Cert Monitoring vs. Cert Management: Pick the Right Hammer
Certificate tooling splits into four categories that vendor marketing deliberately blurs: monitoring (watches and alerts, changes nothing), lifecycle management (issues, deploys, and revokes - and can cause outages by its own action), issuance/CA (creates certificates), and discovery/inventory (finds the certificates you have). They are not interchangeable. Most teams under a few thousand certificates need discovery plus monitoring plus a managed issuance source like ACME - not a heavy lifecycle platform.
A magnifying glass, a microscope, and a telescope all let you see things you couldn't see with your naked eye. They sound like variations on the same idea. They are very different tools. A telescope cannot replace a microscope. A microscope cannot replace a magnifying glass. The right answer depends on whether you're looking at a coin, a cell, or a planet.
The cert tooling market has the same problem.
Cert monitoring. Cert lifecycle management. Cert discovery. Cert issuance. PKI as a service. Machine identity management. The vendor pitches describe overlapping ideas. The products are not interchangeable. Teams that buy the wrong one end up paying for capability they don't use and missing capability they actually need.
Here's a clearer way to think about the categories, why they matter, and how to identify which one you actually need.
The four categories
Almost every cert-related tool fits into one (or a combination) of four categories.
Category 1: Monitoring. Watches certs and alerts when something is wrong. Doesn't issue, doesn't manage, doesn't change anything. Pure observation. Examples: TLS Radar, Keychest, Red Sift Certificates, Qualys SSL Labs.
Category 2: Lifecycle management. Manages certs through their full lifecycle - issuance, renewal, distribution, revocation, reporting. Often integrated with one or more CAs. Replaces or augments manual cert processes. Examples: Venafi, Keyfactor, AppViewX, DigiCert CertCentral, Sectigo Certificate Manager.
Category 3: Issuance / CA. Actually creates certs. A certificate authority, public or internal. Examples: Let's Encrypt, DigiCert, Sectigo, AWS Private CA, HashiCorp Vault PKI, EJBCA, step-ca.
Category 4: Discovery / inventory. Finds certs that exist across your environment, often from external scanning and CT log monitoring. Sometimes a feature of the above categories; sometimes a standalone product. Examples: Censys (broader scope), CT log monitors, TLS Radar's discovery component.
A team's cert tooling usually involves elements from at least three of these categories. The trap is treating them as interchangeable when they aren't.
Why the categories matter
The differences are structural, not just feature differences.
Monitoring tools don't change your environment. They watch and alert. They don't issue certs, don't deploy them, don't revoke them. Their failure mode is "we didn't catch something." They never cause an outage by their own action.
Lifecycle management tools do change your environment. They issue certs, push them to systems, revoke them when needed. Their failure mode can include "we changed something and broke it." They can cause an outage by their own action - usually a misconfigured workflow or a deployment that went wrong.
Issuance is a separate concern again. Whether you use Let's Encrypt or DigiCert is a CA decision. The cert manager wrapping them is a different decision. You can have one without the other.
Discovery sits above the others. Without it, monitoring is limited to certs you know about, and lifecycle management can only manage what's been registered. Discovery is the precondition for both.
If you treat all four as the same thing, you'll either buy a heavy lifecycle platform when you needed monitoring (paying for capability you don't use and risking outages from the change-making side), or you'll buy lightweight monitoring when you needed lifecycle management (and continue having the operational pain you set out to solve).
The "platform that does it all" trap
The big enterprise platforms - Venafi, Keyfactor, AppViewX - pitch themselves as combined solutions across multiple categories. To be fair, they really do span multiple categories. That's their value proposition.
The trap: just because a platform can do everything doesn't mean you need everything.
If you're a team that has a working renewal process and wants to know when something's about to break, you have a monitoring problem. A platform that's primarily a lifecycle-management tool will not be better at monitoring than a focused monitoring tool - it'll just be more expensive and more complex.
If you're a team that has a chaotic, manual renewal process across many internal CAs and want to centralise it, you have a lifecycle-management problem. A focused monitoring tool will help you see the chaos but won't help you fix it.
The platforms that do everything serve customers who genuinely need everything. Most teams don't.
How to identify which category you need
A practical diagnostic. Answer the following honestly.
Question 1: Do you know what certs you have? - If no - you need discovery first. Everything else builds on it. - If yes - proceed.
Question 2: Are your certs renewing reliably? - If yes, and you just want to confirm - you need monitoring. - If no, and you want to fix the renewal process - you need lifecycle management.
Question 3: Are you issuing certs from your own CA? - If yes - you need issuance tools (or use an existing CA like Let's Encrypt). - If no - you don't need to think about this category.
Question 4: Are your certs failing in ways your current tools don't catch? - If yes - you need better monitoring, not more management. - If no - your monitoring is probably fine.
Most teams under a few thousand certs need: discovery (continuous) + monitoring (continuous) + issuance (Let's Encrypt, ACM, or a similar managed source). They do not need lifecycle management as a separate product. The lifecycle is handled by ACME and the cloud platforms; monitoring confirms it's working.
Larger teams, especially those with internal CAs and complex workflows, often need lifecycle management too. The lifecycle tools are appropriate at scale - they're overkill at smaller scale.
One small ask
The right tool for the right job. The vendor marketing for cert tools blurs categories deliberately because consolidation pitches sell better than focused tools. Underneath the marketing, the categories are real and matter. TLS Radar is squarely a monitoring + discovery tool. We don't do lifecycle management or issuance - there are good tools for those, and we'd rather you use them than us shoehorning ourselves into roles we'd serve badly. Free tier covers three domains, which is enough to see whether monitoring is what you actually need.
Monitoring done well, independent of your CA
TLS Radar is continuous, external monitoring across expiry, trust, chains, ciphers, and known vulnerabilities - independent of whoever issues or manages your certificates. Pair it with any CA or lifecycle tool you already run.
Related reading
Frequently asked questions
- What is the difference between certificate monitoring and certificate management?
- Monitoring watches your certificates and alerts you when something is wrong; it does not issue, deploy, or revoke anything, so it cannot cause an outage. Lifecycle management runs the full lifecycle - issuance, renewal, deployment, revocation - and changes your environment, which means it can cause an outage through a misconfigured workflow. Many teams need both, but they solve different problems.
- Do I need a certificate lifecycle management platform?
- Only if your renewal process is chaotic across many internal CAs and you need to centralize it. If your certificates renew reliably (via ACME or a cloud platform) and you just want to know when something is about to break, you have a monitoring problem, and a heavy lifecycle platform is more cost and complexity than you need.
- What are the categories of certificate tools?
- Four: monitoring (observe and alert), lifecycle management (issue, deploy, renew, revoke), issuance/CA (create certificates, like Let's Encrypt or a private CA), and discovery/inventory (find the certificates across your environment). Discovery underpins the others, since you can only act on certificates you know about.
- Is monitoring enough, or do I need management too?
- For most teams under a few thousand certificates, discovery plus monitoring plus a managed issuance source (Let's Encrypt, AWS ACM) is enough - ACME and cloud platforms handle the lifecycle, and monitoring confirms it worked. Larger teams with internal CAs and complex workflows often add lifecycle management, which is appropriate at that scale and overkill below it.
Get the next post in your inbox
TLS monitoring tips and product updates. No spam, unsubscribe anytime.