We're evaluating several options for automating certificate deployment and renewal across both enterprise IT and operational technology environments. I'd like to build a lab by the end of the year and test at least one dependable ACME-capable solution that can update certificates on OT software, servers, workstations, and related systems. Our environment includes Allen-Bradley and Siemens controllers and HMIs, Ignition, Canary, Windows IoT, Windows Server 2016 and 2022, and Windows 10 and 11 Pro. Has anyone implemented certificate lifecycle management across a similar mix of systems, particularly where some applications require certificates to be imported through their own administration interfaces?
4 Answers
If you only need server-certificate deployment, a more focused product such as CertKit could be simpler and less expensive than a larger enterprise platform. The tradeoff is that it may not cover client certificates or the specialized certificate-loading workflows used by some OT applications.
Don’t assume ACME will work everywhere. Some OT products support SCEP, while others require vendor-specific procedures or scripts that connect over SSH and rotate certificates manually. Industrial equipment often lags behind current automation standards, so inventory each device and application’s certificate capabilities before choosing a platform. Also plan for vendor restrictions, maintenance windows, and devices that need a reboot before a new certificate takes effect.
A commercial lifecycle manager such as DigiCert Trust Lifecycle Manager may be worth evaluating. It can cover many conventional IT systems and unusual endpoints, but you should test each OT application directly rather than relying only on an integration list. Consultant or implementation hours can be valuable because the edge cases and renewal workflows are usually where the effort goes.
The vendor’s answer will probably depend on the exact product and certificate type. A proof of concept with representative applications and a few unusual devices is safer than assuming broad integration claims cover every workflow.
AD CS is another option for private certificates, especially when the devices can accept certificates through Windows or standard enrollment methods. It avoids ACME validation for internal systems, but many OT devices will not renew unattended and may require a restart. I would avoid extremely long-lived certificates; use a defined renewal process, document exceptions, and test whether monthly patching or planned maintenance can accommodate certificate changes.
Windows servers may be rebooted during patching, but controllers, HMIs, and production systems often have stricter uptime requirements. Treat those devices separately and verify their renewal and restart behavior during the lab phase.
The main question for us is how well it handles applications such as Ignition and Canary that expect an administrator to upload certificates through their own web or configuration interfaces. Ignition appears to place the certificate in the machine’s certificate store, but Canary may have additional application-specific behavior.