Keyfactor Platform vs XiPKI
Keyfactor Platform
keyfactor.comXiPKI
github.comSide by side
| Figure | Keyfactor Platform | XiPKI |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | — |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Public Key Infrastructure Software | 7.9 (#12) | 7.3 (#16) |
| Purpose | Keyfactor Certificate Lifecycle Automation discovers, manages, and automates digital certificates across an enterprise. | XiPKI is an open-source public key infrastructure system covering certification authority, registration authority, and OCSP responder functions, intended for critical infrastructure. |
| Security and compliance | Keyfactor’s Trust Center lists materials and compliance entries including SOC 2, SOC 3, ISO/IEC 27001, FedRAMP Moderate, audit logging, and role-based access control. | The project says Bouncy Castle can be switched between LTS and FIPS variants to meet different compliance requirements, and lists eIDAS standards EN 319 411 and EN 319 412 support. |
| Support | Keyfactor advertises PKI expertise and provides customers with a support portal. | The project directs users to open a GitHub issue and asks bug reports to include test data, logs, version, OS, JRE or JDK, and reproduction steps. |
Plans
Keyfactor Platform
- Keyfactor Certificate Lifecycle AutomationPriced on request
In their own words
Keyfactor Platform
Keyfactor Platform, through Keyfactor Command, gives PKI, security, infrastructure, and DevOps teams visibility into certificates and tools to govern their lifecycle. It can inventory certificates from certificate authorities, scan networks for unknown SSL/TLS certificates, and connect to key and certificate stores. Teams can automate enrollment, renewal, revocation, and provisioning, with self-service workflows available through a user interface or API. Listed enrollment protocols are SCEP, ACME, and EST. Administrators can set role-based permissions, protect private keys with retention and storage policies, and require enrollment or approval workflows. Integrations span CI/CD, cloud, HSM, IoT, ITSM, public and private certificate authorities, and web servers. Deployment options are on premises, as a hosted certificate lifecycle service, or as fully managed PKI in a single-tenant cloud platform. Keyfactor says Command has been tested for deployments with more than 500 million certificates. A 30-day trial is offered. Pricing is available on request, and there are no per-certificate fees listed.
XiPKI
XiPKI is an open-source public key infrastructure system for certification authority, registration authority, and OCSP responder functions, aimed at critical infrastructure. It supports multiple CAs in one instance, database clusters, and active instances for the same CA, with management through embedded OSGi commands and an API. Its CA gateway supports EST, SCEP, CMP, ACME, and its RESTful API. The OCSP responder handles RFC 2560, RFC 6960, and RFC 5019, along with signed and unsigned requests, health checks, and multiple certificate status sources. HSM connections use PKCS#11; listed devices include AWS CloudHSM, Nitrokey, nCipher, Sansec, SoftHSM, TASS, Thales, and Utimaco. The project describes native support for ML-DSA, ML-KEM, and composite post-quantum algorithms. XiPKI is free under Apache License 2.0. It supports Linux and macOS and requires Java 11 or later and Tomcat 10 or 11. Listed databases include DB2, MariaDB, MySQL, Oracle, PostgreSQL, H2, and HSQLDB.