Skip to main content
This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Federal Modernization Workbook · Book 07 · Appendix

Appendix C — Anatomy of the CLM Platform

What the certificate lifecycle management platform is made of: the component types every CLM platform has, how they map to CyberArk Certificate Manager, Self-Hosted 26.1, the program’s choice, its server roles and integrations, a two-site reference topology, and one certificate’s journey through the components.

“The platform” is not a box. It is a set of servers, one database and a handful of connectors, and each piece has a job.

In this appendix

  • The component types every certificate lifecycle management (CLM) platform has, and what each one does
  • How they map to CyberArk Certificate Manager, Self-Hosted 26.1, the program’s CLM platform (Chapter 04)
  • The platform’s server roles, what it connects to, a two-site reference topology, and one certificate’s journey through it

The program chose CyberArk Certificate Manager, Self-Hosted as the CLM platform, the system of record for every certificate that Intune and the PIV system don’t manage (Chapter 04). This appendix describes what that platform is made of. The build itself, phase by phase, is in the implementation guide, Certificate Lifecycle on CyberArk Certificate Manager, which is under review; the component facts here come from CyberArk’s 26.1 documentation, checked on October 23, 2026. The vendor’s documentation links now open version 26.2, published under the Palo Alto Networks name (Palo Alto Networks Trust Protection Foundation); the sizing, hardware, database-latency, Message Bus, ACME, rolling-upgrade, Windows-services and Microsoft CA facts cited below read the same there, rechecked November 9, 2026.12

What every CLM platform is made of

Any CLM platform, from any vendor, does the same jobs. The table names each job, says why Book 07’s design needs it, and gives the CyberArk component that does it.

Job Why the design needs it In CyberArk Certificate Manager
Inventory and policy store One record of every certificate, its owner and its renewal path (Chapter 05) One SQL Server database; policy folders in the Policy Tree34
Lifecycle engine Issues, renews, installs and revokes on schedule, so no class depends on a person remembering a date (Chapter 08) Certificate Lifecycle and Monitoring component5
Discovery Finds certificates a CA’s database doesn’t show (Chapter 02) Network Discovery, CA Import, Onboard Discovery, Server Agent6
CA connectors Request certificates from each issuer in the issuer map CA template drivers: Microsoft Enterprise and Standalone CA, public CAs, AWS7
Provisioning connectors Install renewed certificates where they’re used Application drivers (IIS and CAPI, F5, NetScaler, Key Vault and others) and the Server Agent8
Enrollment services Let servers, devices and pipelines request their own certificates ACME, EST and SCEP services; the REST API9
Monitoring Watches revocation endpoints and expiry Validation and Certificate Revocation Monitoring components10
Consoles and API People and automation in, behind single sign-on Web console and Policy Tree (both web), Web SDK, Authentication Server; per-server Configuration Console1112
Audit and events Evidence for the assessor, events for the SIEM Log server (Logging service), with SQL, syslog, SNMP and email channels13
Key protection Protects the database’s secrets A software key, an HSM, or both14

The server roles

Every server in the cluster runs the same software against the same database. “Multiple servers connected using the same database are referred to as a cluster,” and each module is installed on every server and enabled per server, so a server’s role is simply the set of components switched on.1516

Top, a load balancer giving one name for the web console, API, agents and SCEP, with arrows to two boxes. Web services servers, two or more: web console and Policy Tree; Web SDK and Authentication Server; agent check-in, EST on 50443, SCEP on 80 if used. ACME servers, separate and not in FIPS mode: ACME service only; their own load-balancer name; CyberArk allows no FIPS on any server used for ACMEv2. Below, back-end processing servers, two or more: the certificate lifecycle of issue, renew, install and revoke; CA Import, discovery, validation and revocation monitoring; processing engines keep work on chosen servers. Log and event servers, two at larger sizes: the Logging service for the audit trail and notifications; the only servers that send to the SIEM, email and SNMP. These connect to the Message Bus, MQTT over TLS on 8883 between every server and every other, across sites, which connects for all servers to SQL Server Always On, one active database with full recovery and Enterprise edition recommended, and to an HSM pair, or a software key, protecting the database's secrets with the same partition label on every server; if the HSM is unreachable the platform shuts down.

