cert-manager vs OpenXPKI
cert-manager
cert-manager.ioOpenXPKI
openxpki.orgSide by side
| Figure | cert-manager | OpenXPKI |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 3 |
| Spec score · Certificate Management Software | 8.0 (#10) | 7.6 (#20) |
| Spec score · Public Key Infrastructure Software | 8.0 (#10) | 7.6 (#14) |
| Integrations | Satellite projects include istio-csr, approver-policy, Kubernetes CSI drivers, csi-driver-spiffe, and trust-manager. | Connectors can access flat files, LDAP directories, SQL databases, and web services; Enterprise Edition offers DigiCert, Sectigo, and SwissSign extensions. |
| Purpose | cert-manager obtains X.509 certificates from public and private issuers, keeps them valid and up to date, and attempts renewal before expiry. | OpenXPKI is enterprise-grade PKI and Trustcenter software for customizable management of X.509v3 certificates. |
| Support | Palo Alto Networks offers commercial support and FIPS builds as part of its Long Term Support offering. | Community Edition support is available through a mailing list; commercial support options with SLAs are offered by White Rabbit Security GmbH. |
Plans
OpenXPKI
- Community EditionFree
- Enterprise EditionPriced on request
- OpenXPKI as a ServicePriced on request
In their own words
cert-manager
cert-manager is a free, open-source tool for obtaining and managing X.509 certificates on Kubernetes and OpenShift. It requests certificates from public or private issuers, keeps them valid, and attempts renewal before expiration. The project automates TLS certificate issuance for Kubernetes Ingress and supports private-PKI certificates for pod-to-pod mutual TLS. Documented authority options include Let’s Encrypt, HashiCorp Vault, CyberArk Certificate Manager, and private PKI. Installation can use kubectl-applied manifests, Helm, Flux, or Argo CD. Related projects include istio-csr, approver-policy, Kubernetes CSI drivers, csi-driver-spiffe, and trust-manager; trust-manager distributes X.509 trust bundles and can run independently. cert-manager publishes threat-model and hardening guidance covering secrets, RBAC, networking, and Kubernetes configuration. Its default Helm values prioritize installation ease and backward compatibility over hardened production security. The project has no LTS releases, though each release is supported until the second subsequent version.
OpenXPKI
OpenXPKI is PKI and Trustcenter software for managing X.509v3 certificates in professional environments. Its customizable workflows cover requests, renewals, and revocations, with enrollment through SCEP, EST, SimpleCMC, ACME, and a REST-like API with OpenAPI support. One instance can host multiple PKI Realms, each with separate namespaces, profiles, workflows, and policies. The Ember.js web interface serves users, operators, and administrators in major browsers. Connectors reach flat files, LDAP, SQL databases, and web services; Enterprise Edition adds extensions for DigiCert, Sectigo, and SwissSign. Hardware Security Modules are supported through PKCS#11. YAML configuration can be tracked with revision control, and custom reporting workflows can produce downloadable CSVs. Community Edition is free and fully functional, with Debian 12 packages and mailing-list support. Enterprise Edition has packages for RHEL, SLES, and Ubuntu Server LTS; service and commercial support options are also listed, with SLAs available. The software was founded in 2009.