Frequently asked questions
Operational answers to common Ecurem CLM questions.
Inventory
Is every discovered certificate automatically managed?
No. Discovery provides visibility. Use Inventory, tags and internal governance to decide what should enter Renewal.
Discovery
Can I scan any domain or network?
No. The scope must be authorized by your organization.
Why are no certificates found?
Check DNS, routing, firewall, target port and actual TLS service availability.
Discovery Agent
Do I need inbound Internet access to the Agent?
No for normal SaaS communication. The Agent uses outbound HTTPS and must reach internal targets on configured ports.
Renewal
Are issuance and deployment the same?
No. A certificate can be issued but not yet served by the target application.
Client PKI
Can Ecurem CLM work with an offline root?
Yes. An offline root can be referenced/imported while operational authorities handle day-to-day issuance.
Reports
Does “Not assessed” mean compliant?
No. It means available evidence is insufficient to conclude.
AI Assistant
Can Aida modify certificates?
The tools documented here are read-only and operate within the active organization.
Security
Is 2FA mandatory?
Yes.
Where is the Ecurem ACM guide?
It remains at ecurem.cloud/en/guide.