The platform’s server roles: web services servers and separate non-FIPS ACME servers behind a load balancer; back-end processing servers and log and event servers; all linked by the message bus to one SQL Server Always On database and an HSM pair.
Role Components switched on What to know
Web services Web Console (with the Policy Tree), Web SDK, Authentication Server, Client REST for agents; EST and SCEP if used At least two servers; every web service behind a load balancer, which rolling upgrades require1718
ACME ACME service only “Because FIPS is not supported for ACMEv2, you cannot have FIPS enabled on any server that is used for ACMEv2”19
Back-end processing Lifecycle and monitoring, CA Import, discovery, validation, revocation monitoring, reporting Processing engines assigned to policy folders keep work on chosen servers, for example public-CA enrollment on one server allowed out to the internet20
Log and event The Logging service “provides log event processing and notification delivery”; about ten events per renewal2122
Agent handlers Client REST Two more servers for every 40,000 agent-managed servers23

CyberArk’s sizing: two servers up to 50,000 active certificates; six at 250,000, as two logging event processing, two web services and two back-end servers; past a million, designed by CyberArk. Each server needs four cores, 16 GB of memory and 5 GB of disk.24 A Message Bus links the servers: “Message Bus is not optional,” and in its default mode “All servers must be able to communicate with each other over the configured port,” TLS 8883.25 Every server works against one active database, so distance costs time: CyberArk’s table shows about 2 seconds per renewal at no delay, and about 15 seconds at a 30 ms delay.26

What the platform connects to

Center, CyberArk Certificate Manager: inventory, owners and policy; request, renew, install and revoke. Left, a group of issuers through CA template drivers: AD CS, enterprise or standalone, over DCOM; public CAs, DigiCert, Sectigo, GlobalSign and HID; AWS Private CA and ACM, issuing and importing through S3 audit reports, each with two-way arrows. Also left, Microsoft Entra ID for console sign-in with SAML or OIDC single sign-on and SCIM; the CyberArk vault providing target credentials through the Credential Provider; and clients requesting through ACME, EST, SCEP and REST such as certbot, win-acme, vCert and network devices. Right, a group of where certificates are installed: Windows IIS and CAPI, agentless with admin on the target; appliances F5, NetScaler and Palo Alto NGFW; keystores Apache PEM, Java and PKCS 12, and the Server Agent; cloud stores Azure Key Vault, AWS and HashiCorp Vault; and Kubernetes through the cert-manager CyberArk issuer, dashed. Below right, the SIEM receiving syslog over TLS on 6514 in CEF or JSON, and ServiceNow, dashed, through a third-party app and a MID Server.

Integrations of CyberArk Certificate Manager: issuers on the left; Entra ID, the CyberArk vault and enrollment clients feeding in; installation targets on the right; the SIEM and ServiceNow receiving events and owners.

Three connections need care inside a federal boundary. Kubernetes discovery runs only through CyberArk’s SaaS, which needs TCP 443 to its cloud service; issuance inside the boundary uses cert-manager’s CyberArk issuer against the self-hosted API instead.2728 There is no CyberArk-built ServiceNow integration in the 26.1 documentation; the third-party app on the ServiceNow Store connects through a MID Server, so it is assessed as a supply-chain component.29 And the Intune SCEP integration, which the program doesn’t use (Chapter 04 and the implementation guide), needs outbound HTTPS to Azure from every server, with no government-cloud endpoints documented.30

A two-site reference topology

The layout below is the program’s design guidance, built only from CyberArk’s documented constraints; it is not a vendor blueprint.

