Public SSL/TLS certificates are moving toward shorter maximum validity periods under industry-wide rules from the CA/Browser Forum. This means certificates need to be renewed more often. Manual renewal increases effort and the risk of missed renewals, which can make systems unreachable.
Recommendation: Use automated certificate renewal wherever possible to help keep your LMS available.
Overview
|
|
Option A: Managed certificate (recommended) |
Option B: Your own CA, automated |
Option C: Your own certificate, manual |
|---|---|---|---|
|
Certificate Authority (CA) |
Let’s Encrypt |
Your chosen CA, such as DigiCert, GlobalSign or Sectigo |
Your chosen CA |
|
Renewal |
Automatic, by IMC |
Automatic, by IMC |
Manual, by you |
|
Your effort |
None after setup |
Provide access once (see below) |
Renew and send the certificate before every expiry |
|
Responsible for on-time renewal |
IMC |
IMC, provided access remains valid |
You |
|
How to request |
Service request |
Service request (ACM) |
Service request for each renewal |
Option A: Certificate managed by Scheer IMC
Recommended. IMC requests, installs and renews the certificate automatically using Let’s Encrypt. You do not need to take action after setup.
-
Systems without Azure Application Gateway or WAF: available now
-
Systems with Azure Application Gateway or WAF: Let’s Encrypt can also be used with Azure WAF. Automated renewal for this setup is planned for Q1 2027. Until then, certificates on WAF systems continue to be renewed as they are today.
Requirement: Your organisation must not require a specific certificate authority, and the DNS record for your domain must point to the IMC system.
For more information on how to request a Let’s Encrypt SSL certificate, click here.
Option B: Your own CA with automated renewal
If your internal policies require a specific CA, renewal can still be automated when the CA can be connected through a supported standardised interface.
Supported connection methods include:
-
ACME credentials from your CA, such as External Account Binding (EAB)
-
A supported CA API
-
DNS or domain-validation delegation, such as CNAME delegation for the validation record
The connection is set up once per customer and includes access setup, coordination and testing. A service request (ACM) is required, and the one-time effort is quoted individually. After setup, certificate renewal runs automatically.
Option C: Your own certificate without integration
If Option A and Option B are not possible, you manage the certificate yourself.
-
Buy and renew the certificate with your chosen CA.
-
Send Scheer IMC the valid certificate, including the private key, in good time before the current certificate expires. For example, provide a password-protected PFX file and send the password through a separate channel.
-
Scheer IMC installs the certificate on the platform, such as Azure Key Vault or Application Gateway.
Important: You are responsible for renewing the certificate on time. Allow enough lead time for processing and installation: at least 10 working days before expiry.
For more information on how to request an SSL certificate update, click here.
Which option is right for you?
-
No specific CA requirement? Choose Option A.
-
A specific CA is required and supports ACME, an API or DNS delegation? Choose Option B.
-
A specific CA is required, but automated access is not possible? Choose Option C.
If you are unsure which option to choose, contact the Scheer IMC Service Desk.
FAQ