Certificate Lifecycle Management (CLM) is TigerTrust’s biggest module. It consolidates every certificate-adjacent operation into one control plane: X.509 issuance, discovery across cloud/K8s/on-prem/IoT, deployment, renewal, revocation, PKI Core, CT monitoring, code and document signing, SSH key management, and TPM-attested device identity.

​
The mental model

Discover ─► Inventory ─► Issue ─► Deploy ─► Monitor ─► Renew ─► Revoke
                                                          │
                                                          └─► Notify + Audit
Every certificate flows through this shape. Each stage has a policy hook and every state change is written to the audit log.

​
What lives inside CLM

Certificates

Inventory, issuance, CAs, templates, renewal, revocation, deployment, tags, IP-SAN, CSR-only signing.

Discovery & Inventory

Filesystem, keystore, K8s, network, and container-image scans across every host.

PKI Core

Internal CA with HSM/PKCS#11, CRL, OCSP, SCEP, ACME.

Signing

Code signing, document signing, SSH key lifecycle.

IoT & TPM

TPM 2.0 attestation, enrollment, and PCR-gated issuance.

Automation

Workflows, approvals, ACME, ARI, short-lived certs, DNS-01 persistence.

Monitoring

CT log monitoring, alerts, notifications, analytics, reports.

Post-quantum

Hybrid classical + PQC key exchange and signing algorithms.

​
Install

CLM’s on-host footprint is a single binary — the TigerTrust Agent. It polls the Collector over outbound HTTPS, generates CSRs locally, and deploys renewed certs to files, keystores, K8s secrets, load balancers, and cloud key stores.

Install the CLM Agent

Package installers, Helm chart, one-liner, and Windows MSI.

​
How CLM interacts with other modules

  • Secrets Manager owns the PKI mount that CLM’s PKI Core can drive for Vault-compatible clients.
  • PAM uses CLM-issued host certs for SSH CAs and short-lived DB/K8s creds.
  • NHIG treats every private key and API key CLM discovers as an identity in the inventory.

​
Where to start

Certificate lifecycle

The state machine: pending → active → expiring → renewed / revoked.

Quickstart

Sign in, connect a CA, issue your first cert, install the agent.

Certificate Authorities

Every supported CA — internal, Let’s Encrypt, DigiCert, Sectigo, cloud issuers.

Discovery

Find every cert already in your estate.