What certificate lifecycle management does well
Certificate lifecycle management (CLM) tools issue certificates, renew them before they expire, revoke and replace them, and keep a record of what was issued and where it was seen. For an organization that has suffered an outage from an expired certificate, that automation is worth a great deal, and it is a mature category with well-established products.
It is also, by design, about certificates. A CLM tool knows the certificate on a load balancer. It does not know the private key someone copied into a container image, the TLS configuration that still accepts RSA key exchange, the OpenSSL version a supplier compiled into an appliance, or the algorithm that signs your firmware.
What migration actually touches
Post-quantum migration replaces key-establishment and signature algorithms. That reaches:
- Key exchange in protocols. TLS, SSH, VPNs and messaging, configured per service, often independently of any certificate.
- Signatures beyond certificates. Code signing, firmware signing, document signing, software update mechanisms and their trust anchors.
- Keys and keystores. Material that was never issued by a CA: SSH keys, application secrets, keystores in images and on hosts.
- Libraries and products. The implementation behind every interface, and therefore the supplier who must ship the update.
A CLM tool sees the first item only where a certificate is involved, and the last three not at all. Cryptographic asset discovery and inventory (CADI) exists to see all four, with the source of every finding, so that each can be assigned, changed and verified.
How the two fit together
The practical relationship is sequence, not competition. The inventory establishes what must change and in which order; the certificate manager executes the certificate part of that change when the algorithms, libraries and trust chains are ready. In between, the inventory keeps the two honest: after a reissue, a rescan shows whether the service actually negotiates the new algorithm, or whether an old library quietly kept the old one.
That is also why Cryptoramic treats the certificate manager as a neighbor rather than a target. It imports CycloneDX and SPDX bills of materials, brings ownership and application context into the assessment, and exports CycloneDX CBOMs for use in your existing workflows. It does not issue certificates, and it does not need to.
Questions to ask before choosing
- Which cryptographic assets does the tool record besides certificates, and from which sources?
- Can a finding be traced to the file, layer, host or service that produced it?
- Does the tool distinguish an algorithm that is present from one that is used?
- How does it treat the suppliers behind your products, and can it hold their readiness evidence?
- What does a first result cost, in time and access, on one scope?
Read what CADI means for the wider category, or why the first scope should be small.
Frequently asked questions
Does certificate lifecycle management give me a cryptographic inventory?
Not necessarily. It gives you visibility into the certificates it manages or discovers. A wider inventory also needs keys, software libraries, security settings and the connections that depend on them. Some products provide both; check the coverage of your tool.
Do I need CADI if I already run a certificate manager?
You still need to find the cryptography outside your certificate manager’s coverage. That may require a separate discovery tool. Before choosing one, check whether your existing tools can identify the software, keys and connections that must change for post-quantum migration.
Should CADI replace my certificate manager?
Usually no. Discovery helps you find what needs attention; certificate management handles tasks such as issuing and renewing certificates. They can work together, with discovery findings helping you decide what to change.