License & Deployment Mix: 19 tools – 10 OSS, 8 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
Overview
Public Key Infrastructure (PKI) is the framework of policies, processes, and technology for managing digital certificates and public-key encryption. A PKI system issues, renews, revokes, and validates X.509 certificates used for TLS/SSL (HTTPS), mutual TLS (mTLS), code signing, email signing (S/MIME), document signing, and SSH certificate-based authentication.
Certificate management platforms provide:
- Certificate Authority (CA) – issue X.509 certificates from an internal or public CA; root and intermediate CA hierarchy; certificate profiles and policies
- Certificate lifecycle – automated issuance, renewal, revocation, and expiry tracking; prevent outages caused by expired certificates
- ACME protocol – Automated Certificate Management Environment (RFC 8555); the protocol used by Let’s Encrypt; automated certificate issuance and renewal for public TLS
- Certificate inventory – discover and catalogue all certificates across the infrastructure (servers, load balancers, CDNs, cloud services, IoT devices); identify unknown, expired, or weak certificates
- CRL and OCSP – Certificate Revocation Lists and Online Certificate Status Protocol for real- time certificate validation; essential for revoking compromised certificates
- Key management – secure generation, storage, and rotation of private keys; HSM integration for hardware-protected keys
- mTLS – mutual TLS where both client and server present certificates; used for service-to- service authentication in zero-trust architectures
- SSH CA – sign SSH public keys with a CA certificate; eliminates authorized_keys files; time-limited SSH access; see also Secrets Management (OpenBAO SSH engine)
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
An internal CA (e.g. OpenBAO’s PKI engine) handles service certificates, mTLS, and SSH CA, while an ACME client (e.g. Traefik with Lego) handles Let’s Encrypt certificates; dedicated PKI tools complement these for certificate discovery and lifecycle management.
Deployment Model
| Tool | Self-Hosted | SaaS | License |
|---|---|---|---|
| step-ca | Yes | Yes (Smallstep) | Apache 2.0 |
| EJBCA Community | Yes | No | LGPL-2.1 |
| Dogtag | Yes | No | GPL-2.0 |
| cfssl | Yes | No | BSD-2-Clause |
| XCA | Yes (desktop) | No | BSD |
| cert-manager | Yes (K8s) | No | Apache 2.0 |
| certbot | Yes (CLI) | N/A | Apache 2.0 |
| Lego | Yes (CLI) | N/A | MIT |
| acme.sh | Yes (CLI) | N/A | GPL-3.0 |
| Boulder | Yes | No | MPL-2.0 |
| Venafi | Yes | Yes | Proprietary |
| Keyfactor | Yes | Yes | Proprietary |
| DigiCert | No | Yes | Proprietary |
| Sectigo | No | Yes | Proprietary |
| AppViewX | Yes | Yes | Proprietary |
| GlobalSign Atlas | No | Yes | Proprietary |
| Smallstep Enterprise | Yes | Yes | Proprietary |
| EJBCA Enterprise | Yes | Yes | Proprietary |
| Entrust | Yes | Yes | Proprietary |
CA Capabilities
| Tool | Root CA | Intermediate CA | ACME Server | CRL | OCSP | HSM |
|---|---|---|---|---|---|---|
| step-ca | Yes | Yes | Yes | No | No | Yes |
| EJBCA | Yes | Yes | Yes | Yes | Yes | Yes |
| Dogtag | Yes | Yes | No | Yes | Yes | Yes |
| cfssl | Yes | Yes | No | No | No | No |
| OpenBAO PKI | Yes | Yes | No* | Yes | Yes | Yes |
| Boulder | Yes | Yes | Yes | Yes | Yes | Yes |
| Venafi | No (manages) | No | Yes | N/A | N/A | Yes |
| Keyfactor | Yes (EJBCA) | Yes | Yes | Yes | Yes | Yes |
* = ACME support planned / community effort
Protocol Support
| Tool | ACME | CMP | EST | SCEP | REST API |
|---|---|---|---|---|---|
| step-ca | Yes | No | No | No | Yes |
| EJBCA | Yes | Yes | Yes | Yes | Yes |
| Dogtag | No | Yes | No | Yes | Yes |
| cfssl | No | No | No | No | Yes |
| cert-manager | Yes | No | No | No | Yes |
| Venafi | Yes | No | Yes | No | Yes |
| Keyfactor | Yes | Yes | Yes | Yes | Yes |
Certificate Lifecycle Management
| Tool | Discovery | Inventory | Auto-Renew | Alerts | Compliance |
|---|---|---|---|---|---|
| step-ca | No | Basic | Yes (ACME) | No | No |
| EJBCA | No | Yes | Yes | Yes | Yes |
| cert-manager | No | Yes (K8s) | Yes | No | No |
| Venafi | Yes | Yes | Yes | Yes | Yes |
| Keyfactor | Yes | Yes | Yes | Yes | Yes |
| DigiCert | Yes | Yes | Yes | Yes | Yes |
| Sectigo | Yes | Yes | Yes | Yes | Yes |
