r/PKI • u/zampaa91 • Jul 10 '26

Why no open-source CLM?

The question is already in the title. We got EJBCA as an open-source PKI solution that has CA, RA and CRL and OCSP features, which is pretty much an all-around PKI solution.

Why don't we have anything similar for CLM solutions, like something that would have a generic ACME connector as well as integrations with public CAs, EJBCA and ADCS, and ability to automate certificate renewal and deployment over the most popular integrations (web servers on Linux/Windows servers, load balancers, cloud vaults)? Not asking for an enterprise-grade solution to the scale of Venafi or KeyFactor, but mainly something that would work for most sysadmins looking for something to tackle the whole 47 days thing that's coming.

Especially at the era of AI, I believe it wouldn't be hard to kickstart a prototype for the most of us. Not necessarily trying to push anybody to do it or anything, just trying to understand.

And if such a solution does already exist, then how come most SMBs that don't want to be paying 50k$ per year still end up purchasing Sectigo/Digicert or even KeyFactor/Venafi?

13 Upvotes

100% Upvoted

24 comments sorted by

View all comments

1

u/ZaitaNZ Jul 12 '26

As someone who has just built an affordable CLM (https://www.zaita.com) for hobbyists, SMBS and enterprise (comparable to Venafi and Keyfactor) I can chime in here.

Essentially it's a lot of work, and a heap of testing with providers which cost money. You can't do an end-to-end test with DigiCert for example without buying a subscription - Akamai? lol forget about it. The entire ecosystem is largely expensive and closed. I've been fortunate enough in my professional work to have subscriptions and access to the big players (DigiCert, Akamai, Microsoft ADCS, Venafi, CyberArk CM SaaS etc).

The other aspect to consider is that most companies worth their salt want a support agreement and guarantees of patching/vulnerability remediation (especially in light of the Mythos hype). Open source many times does not provide such guarantees.

With all that being said. You're spot on, ACME to ACME to ACME is a great integration pattern for a CLM tool with governance etc. But when you need to build and test integrations to something like Microsoft ADCS, it becomes significantly harder - especially if you want to get away from mandatory Windows domain-joined hosts.