on servers, and in the cloud, including those from other CAs, and creates a centralized overview of them.
- Lifecycle Management: expiration alerts, approval workflows, automatic renewal and deployment.
- PKI Services: creating private CAs and issuing certificates for users, devices, and servers.
- Automation and Integration: ACME, SCEP, REST API, agents, and connectors for common systems (see below).
Automation via ACME
ACME (Automatic Certificate Management Environment) is an open and standardized protocol for automating the acquisition, renewal, and revocation of digital certificates. It provides a simple and efficient way to manage certificates for web servers, applications, and other online services, reducing their management costs. ACME can be used with various certificate authorities, and clients that use the protocol typically also deploy certificates to servers.
Trust Lifecycle Manager has its own ACME endpoint through which you can obtain public DV certificates. It works with common ACME clients like Certbot or acme.sh.
Automation via SCEP
Simple Certificate Enrollment Protocol (SCEP) is a communication protocol for automating certificate requests and distribution in a network. SCEP allows devices like servers, routers, or other network elements to request certificates directly from a certificate authority (CA) and subsequently deploy them without user intervention. It's often used for secure network access (e.g., VPN), data encryption, and device authentication within corporate infrastructure.
TLM integrates with Microsoft CA and Microsoft Intune, so through SCEP profiles in Intune, you can automatically issue certificates to managed laptops and mobile devices.
Integration with other tools
Trust Lifecycle Manager is compatible with a wide range of other tools. Here are some examples of integrations documented by DigiCert:
- DigiCert Autoenrollment Server
- Citrix FAS integration
- Intune SCEP integration
- Microsoft CA server integration
- Third-party ACME integration
- Windows Hello for Business integration
Guides for individual integrations can be found on the Integration guides page on DigiCert's website.
Build your own automation
Trust Lifecycle Manager functions as an orchestrator: you assemble automation from individual components based on your infrastructure. On one side, you choose a certificate source, be it DigiCert's public CA, a private CA within TLM, or the existing Microsoft CA. In the middle, you define the method of issuance and renewal: ACME, SCEP, REST API, or a DigiCert agent installed directly on the server. On the other side, you select a deployment target, such as web servers, load balancers, cloud services, or endpoint devices managed through Intune. The whole connection is controlled by profiles and rules, where you set the certificate type, approvals, notifications, and renewal deadlines. Once the setup is complete, certificates are issued, renewed, and deployed automatically, and you maintain control over their entire lifecycle in one place.
More information and resources
The features and benefits of Trust Lifecycle Manager are best summarized in the product datasheet. The most comprehensive source of information about TLM and its possible uses is the official documentation, which is publicly available.
How to obtain Trust Lifecycle Manager
Setting up automation and integration into existing processes is an individual matter. Contact us and we will help you find a tailored solution.
