- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Entrust Certificate Manager
The certificate that took down production was the one nobody knew existed. Discovery, inventory and automated renewal across a real estate — and the discovery half matters more, because a renewal process only covers certificates you know about.
Data residency & processing — two different questions
Where data lives
Yours — on-premises appliances in India
nShield HSMs are physical appliances in your own data centre, and private PKI can run on-premises too. Keys are generated and held in hardware you own, in India, under your administrators — the evidence is a serial number and an access log rather than a contract clause.
The constraint, stated plainly
No India region for the managed service
nShield as a Service runs in the UK, US, Germany and Australia. Entrust has live engineering hiring in Bengaluru and Pune, and that is people in India, not data in India — treating an engineering presence as a residency answer is the error that surfaces during an audit.
For a residency-bound Indian buyer the answer is appliances you operate, which is very likely what your regulator wanted anyway. Note what does not exist so its absence is not misread: Gartner publishes no Magic Quadrant for HSM or key management at all, only Market Guides, which have no Leader quadrant — and we could not verify an HSM Leader placement for Entrust with any analyst. A search caution specific to this vendor: “Entrust India” surfaces several unrelated companies, including a Bengaluru wealth manager, so check you are reading about Entrust Corporation before drawing conclusions.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Entrust portfolio
This page covers Entrust Certificate Manager — certificate discovery, inventory and renewal. The rest of the Entrust portfolio on TechBag:
Quick facts
30-second orientation- Product
- Entrust Certificate Manager — Cryptographic Security Platform
- The real problem
- Certificates nobody knew existed, expiring unannounced
- Why now
- Public TLS lifetimes: 200 days (Mar 2026) → 47 days (Mar 2029)
- Scope
- Manages certificates — does not issue trust; you still need a CA
- Discovers
- Networks, cloud environments and CA repositories
- Multi-CA
- Entrust, Microsoft AD CS and third-party CAs
- Automation
- ACME and EST enrolment; alerts and scheduled renewals
- Also inside
- The PKI Hub appliance bundles its lifecycle management
- Vendor
- Entrust — CEO Tony Ball, from 31 March 2026
- Public certificates
- Entrust sold that business to Sectigo, Sept 2025
- Analyst standing
- No CLM analyst ranking cited here
- Deployment
- On-premises or cloud — no documented India cloud region
- Pricing
- Quote-only — no published list price
- Buy in India via
- TechBag — INR, GST, discovery scoping
Understand certificate lifecycle management before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
Discovery, inventory, renewal and revocation across the certificates scattered through your estate — including the ones nobody remembers issuing. Entrust sells it as Certificate Manager.
Spreadsheet tracking vs lifecycle management — the honest table
What discovery and automation change, dimension by dimension.
| Dimension | Spreadsheet & calendar reminders | Certificate Manager |
|---|---|---|
| How many certificates? | Nobody knows | One discovered inventory |
| Certificate on an old appliance | Found when it expires | Found by the scan |
| Who owns it | Whoever installed it, maybe | A named owner per record |
| Renewal | Manual, from a reminder | ACME, EST or scheduled |
| Several CAs | A portal per issuer | One console across CAs |
| 47-day lifetimes | Unworkable by hand | Automated |
| Audit request | A week of emails | A report |
| Post-quantum planning | No inventory to start from | Key and algorithm per record |
Certificate lifecycle management manages trust; it does not issue it. A CA still sits behind it — your private PKI, and a public CA for browser-trusted certificates, which Entrust no longer sells.
The five pieces of certificate lifecycle management
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Discover
Network scans, cloud connectors and imports from CA repositories surface certificates wherever they are installed — including ones nobody recorded at issue.
Inventory
Each certificate gets one record — issuer, key, algorithm, expiry, location and owner — so ‘what expires next month’ becomes a query, not an investigation.
Multi-CA Control
Request, renew and revoke across Entrust CAs, Microsoft AD CS and third-party CAs from one console, instead of a separate portal and process per issuer.
Automate
ACME and EST enrolment, alerts and scheduled renewals replace the calendar reminder — the only approach that survives 47-day certificate lifetimes.
Report
Reports on expiring and non-compliant certificates give owners a to-do list and give auditors evidence that the certificate estate is actually managed.
Discovery feeds the inventory, the inventory drives renewal, and the reports prove the estate is under control.
Twelve capabilities. Discover, automate, govern.
What Entrust Certificate Manager actually does — find every certificate, renew it before it expires, and show who owns it.
Network Certificate Discovery
Scan address ranges and ports to find TLS certificates on servers, load balancers and appliances — including those installed by hand.
Import from CA Repositories
Pull issued-certificate records from connected CAs, so the inventory starts from what was issued, not only what a scan can reach.
Cloud Environment Discovery
Find certificates in cloud environments alongside on-premises ones, so a migration does not quietly create a second, invisible estate.
