This page provides a comprehensive comparison of capabilities across all supported Certificate Authority integrations in SSL-CLM v2.
| Capability | Microsoft AD CS | Smallstep CA | ACME / Let’s Encrypt | EJBCA | AWS Private CA | Google CAS |
|---|
| Enroll | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Renew | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Revoke | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Template Discovery | ✓ | — | — | ✓ | — | — |
| Template Selection | ✓ | — | — | ✓ | ✓ (via ARN) | — |
| Inventory Sync | ✓ | ✓ | — | ✓ | ✓ | ✓ |
| Health Check | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Wildcard Certs | ✓ | ✓ | ✓ (DNS-01 only) | ✓ | ✓ | ✓ |
| SAN Support | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Custom Validity | Template-based | ✓ | 90 days (fixed) | Profile-based | ✓ | ✓ |
| Auto-Renewal | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| CA | Type ID | Runtime | Agent Required | Protocol |
|---|
| Microsoft AD CS | MSCA | Agent | Yes | WinRM / certutil |
| Smallstep CA | STEPCA | Backend | No | REST API + JWK tokens |
| ACME / Let’s Encrypt | ACME | Backend | No | ACME (RFC 8555) |
| EJBCA | EJBCA | Backend | No | REST API + mTLS |
| AWS Private CA | ACMPCA | Backend | No | AWS SDK |
| Google CAS | GOOGLE_CAS | Backend | No | Google Cloud API |
| CA | Primary Auth | Credentials Required |
|---|
| Microsoft AD CS | Domain/Kerberos (via Agent) | Domain-joined agent, optional ADCS username/password |
| Smallstep CA | JWK Provisioner | JWK private key (EC P-256), provisioner name, key ID |
| ACME / Let’s Encrypt | ACME Account Key | Directory URL, account email, optional EAB (KID + HMAC) |
| EJBCA | Mutual TLS | Client certificate + key, CA name, profile names |
| AWS Private CA | IAM Credentials | Access Key ID, Secret Access Key, CA ARN, region |
| Google CAS | Service Account | Service account JSON, project ID, location, CA pool ID |
| CA | Domain Validation | How It Works |
|---|
| Microsoft AD CS | Template-based | CA enforces template constraints; no domain validation |
| Smallstep CA | Provisioner-based | JWK token authorizes issuance; no external validation |
| ACME / Let’s Encrypt | Challenge-based | DNS-01, HTTP-01, or TLS-ALPN-01 challenges |
| EJBCA | Profile-based | End entity profile constraints; optional approval |
| AWS Private CA | IAM Policy | AWS IAM policies control who can issue |
| Google CAS | IAM Policy | GCP IAM policies control who can issue |
| CA | RSA | ECDSA | Ed25519 | Min Key Size |
|---|
| Microsoft AD CS | ✓ | ✓ | — | Template-defined |
| Smallstep CA | ✓ | ✓ | ✓ | Provisioner-defined |
| ACME / Let’s Encrypt | ✓ | ✓ | — | 2048 (RSA) |
| EJBCA | ✓ | ✓ | ✓ | Profile-defined |
| AWS Private CA | ✓ | ✓ | — | 2048 (RSA) |
| Google CAS | ✓ | ✓ | — | 2048 (RSA) |
| CA | Default Validity | Configurable | Maximum |
|---|
| Microsoft AD CS | Template-defined | Per template | Up to CA validity |
| Smallstep CA | Provisioner-defined | ✓ | Configurable |
| ACME / Let’s Encrypt | 90 days | No | 90 days |
| EJBCA | Profile-defined | Per profile | Up to CA validity |
| AWS Private CA | Configurable | ✓ | Up to CA validity |
| Google CAS | Configurable | ✓ | Up to CA validity |
| Use Case | Recommended CA |
|---|
| Enterprise Windows environment with AD | Microsoft AD CS |
| Internal microservices / DevOps | Smallstep CA |
| Public-facing websites (free, automated) | Let’s Encrypt (ACME) |
| Enterprise PKI with complex profiles | EJBCA |
| AWS-native workloads | AWS Private CA |
| GCP-native workloads | Google CAS |
| Multi-cloud or hybrid | Smallstep CA or EJBCA |
| IoT / embedded devices | EJBCA or Smallstep CA |
| Short-lived certificates (< 24h) | Smallstep CA |
| CA | License Model |
|---|
| Microsoft AD CS | Included with Windows Server (Enterprise CAL) |
| Smallstep CA | Open source (community) or commercial (Smallstep) |
| Let’s Encrypt | Free |
| ZeroSSL | Free tier + paid plans |
| EJBCA | Open source (community) or commercial (Keyfactor) |
| AWS Private CA | Per-certificate pricing ($0.75/cert/month for general certs) |
| Google CAS | Per-certificate pricing (DevOps tier: $0.10/cert, Enterprise: $2-3/cert) |