lego vs ManageEngine Key Manager Plus
lego
go-acme.github.io
ManageEngine Key Manager Plus
manageengine.comSide by side
| Figure | lego | ManageEngine Key Manager Plus |
|---|---|---|
| Price from | Free | $39.58/mo |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | — | — |
| Web | — | Yes |
| Windows | — | Yes |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 8 |
| Spec score · Certificate Management Software | 8.5 (#6) | 8.9 (#4) |
| Purpose | lego is an ACME client and library written in Go for obtaining and renewing certificates. | Key Manager Plus manages SSL/TLS certificate lifecycles across enterprise networks, from discovery and acquisition through deployment, renewal, and expiry tracking. |
| Support | The project links to GitHub issues and discussions for help and community participation. | Support is offered through on-premises and cloud email addresses, telephone callback options, forums and FAQs. |
Plans
ManageEngine Key Manager Plus
- Free EditionFree
- On-premises license (25 managed keys)$59 a month
- Subscription — 25 keys$475 a year
- On-premises license (25 managed keys)$599 a year
- On-premises perpetual license (25 managed keys)$1,188, paid once
- Perpetual — 25 keys$1,188, paid once
- Subscription — 1,000 keys$2,645 a year
- Perpetual — 1,000 keys$6,613, paid once
In their own words
lego
lego is an independent, free, open-source ACME client and Go library for obtaining, renewing, and revoking certificates. It supports wildcard and SAN certificates and can work with multiple ACME servers, including Let’s Encrypt and ZeroSSL. Validation choices include DNS-01, HTTP-01, TLS-ALPN-01, and DNS-PERSIST-01. The project lists more than 200 DNS providers, including Cloudflare, Amazon Route 53, Google Cloud DNS, and Azure DNS, with CNAME support enabled by default. Users can run lego from the command line or call it as a Go library. DNS credentials and settings are supplied through environment variables, with file references and dotenv files supported. Installation options include prebuilt binaries, Docker, package managers, and source. The maintainers look after the AUR and Snap packages; other listed packages are community maintained. The project lists support for ACME RFC 8555 and certificate validation and renewal extensions. It is licensed under MIT, and installing from source requires Go 1.25 or later. The project points to GitHub issues and discussions for help.
ManageEngine Key Manager Plus
ManageEngine Key Manager Plus centralizes SSL/TLS certificate lifecycle management across enterprise networks, from discovery and acquisition to deployment, renewal, and expiry tracking. It finds certificates across endpoints and stores, including Microsoft CA, self-signed, public CA, mail server, load balancer, and AWS-hosted certificates. Renewal can be automated, with expiry alerts sent by email, SNMP traps, or syslog. Listed public CA integrations include Let's Encrypt, DigiCert, GlobalSign, RapidSSL, GoDaddy, and Thawte. It also manages SSH and PGP keys in a digital-key vault. Audit features cover key and certificate operations, privileged-session video, and activity reports. Controls include role-based access, two-factor authentication, SAML single sign-on, audit logging, and external storage for the master encryption key. The product is offered as SaaS and on premises. A free plan and 30-day trial are listed. The on-premises license for 25 managed keys is $59.00 per month, billed monthly.