cert-manager vs ManageEngine Key Manager Plus
cert-manager
cert-manager.io
ManageEngine Key Manager Plus
manageengine.comSide by side
| Figure | cert-manager | ManageEngine Key Manager Plus |
|---|---|---|
| Price from | Free | $39.58/mo |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | — | — |
| Web | — | Yes |
| Windows | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 8 |
| Spec score · Certificate Management Software | 8.0 (#10) | 8.9 (#4) |
| Purpose | cert-manager obtains X.509 certificates from public and private issuers, keeps them valid and up to date, and attempts renewal before expiry. | Key Manager Plus manages SSL/TLS certificate lifecycles across enterprise networks, from discovery and acquisition through deployment, renewal, and expiry tracking. |
| Support | Palo Alto Networks offers commercial support and FIPS builds as part of its Long Term Support offering. | Support is offered through on-premises and cloud email addresses, telephone callback options, forums and FAQs. |
Plans
ManageEngine Key Manager Plus
- Free EditionFree
- On-premises license (25 managed keys)$59 a month
- Subscription — 25 keys$475 a year
- On-premises license (25 managed keys)$599 a year
- On-premises perpetual license (25 managed keys)$1,188, paid once
- Perpetual — 25 keys$1,188, paid once
- Subscription — 1,000 keys$2,645 a year
- Perpetual — 1,000 keys$6,613, paid once
In their own words
cert-manager
cert-manager is a free, open-source tool for obtaining and managing X.509 certificates on Kubernetes and OpenShift. It requests certificates from public or private issuers, keeps them valid, and attempts renewal before expiration. The project automates TLS certificate issuance for Kubernetes Ingress and supports private-PKI certificates for pod-to-pod mutual TLS. Documented authority options include Let’s Encrypt, HashiCorp Vault, CyberArk Certificate Manager, and private PKI. Installation can use kubectl-applied manifests, Helm, Flux, or Argo CD. Related projects include istio-csr, approver-policy, Kubernetes CSI drivers, csi-driver-spiffe, and trust-manager; trust-manager distributes X.509 trust bundles and can run independently. cert-manager publishes threat-model and hardening guidance covering secrets, RBAC, networking, and Kubernetes configuration. Its default Helm values prioritize installation ease and backward compatibility over hardened production security. The project has no LTS releases, though each release is supported until the second subsequent version.
ManageEngine Key Manager Plus
ManageEngine Key Manager Plus centralizes SSL/TLS certificate lifecycle management across enterprise networks, from discovery and acquisition to deployment, renewal, and expiry tracking. It finds certificates across endpoints and stores, including Microsoft CA, self-signed, public CA, mail server, load balancer, and AWS-hosted certificates. Renewal can be automated, with expiry alerts sent by email, SNMP traps, or syslog. Listed public CA integrations include Let's Encrypt, DigiCert, GlobalSign, RapidSSL, GoDaddy, and Thawte. It also manages SSH and PGP keys in a digital-key vault. Audit features cover key and certificate operations, privileged-session video, and activity reports. Controls include role-based access, two-factor authentication, SAML single sign-on, audit logging, and external storage for the master encryption key. The product is offered as SaaS and on premises. A free plan and 30-day trial are listed. The on-premises license for 25 managed keys is $59.00 per month, billed monthly.