Concepts and planning · 2.1
Choosing the right issuer
Choose the issuer based on who needs to trust the certificate.
| Who needs to trust the certificate | Recommended issuer | Typical targets |
|---|---|---|
| Public clients, such as browsers on the internet | Public ACME provider | Public websites on IIS, Nginx or Apache, Azure Front Door (Standard, Premium), Azure App Service |
| Internal clients that already trust your organization’s CA | Enterprise CA (AD CS) | Internal IIS, RDS, Exchange, AD FS, domain-joined Windows servers |
| Internal systems without an organizational CA | Built-in Private CA | TLSPilot WebUI, Entra app certificates, internal and lab applications |