Infisical vs. DigiCert Trust Lifecycle Manager
Use Infisical to automate more types of certificates more easily, even if you keep buying public certs from DigiCert.
The TLM way
Sensors, agents, connectors, and a plan upgrade before anything renews.
- CertCentral automation retired: Discovery and managed automation ended October 1, 2026. Move to Trust Lifecycle Manager.
- Your Trust Lifecycle Manager Advanced quote: Managed automation needs an Advanced subscription.
- sensor-01
- Trust Lifecycle Manager
- Provision a Windows host for the AD CS sensor: Same forest as the CA, not the CA server
- web-07
- sensor-02: Offline
- Select multiple sensors for each CA connector
- Trust Lifecycle Manager
- TLM plan review with DigiCert: 10:00 to 11:00
- Sam, platform team: Where did the old CertCentral scan results go?
The Infisical way
DigiCert (and other) certificates renewed on autopilot.
What's the difference between Infisical and DigiCert Trust Lifecycle Manager?
Infisical issues certificates from DigiCert and every other CA you use, and automates them without software on each server. Getting the same from Trust Lifecycle Manager takes sensors, and agents on every target.
Evaluate
Infisical- Try the free tier to test-drive an internal CA, ACME, and the certificate dashboard
- Use the open-source version to audit and test the code
DigiCert Trust Lifecycle Manager- Ask sales for a price on any plan with automation
- Can't audit the code
Deploy/integrate
Infisical- Use managed cloud, or self-host on Docker, Kubernetes, Linux, AWS ECS, or Google GKE
- One gateway to reach private networks
DigiCert Trust Lifecycle Manager- Install sensors on dedicated hosts, several for failover
- Install an agent on each server you want to scan or automate
- Set up a separate Windows host for the Microsoft CA connector
Migrate/onboard
Infisical- Connect CertCentral with an API key or ACME and keep ordering from DigiCert
- Discover certificates on your networks and Linux servers
- Import the certificates you already hold
DigiCert Trust Lifecycle Manager- Replace CertCentral agents with TLM agents and deploy sensors
- Build a new inventory because CertCentral scan data doesn’t translate
Operate
Infisical- See certificates from every CA in one inventory
- Certificates renew automatically via API, SCEP, ACME, or EST
DigiCert Trust Lifecycle Manager- Manage certificates from other CAs only on the Advanced plan
Automate
Infisical- Get an email, Slack, PagerDuty, or webhook alert before anything expires
- Certificates land on load balancers, cloud services, and servers with no agent to install
DigiCert Trust Lifecycle Manager- Upgrade to Advanced for managed automation
- Upgrade to Premium for Kubernetes and ServiceNow
- Route each server's renewals through its own agent
Scale
Infisical- Issue device certificates from your own CA to Intune or Jamf Pro over SCEP
- Sign code with approvals, without buying another product
- Add secrets, privileged access, or KMS on the same platform when you need them
DigiCert Trust Lifecycle Manager- Buy Software Trust Manager for code signing
- Bring in another vendor for secrets management or other security infrastructure
Infisical vs. DigiCert Trust Lifecycle Manager at a glance
Both products manage certificates from DigiCert and other CAs. The difference is that Infisical requires fewer moving pieces and runs more smoothly.