Top, load-balancer names, one for the web console and API and one for ACME, with arrows to the web and ACME servers in two site groups. Site A, the primary database site: WEB-A1, web services with FIPS mode per policy; ACME-A1, ACME only with FIPS mode off; BE-A1, back end with site A engines and public-CA egress; LOG-A1, logging to the SIEM, email and SNMP. Site B: WEB-B1, ACME-B1, BE-B1 with site B engines, and LOG-B1. Below, a Message Bus mesh with TLS 8883 open between all eight servers across sites, connecting to one SQL Server Always On availability group, primary in site A and secondary in site B, with one listener every server uses, and a note of about 15 seconds per renewal at a 30 ms delay to the primary. Below that, HSM-A and HSM-B in the vendor's HA group with the same partition label on every server.

A two-site reference topology: in each site a web services server, a separate non-FIPS ACME server, a back-end server and a log server; a Message Bus mesh between all eight servers; one SQL Server Always On availability group across the sites; and an HSM pair.

Two points need written confirmation from CyberArk before this is built. CyberArk doesn’t say whether FIPS-mode and non-FIPS servers can share one cluster; if they can’t, the ACME servers become a separate small cluster with their own database (inference).31 And CyberArk’s pages disagree on whether servers without web services need IIS.3233

One certificate’s journey

Seven steps. 1 Find: Discover, through Network Discovery, CA Import and the Server Agent. 2 Own: Place and own, placement rules put it in a policy folder with a named Server Owner. 3 Issue: Enroll, the lifecycle engine asks the CA through its CA template driver. 4 Install: Provision, an application driver or agent installs it on the target. 5 Check: Validate and monitor, with validation scans, revocation monitoring and expiry notices. 6 Repeat: Renew, before expiry back to step 3 so no one has to remember a date, shown as a dashed arrow labeled every renewal. 7 End: Revoke or retire, when no longer needed, revoked through the CA template and the object retired. A note says every step is logged: events go to the SIEM, and the inventory is the evidence an assessor reads.

One certificate’s journey through the platform: discover, place and own, enroll, provision, validate and monitor, renew back to enrollment, and revoke or retire.

The steps follow the stages CyberArk’s engine partitioning describes: certificate work, then enrollment through the CA template, then provisioning through each application object, with revocation through the CA template at the end.34 Every event reaches the log server’s default channel and, through the syslog channel, the SIEM (Chapter 08).35

Where the other books’ certificates meet the platform

Every book whose systems depend on certificates has a section that maps them to this platform: which Book 07 class each certificate is, who issues it, which engine renews it, and what the platform does for it, with a diagram.

Key takeaways

  • The platform is a cluster of Windows servers on one SQL Server database; a server’s role is the set of components switched on.
  • Web services sit behind a load balancer; ACME runs on separate servers that aren’t in FIPS mode; log servers are the only ones that talk to the SIEM.
  • The Message Bus needs TLS 8883 between every server, and every server works against one active database, so sites must be close.
  • Drivers do the reaching: CA template drivers to issuers, application drivers or agents to the systems that use the certificates.

Continue the book

← Previous: Appendix B — Certificate Template Migration Matrix · Book index

  1. CyberArk, 26.1, “System requirements” (cluster; server sizing; hardware; supported applications; latency table; agents), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-install-SysReq-ALLVenProducts.php (accessed Oct 23, 2026).↩︎

  2. CyberArk, 26.1, “Message Bus,” https://docs.venafi.com/Docs/current/TopNav/Content/AdminConsoles/cco-vcc-message-bus.php (accessed Oct 23, 2026).↩︎

  3. CyberArk, Certificate Manager, Self-Hosted 26.1, “MS SQL Always On High Availability” (“All Trust Protection Foundation servers must connect to the same instance of the database”), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r_install_AlwaysOn-highavailability.php (accessed Oct 23, 2026).↩︎

  4. CyberArk, 26.1, “Management trees,” https://docs.venafi.com/Docs/current/TopNav/Content/System_Architecture/r_management_trees.php (accessed Oct 23, 2026).↩︎

