Entrust Certificate Manager vs step-ca

Entrust Certificate Manager centralizes discovery and lifecycle management for digital certificates, from audit and issuance through renewal and revocation. It can find certificates across networks, cloud environments, and CA repositories, then provide continuous monitoring, reports, and alerts. Policy-driven workflows automate lifecycle steps, and certificates from Entrust and third-party CAs can be managed through one control point. Entrust describes deployment across on-premises, private cloud, and public cloud environments. Integration choices include cloud, automation, CA gateway, enrollment protocol, secrets management, and custom REST APIs. The API can query certificates by metadata, import certificates, and update custom-field metadata, subject to token permissions. Compatibility information lists PostgreSQL 15 or higher, OpenID Connect 1.0, LDAP v3, and other specified components. Entrust says the product supports crypto-agility and post-quantum readiness. Pricing is on request, and there is no free plan. Entrust was founded in 1969 and is headquartered in Minneapolis, Minnesota.

step-ca is an online Certificate Authority for automating X.509 and SSH certificate management. It issues X.509 certificates for TLS, mutual TLS, document signing and authentication, as well as SSH certificates for users and hosts. Provisioners can authorize issuance through ACME challenges, OIDC tokens, cloud instance identity documents and short-lived JWK tokens. Automated issuance and renewal are supported for clients, servers and Kubernetes workloads, alongside passive revocation. Templates can customize SANs or OIDs, restrict domains or key sizes, and create longer certificate chains. For CA signing-key protection, step-ca integrates with Google Cloud KMS, AWS KMS, Azure Key Vault, PKCS#11 HSMs, TPM 2.0 and YubiKey PIV. Its intended PKI design uses an offline root CA and a configured intermediate CA that issues end-entity certificates. Installation options include macOS, Windows, Linux, Kubernetes and Docker, and database choices include Badger, BoltDB, MySQL and PostgreSQL. The open-source plan costs nothing. Community help is available through Discord, with dedicated support contracts from Smallstep.