cert-manager vs Keyfactor Platform

cert-manager is a free, open-source tool for obtaining and managing X.509 certificates on Kubernetes and OpenShift. It requests certificates from public or private issuers, keeps them valid, and attempts renewal before expiration. The project automates TLS certificate issuance for Kubernetes Ingress and supports private-PKI certificates for pod-to-pod mutual TLS. Documented authority options include Let’s Encrypt, HashiCorp Vault, CyberArk Certificate Manager, and private PKI. Installation can use kubectl-applied manifests, Helm, Flux, or Argo CD. Related projects include istio-csr, approver-policy, Kubernetes CSI drivers, csi-driver-spiffe, and trust-manager; trust-manager distributes X.509 trust bundles and can run independently. cert-manager publishes threat-model and hardening guidance covering secrets, RBAC, networking, and Kubernetes configuration. Its default Helm values prioritize installation ease and backward compatibility over hardened production security. The project has no LTS releases, though each release is supported until the second subsequent version.

Keyfactor Platform, through Keyfactor Command, gives PKI, security, infrastructure, and DevOps teams visibility into certificates and tools to govern their lifecycle. It can inventory certificates from certificate authorities, scan networks for unknown SSL/TLS certificates, and connect to key and certificate stores. Teams can automate enrollment, renewal, revocation, and provisioning, with self-service workflows available through a user interface or API. Listed enrollment protocols are SCEP, ACME, and EST. Administrators can set role-based permissions, protect private keys with retention and storage policies, and require enrollment or approval workflows. Integrations span CI/CD, cloud, HSM, IoT, ITSM, public and private certificate authorities, and web servers. Deployment options are on premises, as a hosted certificate lifecycle service, or as fully managed PKI in a single-tenant cloud platform. Keyfactor says Command has been tested for deployments with more than 500 million certificates. A 30-day trial is offered. Pricing is available on request, and there are no per-certificate fees listed.