Key and Algorithm Detail
Each record carries key type, size and algorithm — the inventory any post-quantum migration plan has to start from.
Expiry Alerts and Notifications
Automated notifications warn owners ahead of expiry, so a renewal is a named person’s task rather than a message in a shared inbox.
Protocol-Based Renewal
ACME for web-facing servers and EST for enterprise workloads let endpoints renew themselves; manual renewal does not scale to 47-day lifetimes.
Issue from Any Connected CA
Request, renew and revoke from Entrust, Microsoft AD CS and third-party CAs through one workflow and one audit trail.
CA Gateway REST API
The Entrust CA Gateway exposes lifecycle operations and reporting to scripts, pipelines and service-management tools.
An Owner for Every Certificate
Assign each certificate to a team or application owner, so an expiry has someone accountable before it becomes an outage.
Compliance and Audit Reports
Automated reports on expiring, non-compliant and unmanaged certificates give audit evidence and a prioritised work list.
Policy-Driven Automation
Set which issuers, key sizes and validity periods are acceptable, and let automation act on that policy rather than on ad-hoc requests.
Part of a Wider Platform
Certificate Manager sits in Entrust’s Cryptographic Security Platform beside PKI and key management, and ships inside the PKI Hub appliance.
Watch Entrust Certificate Manager in action
Why 47-day certificates force automation, and the expiry risk this product exists to remove — from Entrust’s own channel.
Preparing for 47-Day TLS/SSL Certificates
Why renewal automation is becoming mandatory.
Solving Certificate Expiration Risks
The outage this product exists to prevent.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Certificates expire. Outages should not.
Here’s what genuinely sets Entrust Certificate Manager apart.
The discovery half is the half that matters
Every organisation has a renewal process, and every organisation still has certificate outages. The reason is that a renewal process only covers certificates somebody knows about, and the certificates that cause outages are by definition the ones nobody was tracking — installed manually during an incident, provisioned by a team that has since reorganised, sitting on an appliance whose owner left two years ago. A certificate under active management rarely expires unexpectedly. Discovery is what converts the unknown set into the managed set, and it is the step most organisations skip because it is less obviously valuable than automation until the first time it finds something.
Expired certificates cause outages out of all proportion
The failure is always the same shape: a service stops working, nobody can immediately say why, and the eventual cause is a certificate nobody was watching. What makes it disproportionate is that the outage is total rather than degraded, the cause is not obvious from the symptoms, and it frequently happens on infrastructure whose owner has moved on. None of this is a cryptographic problem. It is an inventory problem wearing a cryptographic costume, which is why the answer is management rather than better certificates.
Shortening lifetimes turn a manageable task into a treadmill
Industry certificate validity periods keep contracting. A manual renewal process that worked comfortably when certificates lasted years becomes a recurring source of incidents when they last months — the same work, several times more often, against an estate that is also growing. Automation stops being a nice-to-have at that point and becomes the only way the process survives contact with reality. This is the single strongest reason organisations that considered certificate management solved are revisiting it.
Machine identity growth compounds the problem
Workloads, services, containers and devices now vastly outnumber human users, and each needs certificates. So the number of certificates to track is rising while the interval between renewals is falling. Those two trends multiply rather than add, and an estate that was manageable by hand three years ago frequently is not now — usually discovered through an outage rather than through planning.
The honest positioning
Buy this when you cannot confidently list your certificates, or when you have had an outage caused by one you did not know about — which in our experience is what actually triggers the purchase. Be clear about what it is not: it manages certificates, it does not issue trust, so a CA still sits behind it, public or private. And if your estate is genuinely small and stable, a well-maintained spreadsheet with calendar reminders is not a ridiculous answer, and we will say so rather than sell you a platform you do not need yet.
The numbers behind Entrust
What your certificate lifecycle journey looks like
Run discovery before anything else
Scan networks and pull CA records first. The count and spread of what you find — not a guess — should size the licence and the automation plan.
List every issuing CA
Name the CAs in use — Entrust, Microsoft AD CS, public CAs. Former Entrust public certificates now renew through Sectigo, so connect that too.
Assign owners
Give every certificate a team or application owner. Unowned certificates are the ones that expire in production.
Automate the high-volume paths
Move web servers to ACME and internal workloads to EST first — the renewals that shorter public lifetimes will multiply fastest.
Report and re-scan
Schedule discovery and expiry reports monthly; new certificates appear every week, and an inventory decays the moment scanning stops.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“The first discovery scan found certificates on appliances our CMDB had never heard of.”
“Every certificate has a named owner now, so the expiry email lands with a person instead of a shared mailbox.”
“It manages our AD CS and public certificates side by side. We still had to pick a new public CA.”
“The connectors took longer than planned. The payoff was our first quarter without a certificate outage.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the certificate-lifecycle market — tap any vendor to see why it sits where it does.
TechBag Certificate-Lifecycle Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Multi-CA lifecycle management from a vendor that no longer runs a public CA.
