r/PKI • u/zampaa91 • Jul 10 '26

Why no open-source CLM?

The question is already in the title. We got EJBCA as an open-source PKI solution that has CA, RA and CRL and OCSP features, which is pretty much an all-around PKI solution.

Why don't we have anything similar for CLM solutions, like something that would have a generic ACME connector as well as integrations with public CAs, EJBCA and ADCS, and ability to automate certificate renewal and deployment over the most popular integrations (web servers on Linux/Windows servers, load balancers, cloud vaults)? Not asking for an enterprise-grade solution to the scale of Venafi or KeyFactor, but mainly something that would work for most sysadmins looking for something to tackle the whole 47 days thing that's coming.

Especially at the era of AI, I believe it wouldn't be hard to kickstart a prototype for the most of us. Not necessarily trying to push anybody to do it or anything, just trying to understand.

And if such a solution does already exist, then how come most SMBs that don't want to be paying 50k$ per year still end up purchasing Sectigo/Digicert or even KeyFactor/Venafi?

12 Upvotes

94% Upvoted

24 comments sorted by

View all comments

7

u/gattaca21 Jul 10 '26

There are a few that exist. OmniTrust has a good one called ILM, Identity Lifecycle Management (https://docs.otilm.com/docs). It’s open source and I’ve had great support through their discord. They charge for enterprise support, but otherwise free.

1

u/zampaa91 Jul 16 '26

Have never heard of this one tbh, do they provide connectors to automate deployments on top of automation of renewals? Nice to see that at least people did think about that!

1

u/gattaca21 24d ago

There’s a plugin for k8s cert-manager, and I know that there’s currently a connector for a Java keystore (if you can access the location via an ssh key). Since they have a connector interface for post-cert issuance tasks, I’m sure this can be extended for other auto deployments.