Let's Encrypt vs OpenXPKI
Let's Encrypt
letsencrypt.orgOpenXPKI
openxpki.orgSide by side
| Figure | Let's Encrypt | OpenXPKI |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 3 | 3 |
| Spec score · Public Key Infrastructure Software | 8.6 (#3) | 7.6 (#14) |
| Spec score · Certificate Management Software | 8.6 (#5) | 7.6 (#20) |
| Integrations | Hosting providers can obtain and manage certificates for customers through their own ACME clients. | Connectors can access flat files, LDAP directories, SQL databases, and web services; Enterprise Edition offers DigiCert, Sectigo, and SwissSign extensions. |
| Intended users | The service is available to people and organizations worldwide that need certificates for domain-named servers, including web, mail, and FTP servers. | The product is aimed at professional PKI environments, and its training lists system administrators, IT operations staff, PKI operators, developers, and integration engineers as audiences. |
| Support | Let’s Encrypt does not offer direct subscriber support and points users to its documentation and community support forums. | Community Edition support is available through a mailing list; commercial support options with SLAs are offered by White Rabbit Security GmbH. |
Plans
Let's Encrypt
- Let's Encrypt certificatesFree
- Let's Encrypt certificatesFree
- Short-lived certificatesFree
OpenXPKI
- Community EditionFree
- Enterprise EditionPriced on request
- OpenXPKI as a ServicePriced on request
In their own words
Let's Encrypt
Let’s Encrypt is a global Certificate Authority that provides SSL/TLS certificates for HTTPS connections. The ACME protocol verifies control of a domain, and compatible clients can automate issuance, management, and renewal. Its client directory includes Apache HTTP Server, Caddy, nginx, Kubernetes, Docker, and Windows/IIS environments. Certificates are Domain Validation only; Let’s Encrypt says it does not plan to issue Organization Validation or Extended Validation certificates. Wildcard certificates are available through the DNS-01 challenge. Standard certificates last 90 days, with an optional six-day lifetime; these periods cannot be adjusted. Subscribers generate and manage private keys on their own servers. Issued and revoked certificates are publicly recorded, and the service says its certificates are trusted by most browsers and operating systems. Certificates cost nothing. A registered domain can receive up to 50 certificates every seven days under published rate limits. Direct subscriber support is not offered.
OpenXPKI
OpenXPKI is PKI and Trustcenter software for managing X.509v3 certificates in professional environments. Its customizable workflows cover requests, renewals, and revocations, with enrollment through SCEP, EST, SimpleCMC, ACME, and a REST-like API with OpenAPI support. One instance can host multiple PKI Realms, each with separate namespaces, profiles, workflows, and policies. The Ember.js web interface serves users, operators, and administrators in major browsers. Connectors reach flat files, LDAP, SQL databases, and web services; Enterprise Edition adds extensions for DigiCert, Sectigo, and SwissSign. Hardware Security Modules are supported through PKCS#11. YAML configuration can be tracked with revision control, and custom reporting workflows can produce downloadable CSVs. Community Edition is free and fully functional, with Debian 12 packages and mailing-list support. Enterprise Edition has packages for RHEL, SLES, and Ubuntu Server LTS; service and commercial support options are also listed, with SLAs available. The software was founded in 2009.