Seat consumption
Your organization's DigiCert ONE account comes with a specific number of seats. For on-premises users, your platform license determines the total number of available seats.
The way you consume seats depends on the seat type and whether certificate lifecycle automation is enabled.
Important
Not seeing the expected seat type licenses in your account? Contact your DigiCert account representative.
Seat consumption models
Certificate-based
By default, seats get tracked and consumed through their associated certificates.
In this model, you consume seat inventory whenever seats get created and have certificates associated with them, regardless of whether the certificates are deployed.
Specifics vary by seat type:
Organization, User, Device, and Server seats get consumed only if there is a valid certificate. They get released if the certificate expires or gets revoked. For User seats, all associated certificates must be expired or revoked to release the seat.
Certificate management and Imported seats get consumed regardless of certificate status. They get released if the seat gets deleted.
User seats allow multiple certificates per seat. All other seat types consume an additional seat per certificate.
Deployment-based (automation)
Server and Certificate management seats support certificate lifecycle automation for web servers, network appliances, and cloud services.
For automated certificates, the seats get tracked and consumed on a per-deployment (instance) basis.
An automation instance can be:
A certificate deployed to a single website on a web server.
A certificate deployed to a single IP:port on a network appliance or cloud service.
For example:
An automated private CA manager certificate for a single website consumes one Server seat.
An automated private Microsoft CA certificate for a single load balancer IP:port consumes one Certificate management seat.
An automated public CertCentral certificate on a single load balancer IP:port consumes one Certificate management seat.
If any of the above certificates are deployed/automated on additional websites or load balancer IPs:ports, they consume additional seats of that type.
Note that:
Additional lifecycle automation actions for the same certificate instance use the same seat.
If you delete the seat, it disables automation for that certificate instance and releases a seat of that type back into your license pool.
Note
For DigiCert®-hosted accounts, automated certificates allow for an overage. If you exceed your current inventory, additional seats get charged.
Discovery seats
Discovery seats are a special use case. Discovery seats are unlimited and are not consumed in the usual manner.
You can add as many discovered certificates to your account as needed. You only pay for what you use.
Summary of seat consumption behaviors
Seat type | Consumption model | Consumed when | Released when | Notes |
|---|---|---|---|---|
Organization | Certificate-based | A valid certificate is enrolled | The associated certificate expires or gets revoked | |
User | Certificate-based | At least one valid certificate is enrolled | All associated certificates are expired or get revoked | Only seat type that allows multiple certificates per seat. |
Device | Certificate-based | A valid certificate is enrolled | The associated certificate expires or gets revoked | |
Server | Certificate-based | A valid certificate is enrolled | The associated certificate expires or gets revoked | Works differently if the certificate is automated (see below). |
Server (with certificate lifecycle automation) | Deployment-based | A certificate is automated on a single IP:port or website (instance) | The seat gets deleted | Additional lifecycle automation actions for the same certificate instance use the same seat.1 Overages are allowed. |
Certificate management | Certificate-based | A certificate from an external CA is enrolled using a method other than ACME/agent/sensor automation | The seat gets deleted | Works differently if the certificate is automated (see below). |
Certificate management (with certificate lifecycle automation) | Deployment-based | A certificate from an external CA is automated on a single IP:port or website (instance) | The seat gets deleted | Additional lifecycle automation actions for the same certificate instance use the same seat.1 Overages are allowed. |
Imported | Certificate-based | A private certificate from an external CA is imported for which the issuing CA has been imported into DigiCert® CA Manager | The seat gets deleted | When an applicable connector type is available, Certificate management seats are the preferred way to manage certificates from external CAs. |
Discovery | Special | A certificate from an external CA is found and uploaded with or without a corresponding CA connector | The seat gets deleted 2 | Discovery seats are unlimited and metered/charged as they are used. |
1. If using a third-party ACME client, an additional seat gets consumed if you reinstall the client or change its domain or configuration directory.
2. You can delete discovery data and reclaim the associated seats directly from your inventory or account settings page.