  5. CyberArk, 26.1, “Selecting components” (component list and descriptions; “At least two Trust Protection Foundation servers needs to have Web Console enabled”), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-install-select-components.php (accessed Oct 23, 2026).↩︎

  6. CyberArk, 26.1, “Selecting components” (component list and descriptions; “At least two Trust Protection Foundation servers needs to have Web Console enabled”), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-install-select-components.php (accessed Oct 23, 2026).↩︎

  7. CyberArk, 26.1, “Microsoft ADCS CA template,” https://docs.venafi.com/Docs/current/TopNav/Content/Drivers/cco-MicrosoftCertServices-CATemplate-tpp.php, and the enrollment and revocation support matrix, https://docs.venafi.com/Docs/current/TopNav/Content/Drivers/r-drivers-matrix-EnrollmentRevocationSupport-ta.php (accessed Oct 23, 2026).↩︎

  8. CyberArk, 26.1, “System requirements” (cluster; server sizing; hardware; supported applications; latency table; agents), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-install-SysReq-ALLVenProducts.php (accessed Oct 23, 2026).↩︎

  9. CyberArk, 26.1, “Selecting components” (component list and descriptions; “At least two Trust Protection Foundation servers needs to have Web Console enabled”), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-install-select-components.php (accessed Oct 23, 2026).↩︎

  10. CyberArk, 26.1, “Selecting components” (component list and descriptions; “At least two Trust Protection Foundation servers needs to have Web Console enabled”), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-install-select-components.php (accessed Oct 23, 2026).↩︎

  11. CyberArk, 26.1, “Selecting components” (component list and descriptions; “At least two Trust Protection Foundation servers needs to have Web Console enabled”), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-install-select-components.php (accessed Oct 23, 2026).↩︎

  12. CyberArk, 26.1, “Policy Tree overview” (accessed “using a supported or compatible web browser”), https://docs.venafi.com/Docs/current/TopNav/Content/AdminConsoles/c-WebAdmin-Overview-tpp.php (accessed Oct 23, 2026).↩︎

  13. CyberArk, 26.1, “Log server,” https://docs.venafi.com/Docs/current/TopNav/Content/Logging/c-logging-LogServer.php, and “Syslog channel,” https://docs.venafi.com/Docs/current/TopNav/Content/Logging/c-logging-sysLogChannelConfig-tpp.php (accessed Oct 23, 2026).↩︎

  14. CyberArk, 26.1, “Encryption files” (“software encryption, and hardware encryption. You must use some combination of the two”), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-vcc-encryption-files.php, and “HSM configuration,” https://docs.venafi.com/Docs/current/TopNav/Content/EncryptionKeys/r-hsm-configuration.php (accessed Oct 23, 2026).↩︎

  15. CyberArk, 26.1, “System requirements” (cluster; server sizing; hardware; supported applications; latency table; agents), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-install-SysReq-ALLVenProducts.php (accessed Oct 23, 2026).↩︎

  16. CyberArk, 26.1, “Platform objects” (“every module is installed on the server. However, the modules may or may not be enabled”), https://docs.venafi.com/Docs/current/TopNav/Content/System_Architecture/c_platform_objects_tpp.php (accessed Oct 23, 2026).↩︎

  17. CyberArk, 26.1, “Selecting components” (component list and descriptions; “At least two Trust Protection Foundation servers needs to have Web Console enabled”), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-install-select-components.php (accessed Oct 23, 2026).↩︎

  18. CyberArk, 26.1, “Rolling upgrades” (web services behind an application delivery controller), https://docs.venafi.com/Docs/current/TopNav/Content/Install/c-rolling-upgrades.php (accessed Oct 23, 2026).↩︎

  19. CyberArk, 26.1, “Deploying on Windows Server” (FIPS and ACMEv2; servers with no web services), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-deploy-windows-server.php (accessed Oct 23, 2026).↩︎

