We are evaluating certificate-management platforms that can automate certificate deployment and renewal across both enterprise and operational-technology environments. I would like to have a lab running by the end of the year with at least one dependable ACME-capable solution that can update certificates on OT software, servers, workstations, and related systems. Our environment includes Allen-Bradley and Siemens controllers and HMIs, Ignition, Canary, Windows IoT, Windows Server 2016 and 2022, and Windows 10 and 11 Pro. What tools or approaches have worked well for deployments like this?
5 Answers
An internal Microsoft CA with AD CS can be a practical option for Windows systems and private certificates. It avoids relying on ACME validation and can make certificate distribution easier in domain-connected environments. However, it will not solve every OT use case, and older devices may still need manual installation, scripting, or vendor-specific enrollment.
Plan to purchase implementation or consulting time from whichever vendor you select. A proof of concept with unusual devices and applications can uncover issues around key storage, renewal permissions, certificate chains, reboots, and application-specific import steps. Public certificate lifetimes are increasingly short, so confirm that every endpoint can renew reliably without unacceptable downtime.
Do not assume ACME will work everywhere. Some devices support SCEP, while others require vendor-specific procedures or scripts to copy and rotate certificates. OT equipment often has limited certificate-management capabilities, and some applications may require a reboot or an operator to load the certificate through the application interface. Build an inventory of each device and application’s supported enrollment method before choosing a platform.
A commercial lifecycle-management platform such as DigiCert Trust Lifecycle Manager is worth evaluating. It can cover a broad mix of enterprise systems and unusual endpoints, but application-specific support varies. Ask the vendor to test Ignition, Canary, and any other software that requires certificates to be imported through a gateway or configuration page rather than directly into the operating system.
For server certificates only, a smaller deployment-focused product may be cheaper and simpler than a full enterprise lifecycle suite, especially if it already has integrations for your operating systems and services. The limitation is that these tools may not handle client certificates or specialized OT devices, so check the scope carefully.
That distinction is important. Installing a certificate in the Windows certificate store may not update an application’s internal keystore or configuration. Make sure the proof of concept tests the complete renewal process, including importing the certificate into the application and confirming that the service actually uses it.