| Feature |  | DigiCert Trust Lifecycle Manager |
|---|---|---|
| Open sourceWhether the source code is public, so your team can review exactly what runs. | MIT-licensed core your team can audit | Proprietary |
| Self-hostingRunning the product on your own infrastructure instead of the vendor's cloud. | Docker, Kubernetes, Linux, AWS ECS, or Google GKE, on PostgreSQL and Redis | On-premises DigiCert ONE, by arrangement only |
| Managed cloudA version the vendor hosts and operates for you. | US and EU regions. One gateway where it has to reach a private network | Hosted, but sensors and agents run on your network |
| Products neededHow many separate products it takes to cover issuance, lifecycle management, and code signing. | Infisical Certificate Management | TLM for certificates, plus Software Trust Manager for code signing |
| Components to runThe servers, agents, and connectors your team deploys and keeps up to date. | One platform, plus a gateway for private networks | Sensors on dedicated hosts, several per CA connector for failover, plus an agent on each server |
| Product scopeWhat Infisical and DigiCert Trust Lifecycle Manager cover beyond certificate management. | Certificates, secrets, privileged access, and KMS on one platform | Certificates. Secrets need another vendor |
| Private CA hierarchy | Built in, cloud or self-hosted, with HSM-backed keys | Hosted by DigiCert. AD CS and other private CAs need Advanced |
| External and public CAs | Public and private certificates in one inventory, from DigiCert, Sectigo, Let's Encrypt, AD CS, Venafi, and more | Only through a sensor-run connector for each CA account |
| Code signing | Built in, with signing approvals and signtool, jarsigner, and cosign support | Software Trust Manager, a separate product |
| ACMEHow tools like certbot and cert-manager request and renew certificates automatically. | ||
| ESTA protocol devices and servers use to enroll for certificates securely, common in network equipment and IoT. | ||
| SCEPAn older enrollment protocol used by device management tools like Microsoft Intune and Jamf. | ||
| APIRequesting certificates directly from your own code or scripts. | ||
| Certificate discoveryScanning your networks to find certificates in use, including ones you didn't know about. | Scans IP ranges, domains, and Linux servers, with no agent | Network and server scans need Advanced, plus sensors and agents |
| InventoryA single list of every certificate, where it's used, and when it expires. | ||
| Automatic renewalReplacing certificates before they expire, without manual steps. | Via syncs, agents, or ACME clients | Advanced plan, through an agent on each server or a sensor |
| Expiry alertsNotifications before a certificate expires, so it gets renewed in time. | Slack, PagerDuty, email, or webhooks | Email, Slack, or Jira. ServiceNow on Premium |
| Certificate syncsInstalling certificates automatically on the load balancers, servers, and cloud services that use them. | Pushed to 15+ destinations with no agent on the target | Advanced plan, through sensors and agents |
| Access controlRules for who can read or change which secrets and certificates. | ||
| SAML SSOSigning in through your company's identity provider, like Okta or Microsoft Entra ID. | ||
| Audit logsA record of who did what, kept for security reviews and compliance. | ||
| Pricing modelWhat the price is based on. | Quote-based subscription or free tier | Per certificate. Plans with automation by quote |
| Free tierWhat you can use without paying. | An internal CA, ACME, and the certificate dashboard | |
Use DigiCert Trust Lifecycle Manager and Infisical together
Infisical orders certificates from DigiCert CertCentral, so you keep your DigiCert account, organizations, and validated domains.
What stays on DigiCert
CertCentral as your public CA for OV, EV, and code-signing certificates.
What Infisical adds
On top of what CertCentral covers:
- One inventory for certificates from every CA, including Let's Encrypt, Sectigo, and AD CS
- Automated renewal and delivery, with no agent on each server
- Your own private CAs for internal certificates, cloud or self-hosted
- ACME, EST, and SCEP enrollment for servers, Kubernetes, network gear, and devices in Intune or Jamf Pro
How they connect
Infisical can order certificates through CertCentral or over DigiCert's ACME so you don’t have to switch certificate vendors.
Frequently asked questions
Everything you need to know. Can't find an answer? Talk to our team.
DigiCert publishes one price for Trust Lifecycle Manager: $40 per seat on the Essentials plan, with a 25-seat minimum, where each managed certificate is a seat. Essentials covers DigiCert certificates with cloud and Certificate Transparency log discovery. Third-party CAs, internal network discovery, and managed automation need the Advanced plan. Kubernetes and ServiceNow need Premium. Both priced by quote. The license is only part of the cost, since TLM's automation runs through sensors and agents your team installs and keeps running. Infisical automates certificates from any CA without software on each server, and has a free tier.
Yes. Infisical discovers, renews, and installs certificates from DigiCert and any other public or private CA, and runs its own private CAs. You can keep buying certificates from DigiCert, since Infisical orders them through CertCentral. TLM needs sensors and agents on your network for the same automation, and its Advanced plan for certificates from other CAs.
DigiCert retired CertCentral's discovery and managed automation on October 1, 2026, and data from earlier scans is no longer accessible. DigiCert points affected customers to Trust Lifecycle Manager, where managed automation needs the Advanced plan plus new agents and sensors. CertCentral's ACME and API stay, which means Infisical can keep ordering from CertCentral and take over discovery, renewal, and delivery.
Yes. Infisical orders OV and EV TLS certificates and code-signing certificates from DigiCert CertCentral through its Services API, or over DigiCert's ACME with external account binding. Your CertCentral account, organizations, and validated domains stay as they are, and Infisical handles renewal and delivery.