  20. CyberArk, 26.1, “Management partitions” (lifecycle stages handed off between processing engines), https://docs.venafi.com/Docs/current/TopNav/Content/System_Architecture/r_management_partitions_tpp.php (accessed Oct 23, 2026).↩︎

  21. CyberArk, 26.1, “Windows services” (CyberArk Platform; Logging; API Host; “IIS must be running on all CyberArk servers”), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-vcc-windows-services.php (accessed Oct 23, 2026).↩︎

  22. CyberArk, 26.1, “SQL Server channel requirements” (about 10 events per certificate renewal), https://docs.venafi.com/Docs/current/TopNav/Content/Logging/r-logging-MSSQL-Channel-Requirements.php (accessed Oct 23, 2026).↩︎

  23. CyberArk, 26.1, “System requirements” (cluster; server sizing; hardware; supported applications; latency table; agents), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-install-SysReq-ALLVenProducts.php (accessed Oct 23, 2026).↩︎

  24. CyberArk, 26.1, “System requirements” (cluster; server sizing; hardware; supported applications; latency table; agents), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-install-SysReq-ALLVenProducts.php (accessed Oct 23, 2026).↩︎

  25. CyberArk, 26.1, “Message Bus,” https://docs.venafi.com/Docs/current/TopNav/Content/AdminConsoles/cco-vcc-message-bus.php (accessed Oct 23, 2026).↩︎

  26. CyberArk, 26.1, “System requirements” (cluster; server sizing; hardware; supported applications; latency table; agents), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-install-SysReq-ALLVenProducts.php (accessed Oct 23, 2026).↩︎

  27. CyberArk, 26.1, “Configuring Kubernetes discovery” (TCP 443 to the SaaS), https://docs.venafi.com/Docs/current/TopNav/Content/Discovery/cco-Discovery-Kubernetes-configuring-tpp.php (accessed Oct 23, 2026).↩︎

  28. cert-manager, “CyberArk” issuer (“formerly known as the Venafi Issuer”), https://cert-manager.io/docs/configuration/venafi/ (accessed Oct 23, 2026).↩︎

  29. ServiceNow Store, AEYRiX, “Machine Identity Protection” (“A MID Server will be required”), https://store.servicenow.com/store/app/c239a3ae1be06a50a85b16db234bcbe4 (accessed Oct 23, 2026).↩︎

  30. CyberArk, 26.1, “Integrating with Microsoft Intune” (outbound HTTPS to Microsoft Azure from all servers), https://docs.venafi.com/Docs/current/TopNav/Content/ClientProtect/t-EntMob-intune.php (accessed Oct 23, 2026).↩︎

  31. CyberArk, 26.1, “Deploying on Windows Server” (FIPS and ACMEv2; servers with no web services), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-deploy-windows-server.php (accessed Oct 23, 2026).↩︎

  32. CyberArk, 26.1, “Deploying on Windows Server” (FIPS and ACMEv2; servers with no web services), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-deploy-windows-server.php (accessed Oct 23, 2026).↩︎

  33. CyberArk, 26.1, “Windows services” (CyberArk Platform; Logging; API Host; “IIS must be running on all CyberArk servers”), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-vcc-windows-services.php (accessed Oct 23, 2026).↩︎

  34. CyberArk, 26.1, “Management partitions” (lifecycle stages handed off between processing engines), https://docs.venafi.com/Docs/current/TopNav/Content/System_Architecture/r_management_partitions_tpp.php (accessed Oct 23, 2026).↩︎

  35. CyberArk, 26.1, “Log server,” https://docs.venafi.com/Docs/current/TopNav/Content/Logging/c-logging-LogServer.php, and “Syslog channel,” https://docs.venafi.com/Docs/current/TopNav/Content/Logging/c-logging-sysLogChannelConfig-tpp.php (accessed Oct 23, 2026).↩︎

Back to top