CA-agnostic lifecycle without vendor lock-in.
DigiCert CertCentral is an excellent portal for managing DigiCert-issued certificates. TigerTrust adds the layer above it — a CA-agnostic lifecycle platform that treats DigiCert as one issuer among many, plus discovery and reporting for the certs DigiCert never saw.
Keep DigiCert as a CA. Drop DigiCert as the platform.
DigiCert is a top-tier public CA — most enterprises rightly keep them for EV, code signing, and high-assurance workloads. CertCentral is a good portal for those certificates, but not a full CLM.
What changes when the platform is CA-agnostic.
- Lifecycle tooling scoped to DigiCert-issued certificates
- Limited discovery outside DigiCert-managed inventory
- Basic automation — mostly renewal orchestration
- No SSH certificate lifecycle in the same platform
- Cost model tied to DigiCert certificate consumption
- Every certificate in the estate, regardless of issuer
- Full network, cloud, and Kubernetes discovery
- ACME, webhooks, cert-manager, Terraform, event-driven policy
- SSH certificates, code signing, and workload identity together
- Platform pricing separate from what you spend at any CA
Capability comparison, head to head.
DigiCert is a top-tier CA. CertCentral is its management portal, not a full CLM. Here is where the two overlap and where they don't.
| Capability | TigerTrust | DigiCert CertCentral |
|---|---|---|
DigiCert CA issuance & renewal DigiCert is authoritative for DigiCert-issued certs | ||
Multi-CA orchestration (non-DigiCert issuers) | ||
ACME protocol / Let's Encrypt | ||
Certificate discovery across the estate | ||
Kubernetes cert-manager integration | ||
SSH certificate lifecycle | ||
GraphQL API | ||
GitOps / Terraform workflows | ||
Public CA trust & compliance pedigree DigiCert operates its own public trust anchors; TigerTrust orchestrates trusted CAs but is not itself a WebTrust-audited public CA |
Adding TigerTrust on top of CertCentral.
You do not have to leave DigiCert to gain a CLM. Most teams keep DigiCert as a preferred CA and add TigerTrust as the platform.
Connect CertCentral
Add DigiCert as an issuer in TigerTrust using your existing CertCentral API key. Existing DigiCert inventory imports automatically.
Add other issuers
Connect any other CAs in play — Sectigo, Entrust, private CAs, Let's Encrypt for lower-assurance workloads. Policy decides which cert type routes to which CA.
Turn on discovery
Point discovery at your clouds, Kubernetes clusters, and network ranges. Every certificate — DigiCert or not — appears in one inventory.
Automate deployment
Enable ACME endpoints, cert-manager issuers, webhook renewals, and Terraform. DigiCert keeps issuing; TigerTrust keeps deploying and reporting.
Frequently asked questions
Do we have to leave DigiCert to use TigerTrust?
No — and most teams don't. DigiCert stays as a preferred CA for EV, code signing, and high-assurance workloads. TigerTrust sits above it as the CLM plane, adding multi-CA orchestration, discovery, and reporting.
Can we use Let's Encrypt for lower-assurance certs and DigiCert for the rest?
Yes. Policy in TigerTrust routes each certificate request to the appropriate CA based on hostname, environment, tags, or approver. This is one of the most common patterns customers adopt on switch-day.
How does CertCentral integration work?
TigerTrust uses the CertCentral API to enroll, retrieve, and revoke DigiCert-issued certificates. Your DigiCert contract, sub-account structure, and validation model stay intact.
What about SSH certificates and code signing?
Both are managed in TigerTrust as first-class citizens. CertCentral is scoped to X.509, so if you want a single platform for SSH and code signing alongside your TLS certificates, that consolidation is part of the switch.
How is pricing structured?
Platform pricing is separate from what you spend on certificates. You can keep spending at DigiCert for the certs that need it, and route commodity TLS to free issuers where policy allows. Ask us for a side-by-side against your current DigiCert contract.
Kept DigiCert as the trust anchor, added TigerTrust as the platform above it.
“We did not want to leave DigiCert for the certs that matter. We wanted a CLM around them — plus Let's Encrypt for commodity workloads and Vault for internal service mesh.”
Every CA in your estate, one policy plane.
DigiCert remains a first-class issuer — alongside every other CA teams need in a real multi-issuer estate.
Also worth comparing
TigerTrust vs Sectigo
The other mainstream public CA whose portal customers often outgrow the same way.
TigerTrust vs Entrust
The third of the commercial-CA trio — customers evaluate all three portals against a real CLM.
Certificate Lifecycle Automation
The CA-agnostic CLM product that sits above DigiCert and every other issuer you use.
PKI Modernisation
The buyer journey for teams unifying multi-CA estates onto a single policy plane.