CA Independence × Automation Depth
How well the tool works with CAs other than the vendor’s own vs how deep its renewal automation goes.
Strongest where Entrust PKI is the private CA behind it.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Entrust Certificate Manager vs the lifecycle-management field
DigiCert, CyberArk (Venafi), Keyfactor and Sectigo — honest lanes; the edge is multi-CA management for estates already on Entrust PKI or nShield.
| Dimension | Entrust | DigiCert | CyberArk (Venafi) | Keyfactor | Sectigo |
|---|---|---|---|---|---|
| What it actually is | Certificate Manager, multi-CA | Trust Lifecycle Manager, beside its own public CA | Machine-identity platform built on Venafi | Keyfactor Command, CA-agnostic | Sectigo Certificate Manager, beside its own public CA |
| Runs its own public CA | No — sold to Sectigo, Sept 2025 | Yes | No — works with your CAs | No public CA; EJBCA for private | Yes — now serving former Entrust customers |
| Multi-CA management | Entrust, Microsoft AD CS and third-party CAs | Its own and third-party CAs | CA-agnostic by design | CA-agnostic | Marketed as CA-agnostic |
| Private CA from the same vendor | Entrust PKI and PKI Hub | DigiCert private CA | Works with your existing CAs | EJBCA | Sectigo private CA |
| On-premises deployment | Yes — standalone or inside PKI Hub | Confirm with DigiCert | Confirm with CyberArk | Confirm with Keyfactor | Confirm with Sectigo |
| India data residency | On-premises keeps it in India; no documented India cloud region | Confirm hosting region | Confirm hosting region | Confirm hosting region | Confirm hosting region |
| Published pricing | Quote-only | Quote-only | Quote-only | Quote-only | Quote-only |
| The thing to plan around | You still need a public CA for public TLS | Easiest when DigiCert is also your CA | Broad platform — scope it carefully | Connector and agent rollout effort | Easiest when Sectigo is also your CA |
| Best fit | Estates already on Entrust PKI or nShield | One vendor for public CA and lifecycle | Machine identity beside privileged access | CA-agnostic lifecycle with open-source PKI | Former Entrust public-certificate customers |
Which certificate-management approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Entrust Certificate Manager if…
- ✓You already run Entrust PKI, PKI Hub or nShield
- ✓You need one inventory across Entrust, AD CS and other CAs
- ✓On-premises deployment matters for residency
- ✓You want 47-day readiness without changing your private CA
DigiCert or Sectigo if…
- ✓You want your public CA and lifecycle management from one vendor
CyberArk (Venafi) if…
- ✓Machine identity sits with your privileged-access programme
Keyfactor if…
- ✓You want CA-agnostic lifecycle management with EJBCA behind it
A spreadsheet if…
- ✓Your estate is small, stable and genuinely fully known
Entrust Certificate Manager is one of 21 encryption & rights management products TechBag carries. The encryption & rights management guide narrows them to a shortlist and shows the reasoning. →
What could this save you?
Drag the sliders (certificates under management; loaded engineer-hour cost). Estimates assume the tracking and manual renewal effort removed once discovery and renewal are automated — the larger, unpriced win is the outage an unknown certificate never causes. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Entrust Certificate Manager is quote-priced (no public list) — scoped by the certificates under management and the deployment (on-premises, cloud or inside PKI Hub). Check whether PKI Hub already includes it. TechBag right-sizes it and quotes in INR with GST.
Certificate Manager
Best for multi-CA visibility and renewal
- Discovery across network, cloud and CAs
- One inventory with owners and expiry dates
- ACME and EST automated renewal
Inside PKI Hub
Best if you also need a private CA
- Lifecycle management bundled in the appliance
- Private CA, OCSP and timestamping alongside
- Cloud or on-premises
+ Your public CA
Best for browser-trusted certificates
- Entrust no longer issues public TLS
- Connect Sectigo, DigiCert or another public CA
- Manage both from one inventory
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 10 questions to ask every vendor
Take this into your next vendor call — including ours.
Can it find certificates on appliances and load balancers that no CA record knows about?
Does it manage every CA we use — Entrust, Microsoft AD CS and our public CA?
Which public CA will issue our browser-trusted certificates, now that Entrust no longer does?
Which endpoints can renew via ACME or EST, and which will need agents or scripts?
Is our renewal process ready for 200-day public certificates from March 2026 and 47-day ones by 2029?
Will every certificate have a named owner who receives the expiry alert?
On-premises, cloud or inside PKI Hub — and where is the inventory data hosted?
If we buy PKI Hub, is lifecycle management already included — and are we paying for it twice?
Can it produce the report our auditor or regulator will actually ask for?
What drives the price as the certificate count grows, and what does renewal look like?
Questions buyers ask
Ready to find every certificate before it expires?
Scope a discovery run, plan for 200-day and 47-day lifetimes, or let a TechBag advisor size the inventory and the automation with you.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.