cert-manager vs XiPKI
cert-manager
cert-manager.ioXiPKI
github.comSide by side
| Figure | cert-manager | XiPKI |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Public Key Infrastructure Software | 8.0 (#10) | 7.3 (#16) |
| Purpose | cert-manager obtains X.509 certificates from public and private issuers, keeps them valid and up to date, and attempts renewal before expiry. | XiPKI is an open-source public key infrastructure system covering certification authority, registration authority, and OCSP responder functions, intended for critical infrastructure. |
| Support | Palo Alto Networks offers commercial support and FIPS builds as part of its Long Term Support offering. | The project directs users to open a GitHub issue and asks bug reports to include test data, logs, version, OS, JRE or JDK, and reproduction steps. |
Plans
In their own words
cert-manager
cert-manager is a free, open-source tool for obtaining and managing X.509 certificates on Kubernetes and OpenShift. It requests certificates from public or private issuers, keeps them valid, and attempts renewal before expiration. The project automates TLS certificate issuance for Kubernetes Ingress and supports private-PKI certificates for pod-to-pod mutual TLS. Documented authority options include Let’s Encrypt, HashiCorp Vault, CyberArk Certificate Manager, and private PKI. Installation can use kubectl-applied manifests, Helm, Flux, or Argo CD. Related projects include istio-csr, approver-policy, Kubernetes CSI drivers, csi-driver-spiffe, and trust-manager; trust-manager distributes X.509 trust bundles and can run independently. cert-manager publishes threat-model and hardening guidance covering secrets, RBAC, networking, and Kubernetes configuration. Its default Helm values prioritize installation ease and backward compatibility over hardened production security. The project has no LTS releases, though each release is supported until the second subsequent version.
XiPKI
XiPKI is an open-source public key infrastructure system for certification authority, registration authority, and OCSP responder functions, aimed at critical infrastructure. It supports multiple CAs in one instance, database clusters, and active instances for the same CA, with management through embedded OSGi commands and an API. Its CA gateway supports EST, SCEP, CMP, ACME, and its RESTful API. The OCSP responder handles RFC 2560, RFC 6960, and RFC 5019, along with signed and unsigned requests, health checks, and multiple certificate status sources. HSM connections use PKCS#11; listed devices include AWS CloudHSM, Nitrokey, nCipher, Sansec, SoftHSM, TASS, Thales, and Utimaco. The project describes native support for ML-DSA, ML-KEM, and composite post-quantum algorithms. XiPKI is free under Apache License 2.0. It supports Linux and macOS and requires Java 11 or later and Tomcat 10 or 11. Listed databases include DB2, MariaDB, MySQL, Oracle, PostgreSQL, H2, and HSQLDB.