AWS Private Certificate Authority vs cert-manager
AWS Private Certificate Authority
aws.amazon.com
cert-manager
cert-manager.ioSide by side
| Figure | AWS Private Certificate Authority | cert-manager |
|---|---|---|
| Price from | $50/mo | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | — |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 5 | 1 |
| Spec score · Public Key Infrastructure Software | 8.3 (#6) | 8.0 (#10) |
| Integrations | The SCEP connector can work with mobile device management solutions such as Microsoft Intune and Jamf Pro. | Satellite projects include istio-csr, approver-policy, Kubernetes CSI drivers, csi-driver-spiffe, and trust-manager. |
| Purpose | AWS Private CA is a managed service for issuing and managing private certificates and maintaining an organization's internal PKI. | cert-manager obtains X.509 certificates from public and private issuers, keeps them valid and up to date, and attempts renewal before expiry. |
Plans
AWS Private Certificate Authority
- 30-day CA operation trialFree
- Short-lived private certificates$0.06, paid once
- General-purpose private certificates$0.75, paid once
- Short-lived certificate mode CA operation$50 a month
- General-purpose mode CA operation$400 a month
In their own words
AWS Private Certificate Authority
AWS Private Certificate Authority has no write-up on Specifiction yet; its figures are above.
cert-manager
cert-manager is a free, open-source tool for obtaining and managing X.509 certificates on Kubernetes and OpenShift. It requests certificates from public or private issuers, keeps them valid, and attempts renewal before expiration. The project automates TLS certificate issuance for Kubernetes Ingress and supports private-PKI certificates for pod-to-pod mutual TLS. Documented authority options include Let’s Encrypt, HashiCorp Vault, CyberArk Certificate Manager, and private PKI. Installation can use kubectl-applied manifests, Helm, Flux, or Argo CD. Related projects include istio-csr, approver-policy, Kubernetes CSI drivers, csi-driver-spiffe, and trust-manager; trust-manager distributes X.509 trust bundles and can run independently. cert-manager publishes threat-model and hardening guidance covering secrets, RBAC, networking, and Kubernetes configuration. Its default Helm values prioritize installation ease and backward compatibility over hardened production security. The project has no LTS releases, though each release is supported until the second subsequent version.