Keyfactor Platform vs Let's Encrypt
Keyfactor Platform
keyfactor.comLet's Encrypt
letsencrypt.orgSide by side
| Figure | Keyfactor Platform | Let's Encrypt |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 3 |
| Spec score · Certificate Management Software | 7.9 (#13) | 8.6 (#5) |
| Spec score · Public Key Infrastructure Software | 7.9 (#12) | 8.6 (#3) |
| Automation | It supports automated certificate expiration alerts, renewals, provisioning, and self-service through a UI or API. | The ACME protocol verifies control of a domain and is used to issue certificates; clients can automate certificate management and renewal. |
| Headquarters | Independence, Ohio, United States | LinkedIn lists San Francisco, California as ISRG headquarters. |
| Integrations | Keyfactor describes an API-first architecture with integrations for DevOps tools, key vaults, mobile and IoT devices, and other systems. | Hosting providers can obtain and manage certificates for customers through their own ACME clients. |
| Intended users | The product is presented for PKI, security, infrastructure, and DevOps teams, including organizations operating across on-premises and multi-cloud environments. | The service is available to people and organizations worldwide that need certificates for domain-named servers, including web, mail, and FTP servers. |
| Support | Keyfactor advertises PKI expertise and provides customers with a support portal. | Let’s Encrypt does not offer direct subscriber support and points users to its documentation and community support forums. |
Plans
Keyfactor Platform
- Keyfactor Certificate Lifecycle AutomationPriced on request
Let's Encrypt
- Let's Encrypt certificatesFree
- Let's Encrypt certificatesFree
- Short-lived certificatesFree
In their own words
Keyfactor Platform
Keyfactor Platform, through Keyfactor Command, gives PKI, security, infrastructure, and DevOps teams visibility into certificates and tools to govern their lifecycle. It can inventory certificates from certificate authorities, scan networks for unknown SSL/TLS certificates, and connect to key and certificate stores. Teams can automate enrollment, renewal, revocation, and provisioning, with self-service workflows available through a user interface or API. Listed enrollment protocols are SCEP, ACME, and EST. Administrators can set role-based permissions, protect private keys with retention and storage policies, and require enrollment or approval workflows. Integrations span CI/CD, cloud, HSM, IoT, ITSM, public and private certificate authorities, and web servers. Deployment options are on premises, as a hosted certificate lifecycle service, or as fully managed PKI in a single-tenant cloud platform. Keyfactor says Command has been tested for deployments with more than 500 million certificates. A 30-day trial is offered. Pricing is available on request, and there are no per-certificate fees listed.
Let's Encrypt
Let’s Encrypt is a global Certificate Authority that provides SSL/TLS certificates for HTTPS connections. The ACME protocol verifies control of a domain, and compatible clients can automate issuance, management, and renewal. Its client directory includes Apache HTTP Server, Caddy, nginx, Kubernetes, Docker, and Windows/IIS environments. Certificates are Domain Validation only; Let’s Encrypt says it does not plan to issue Organization Validation or Extended Validation certificates. Wildcard certificates are available through the DNS-01 challenge. Standard certificates last 90 days, with an optional six-day lifetime; these periods cannot be adjusted. Subscribers generate and manage private keys on their own servers. Issued and revoked certificates are publicly recorded, and the service says its certificates are trusted by most browsers and operating systems. Certificates cost nothing. A registered domain can receive up to 50 certificates every seven days under published rate limits. Direct subscriber support is not offered.