Certificate Authorities & TLS Lifecycle

One workspace, many CAs

Versus TLS Cert LCM manages the whole life of a certificate — not just issuance. It discovers the certificates already on your estate, brings them under governance, issues new ones from whichever Certificate Authority you prefer, deploys them to your ADCs and Cloud WAF / Bot platforms, renews them automatically before they expire, and keeps an audit trail of every change. One policy model, many CAs.

The lifecycle Versus manages

A certificate can enter this loop at any stage: minted fresh through Issue Cert, or discovered on a device and adopted into management after the fact.

Certificate Authority support

Versus is deliberately CA-agnostic. The same issuance, deployment, and renewal machinery works no matter where a certificate is signed — you choose the CA per certificate (or per profile). Supported sources fall into five categories.

Generally available  Public ACME CAs

Any CA that speaks ACME (RFC 8555) works, including:

• Let's Encrypt — production and staging
• ZeroSSL — requires External Account Binding (EAB)
• Buypass Go — production and test
• Google Trust Services — requires EAB
• Any other RFC 8555 directory — point Versus at its directory URL

Free or low-cost, publicly-trusted, short-lived certificates — the best fit for automated renewal.

Generally available  Private / internal CA

• Versus Internal ACME CA — run Versus itself as a private CA served over ACME (RFC 8555), so internal services enroll and renew automatically without traffic leaving your network.
• Collector CA — the built-in CA that secures the Versus Collector fleet.

Orchestration  Enterprise CLM platforms

Where you already run an enterprise certificate-lifecycle platform, Versus orchestrates through it rather than replacing it — requesting, renewing, and triggering workflows on Venafi TLS Protect Cloud, Venafi TLS Protect Data Center (TPP), Keyfactor Command, and AppViewX CERT+. See Certificate Platform Integration for connection details.

Connect now · issuance on the roadmap  Commercial CA APIs

Commercial CAs are configurable as CA accounts now so they appear in inventory and policy, with direct API-driven issuance being rolled out: DigiCert CertCentral, Sectigo Certificate Manager, Entrust Certificate Services, and GlobalSign Atlas. Until direct issuance lands for a given provider, you can still issue against these CAs through ACME (where offered) or via CLM-platform orchestration.

Roadmap  Enterprise PKI

Planned CA-account drivers for internal and cloud PKI:

• Microsoft AD CS (SCEP / web-enroll)
• EJBCA / Keyfactor EJBCA
• HashiCorp Vault PKI
• AWS Private CA
• Google Cloud Certificate Authority Service
• Smallstep step-ca

External Account Binding (EAB)

Some public CAs — notably ZeroSSL and Google Trust Services — require EAB to tie the ACME account to your CA subscription. Versus stores the EAB key ID and HMAC key on the CA account and binds automatically on first registration. Let's Encrypt and Buypass Go need no EAB.

Domain validation (DNS-01)

Public ACME CAs prove domain control before signing. Versus automates this with DNS-01: it writes the _acme-challenge TXT record through a managed DNS provider, waits for validation, then removes it. Supported DNS solvers:

• Cloudflare — TXT records via the Cloudflare API, zone auto-resolved
• Infoblox DDI — TXT records via WAPI

The internal ACME CA and enterprise CLM platforms don't require public DNS validation.

Key custody

Two custody models, chosen per certificate profile:

• Centralized escrow — Versus generates and holds the private key, envelope-encrypted (per-secret DEK) in the Versus Vault, so it can deploy and rotate on your behalf.
• Device-generated — the key is generated on the ADC (or Cloud WAF / Bot platform) and never leaves it; Versus manages the certificate around it.

Deployment to your ADC and Cloud WAF / Bot estate

Whichever CA signed a certificate, it deploys through one vendor-aware step — there's no per-CA or (from the operator's view) per-vendor deploy path. Two modes match how each vendor implements certificate replacement:

• Overwrite in place (preferred) — replace the existing certificate object and key, and force the bound SSL/TLS profile to pick up the change.
• New name + rebind — create a new certificate object (year-suffixed name) and repoint the SSL/TLS profile to it, preserving the previous object for rollback.

Deployment targets — device and SSL profile — are auto-discovered by matching the certificate to bound profiles across your estate. F5 BIG-IP (ADC) is fully supported today, including on-prem devices reached through the Versus Collector tunnel (device credentials never leave the customer network). Additional ADC and Cloud WAF / Bot targets — NetScaler, Avi, F5 Distributed Cloud (XC), and Cloudflare — are being added.

Renewal & automation

• ARI-driven auto-renew — renewal timing follows ACME Renewal Information (RFC 9773) where the CA supports it, so you renew exactly when the CA recommends, not on a fixed day count.
• Policy thresholds — for non-ARI CAs, renew at a percentage of lifetime remaining or a day count set on the cert profile.
• Notifications — email, AD group, or ServiceNow group contacts on approaching expiry or failed renewal.
• Approvals & change gates — production certificate workflows can require approval and route through an ITSM change gate, with automatic backout on failure.

Adopting discovered certificates

Certificates found by discovery start as inventory — visible and governed, but not yet operationally managed. Manage this cert promotes an inventory record into a managed certificate so it can be renewed and deployed. Because a discovered cert has no private key in Versus, adoption offers both paths:

• Renew to adopt (recommended) — no key needed now; the first renewal mints a fresh key and certificate.
• Upload existing key / PFX — provide the current private key (PEM) or a PKCS#12/PFX bundle to deploy immediately.

Governance & audit

• Inventory across issued, discovered, and imported certificates, with expiry, key-strength, and post-quantum status.
• Compliance scoring and status filters (Pending Approval, Deployed, Expiring, Expired, Failed).
• Tenant isolation — every certificate, CA account, and key is scoped per tenant with row-level security.
• Execution log — Deploy Jobs records every issuance, renewal, and deployment run, who or what triggered it, and its outcome.