cert-manager vs lego

cert-manager is a free, open-source tool for obtaining and managing X.509 certificates on Kubernetes and OpenShift. It requests certificates from public or private issuers, keeps them valid, and attempts renewal before expiration. The project automates TLS certificate issuance for Kubernetes Ingress and supports private-PKI certificates for pod-to-pod mutual TLS. Documented authority options include Let’s Encrypt, HashiCorp Vault, CyberArk Certificate Manager, and private PKI. Installation can use kubectl-applied manifests, Helm, Flux, or Argo CD. Related projects include istio-csr, approver-policy, Kubernetes CSI drivers, csi-driver-spiffe, and trust-manager; trust-manager distributes X.509 trust bundles and can run independently. cert-manager publishes threat-model and hardening guidance covering secrets, RBAC, networking, and Kubernetes configuration. Its default Helm values prioritize installation ease and backward compatibility over hardened production security. The project has no LTS releases, though each release is supported until the second subsequent version.

lego is an independent, free, open-source ACME client and Go library for obtaining, renewing, and revoking certificates. It supports wildcard and SAN certificates and can work with multiple ACME servers, including Let’s Encrypt and ZeroSSL. Validation choices include DNS-01, HTTP-01, TLS-ALPN-01, and DNS-PERSIST-01. The project lists more than 200 DNS providers, including Cloudflare, Amazon Route 53, Google Cloud DNS, and Azure DNS, with CNAME support enabled by default. Users can run lego from the command line or call it as a Go library. DNS credentials and settings are supplied through environment variables, with file references and dotenv files supported. Installation options include prebuilt binaries, Docker, package managers, and source. The maintainers look after the AUR and Snap packages; other listed packages are community maintained. The project lists support for ACME RFC 8555 and certificate validation and renewal extensions. It is licensed under MIT, and installing from source requires Go 1.25 or later. The project points to GitHub issues and discussions for help.