Seat consumption
Your organization's DigiCert ONE account comes with a specific number of seats. For on-premises users, your platform license determines the total number of available seats.
The way you consume seats depends on the seat type and whether certificate lifecycle automation is enabled.
Important
Not seeing the expected seat type licenses in your account? Contact your DigiCert account representative.
Seat consumption models
Certificate-based
By default, seats get tracked and consumed through their associated certificates.
In this model, you consume seat inventory whenever seats get created and have certificates associated with them, regardless of whether the certificates are deployed.
Specifics vary by seat type:
Organization, User, Device, and Server seats get consumed only if there is a valid certificate. They get released if the certificate expires or gets revoked. For User seats, all associated certificates must be expired or revoked to release the seat.
Certificate management, Imported, and Discovery seats get consumed regardless of certificate status. They get released if the seat gets deleted.
User seats allow multiple certificates per seat. All other seat types consume an additional seat per certificate.
Deployment-based (automation)
Server and Certificate management seats support certificate lifecycle automation for web servers, network appliances, and cloud services.
For automated certificates, the seats get tracked and consumed on a per-deployment (instance) basis.
An automation instance can be:
A certificate deployed to a single website on a web server.
A certificate deployed to a single IP:port on a network appliance or cloud service.
For example:
An automated private DigiCert® Private CA certificate for a single website consumes one Server seat.
An automated private Microsoft CA certificate for a single load balancer IP:port consumes one Certificate management seat.
An automated public DigiCert CertCentral® certificate on a single load balancer IP:port consumes one Certificate management seat.
If any of the above certificates are deployed/automated on additional websites or load balancer IPs:ports, they consume additional seats of that type.
Note that:
Additional lifecycle automation actions for the same certificate instance use the same seat.
If you delete the seat, it disables automation for that certificate instance and releases a seat of that type back into your license pool.
Notice
For DigiCert®-hosted accounts, automated certificates allow for an overage. If you exceed your current inventory, additional seats get charged.
Summary of seat consumption behaviors
Seat type | Consumption model | Consumed when | Released when | Notes |
|---|---|---|---|---|
Organization | Certificate-based | A valid certificate is enrolled | The associated certificate expires or gets revoked | |
User | Certificate-based | At least one valid certificate is enrolled | All associated certificates are expired or get revoked | Only seat type that allows multiple certificates per seat. |
Device | Certificate-based | A valid certificate is enrolled | The associated certificate expires or gets revoked | |
Server | Certificate-based | A valid certificate is enrolled | The associated certificate expires or gets revoked | Works differently if the certificate is automated (see below). |
Server (with certificate lifecycle automation) | Deployment-based | A certificate is automated on a single IP:port or website (instance) | The seat gets deleted | Additional lifecycle automation actions for the same certificate instance use the same seat.1 Overages are allowed. |
Certificate management | Certificate-based | A certificate from an external CA is enrolled using a method other than ACME/agent/sensor automation | The seat gets deleted | Works differently if the certificate is automated (see below). |
Certificate management (with certificate lifecycle automation) | Deployment-based | A certificate from an external CA is automated on a single IP:port or website (instance) | The seat gets deleted | Additional lifecycle automation actions for the same certificate instance use the same seat.1 Overages are allowed. |
Imported | Certificate-based | A private certificate from an external CA is imported for which the issuing CA has been imported into DigiCert® Private CA | The seat gets deleted | When an applicable connector type is available, Certificate management seats are the preferred way to manage certificates from external CAs. |
Discovery | Certificate-based | A certificate from an external CA is found and uploaded with or without a corresponding CA connector | The seat gets deleted 2 |
1. If using a third-party ACME client, an additional seat gets consumed if you reinstall the client or change its domain or configuration directory.
2. You can delete discovery data and reclaim the associated seats directly from your inventory or account settings page.
View seat usage by type
The Seat usage by type chart on the Trust Lifecycle Manager dashboard displays how your licensed seats are used. The information displayed in the chart is organized by seat type and is updated in real time.
Seat usage for every seat type is categorized as follows:
Allocated: Total number of seats allocated to the selected business unit.
Created: Total number of active seat IDs from within the allocation pool. Select the created count to load the Account > Seats page to create, view, and manage these seats.
Consumed: Total number of seat IDs with valid certificates currently being used. Select the consumed count to load the Account > Seats page to create, view, and manage these seats.
Note
The Seat usage by type chart is updated in real time. However, if the update cron job is in the WAITING or LOCKED state, the chart might display incorrect data. For example, the chart might display a different number of the total seats consumed than what is actually consumed. If you notice incorrect data, we recommend that you refresh the dashboard by selecting the Refresh button.