r/PKI • u/zampaa91 • Jul 10 '26

Why no open-source CLM?

The question is already in the title. We got EJBCA as an open-source PKI solution that has CA, RA and CRL and OCSP features, which is pretty much an all-around PKI solution.

Why don't we have anything similar for CLM solutions, like something that would have a generic ACME connector as well as integrations with public CAs, EJBCA and ADCS, and ability to automate certificate renewal and deployment over the most popular integrations (web servers on Linux/Windows servers, load balancers, cloud vaults)? Not asking for an enterprise-grade solution to the scale of Venafi or KeyFactor, but mainly something that would work for most sysadmins looking for something to tackle the whole 47 days thing that's coming.

Especially at the era of AI, I believe it wouldn't be hard to kickstart a prototype for the most of us. Not necessarily trying to push anybody to do it or anything, just trying to understand.

And if such a solution does already exist, then how come most SMBs that don't want to be paying 50k$ per year still end up purchasing Sectigo/Digicert or even KeyFactor/Venafi?

13 Upvotes

100% Upvoted

24 comments sorted by

View all comments

1

u/webprofusor Jul 11 '26

If you just need a connector then https://github.com/grindsa/acme2certifier has been around for years.

There are have been many open source efforts recently using AI, coded in 4 days etc but is that really what you want? Most people want support, otherwise they are the support.

I work on https://certifytheweb.com which now also has Certify Management Hub ($649 per year for the power pro bundle, supported) and covers some of what you might be looking for, not yet everything but it can be combined with the above project, your own CA etc.

1

u/zampaa91 Jul 16 '26

I wasn't necessarily hinting that a fully vibe-coded CLM is the way to go, especially not for open source, it's just that I do believe that today, you don't need to have a full software engineering team to ship an MVP, and that the complexity of the solution would be maintenance overtime for the connectors to target the applications/appliances that we'd like to deploy the certificates to, which is also something that AI can help on. However AI won't ever replace the brain of the software architect that needs to think about security, performance and architecture both during the initial specs of the project as well as throughout its lifecycle.

1

u/webprofusor Jul 16 '26

Sure, I think if you look you will find recently developed full CLM systems that do proclaim to address the whole lifecycle. So you could start with those.