Yes. Infisical runs its own private CAs and connects to other public and private CAs, such as Let's Encrypt, Sectigo, and Microsoft AD CS, alongside DigiCert. Servers, Kubernetes workloads, network equipment, and devices managed in Microsoft Intune or Jamf Pro enroll over ACME, EST, or SCEP, and every certificate sits in one inventory. In Trust Lifecycle Manager, certificates from CAs other than DigiCert need the Advanced plan and a sensor-run connector for each CA.
Yes, for anything beyond cloud and Certificate Transparency log discovery. TLM needs a sensor on a dedicated host for network scans, appliances, cloud services, and CA connectors, and DigiCert recommends several for failover. An agent goes on each server it scans or automates, and the Microsoft CA connector needs its own Windows host. Infisical Cloud needs one gateway to reach a private network.
Infisical's core is open source under the MIT license, and Infisical can be self-hosted. It covers private CAs, ACME, EST, and SCEP enrollment, discovery, renewal, and certificate syncs, and issues from DigiCert and other public CAs. Trust Lifecycle Manager is proprietary.
How to migrate from DigiCert Trust Lifecycle Manager to Infisical
Most teams move one application at a time, so TLM and Infisical run side by side until the last workload moves.
- 01
Connect CertCentral
Connect your CertCentral account with an API key or ACME credentials, so Infisical orders from DigiCert.
- 02
Build the inventory
Run discovery across your networks and Linux servers, and import the certificates you already hold.
- 03
Move renewal and delivery
Point ACME clients at Infisical and replace TLM agent and sensor jobs with certificate syncs.
- 04
Retire TLM
Once nothing depends on TLM, remove its agents and sensors. CertCentral stays your CA.
Our team can help you plan and run the migration.
Start managing certificates, then add secrets, privileged access, KMS, or agent access.
Add products when you need them, on the platform you already run.
- OpenAI: API, Codex
- Let's Encrypt
- Vercel
- Gemini CLI
- Apache Airflow
- Spring Boot
- OpenCode
- DigiCert
- Jenkins
- Terraform: Terraform, Terraform Cloud
- Render
- Azure: Key Vault, App Configuration, DevOps, Entra ID, CLI
- NetScaler
- Databricks
- KMIP
- GoDaddy
- Pulumi
- Okta
- Ansible
- Cloudflare: Workers, Pages, Custom certificates
- Sectigo
- Laravel
- Hermes
- SAP HANA
- ClickHouse
- OpenRouter
- Supabase
- Docker
- Snowflake
- Venafi
- Rails
- Humanitec
- Tailscale
- 1Password
- OpenClaw
- Cassandra
- Northflank
- Redis
- Datadog
- Google Cloud: Secret Manager, Certificate Manager, IAM, KMS
- Dell PowerEdge
- Bitbucket
- Claude Code
- Railway
- dbt Cloud
- Windows Server
- Chef
- .NET
- PostgreSQL
- AWS: Secrets Manager, Parameter Store, Certificate Manager, Elastic Load Balancing, Private CA, IAM, KMS, CloudHSM, ECS, Amplify
- Linux servers
- Auth0
- Oracle: Oracle Database, OCI Vault
- Octopus Deploy
- Fly.io
- MySQL
- F5 BIG-IP
- LDAP
- TeamCity
- Qovery
- Nutanix Prism Central
- Microsoft: Active Directory, AD CS
- Windmill
- LiteLLM
- Netlify
- RabbitMQ
- Spacelift
- Kubernetes
- CircleCI
- GitLab
- SQL Server
- Stripe
- DigitalOcean
- GitHub: GitHub, GitHub Actions
- Couchbase
- MongoDB: MongoDB, MongoDB Atlas
- Heroku
- SSH
- Salesforce
- HashiCorp Vault
- Travis CI
- Kemp LoadMaster
- Next.js
- Django
- Sigstore Cosign
- Elasticsearch
- Certificate ManagementToday
- Secrets ManagementWhen you need it
- Privileged Access ManagementWhen you need it
- KMSWhen you need it
- Agent VaultWhen you need it
Talk to our team
Starting with Infisical is simple, fast, and free.
- SOC 2, HIPAA, and FIPS 140-3 compliant
- Open source, in our cloud or yours
Talk to your boss
Need a yes from your boss?
Here's a message to send your manager. Edit it, then paste it into Slack, Teams, or an email.
Trusted by teams at