| AppViewX | Yes | Yes | Yes | Yes | Yes |
Kubernetes Integration
| Tool | K8s Native | Cert Issuer | CSI | Ingress |
|---|---|---|---|---|
| cert-manager | Yes | Yes (native) | Yes | Yes |
| step-ca | Via cert-manager | Yes | No | Via CM |
| EJBCA | Via cert-manager | Yes | No | Via CM |
| OpenBAO PKI | Via cert-manager | Yes | Yes | Via CM |
| Venafi | Via cert-manager | Yes | No | Via CM |
Authentik Integration
| Tool | OIDC | SAML | Notes |
|---|---|---|---|
| step-ca | No | No | CLI/API only; no web UI |
| EJBCA | Yes | No | Web admin with OIDC |
| Venafi | No | Yes | SAML SSO for console |
| Keyfactor | Yes | Yes | OIDC/SAML for web UI |
| DigiCert | No | Yes | SAML SSO for CertCentral |
Monitoring
All PKI tools integrate with monitoring via Telegraf’s x509_cert input plugin, which monitors certificate expiry across endpoints regardless of which CA issued the certificate. CA-specific metrics (issuance rate, queue depth) require per-tool Telegraf configuration.
Tools
19 tools.
acme.sh
acme.sh is a pure POSIX shell ACME client with zero external dependencies – it requires only a shell interpreter (sh, bash, dash, zsh) and common Unix utilities (curl or wget, openssl).
License: GPL-3.0-only (OSS) · Kind: web · Deploy: docker, k8s, appliance · SSO: none
AppViewX CERT+
AppViewX CERT+ is a commercial multi-CA certificate lifecycle management and automation platform, providing certificate discovery, inventory, policy enforcement, and automated enrollment and renewal.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
Boulder
Boulder is the ACME CA server software that powers Let’s Encrypt, the world’s largest certificate authority issuing over 400 million active certificates.
License: MPL-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
cert-manager
cert-manager is an open-source, CNCF-graduated Kubernetes controller that automates TLS certificate issuance and renewal from issuers such as Let’s Encrypt (ACME), Vault, Venafi, and private CAs.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: none
certbot
certbot is the original and most widely used ACME client, developed by the Electronic Frontier Foundation (EFF) for use with Let’s Encrypt.
License: Apache-2.0 (OSS) · Kind: web · Deploy: saas, docker, k8s, package · SSO: none
cfssl
cfssl (Cloudflare’s PKI/TLS toolkit) is a suite of tools for building and operating a PKI infrastructure.
License: BSD-2-Clause (OSS) · Kind: web · Deploy: native, docker · SSO: none
DigiCert CertCentral
DigiCert is one of the world’s largest public Certificate Authorities and a leading provider of TLS/SSL certificates and PKI solutions.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Dogtag Certificate System
Dogtag Certificate System is an open-source, enterprise-class PKI sponsored by Red Hat, providing a CA, KRA, OCSP responder, and smart-card token management; it underpins Red Hat IdM and FreeIPA.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: native · SSO: none
EJBCA Community
EJBCA (Enterprise Java Beans Certificate Authority) is a full-featured, enterprise-grade Certificate Authority and PKI management platform.
License: LGPL-2.1-or-later (OSS) · Kind: web · Deploy: native · SSO: none
EJBCA Enterprise
EJBCA Enterprise is the commercial edition of EJBCA, maintained and sold by Keyfactor (which acquired PrimeKey, the original EJBCA developers).
License: Proprietary (proprietary) · Kind: web · Deploy: native, docker · SSO: none
Entrust PKI
Entrust is a global cybersecurity company that provides PKI, certificate management, hardware security modules (nShield HSMs), and identity solutions.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
GlobalSign Atlas
GlobalSign is a major public Certificate Authority and identity services provider, now a subsidiary of GMO Internet Group.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Keyfactor
Keyfactor is an enterprise PKI and certificate lifecycle management (CLM) platform that combines a full Certificate Authority (EJBCA Enterprise) with a comprehensive certificate management console (Keyfactor Command).
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
Lego
Lego is a Go-based ACME client and library that supports over 100 DNS providers for automated TLS certificate management.
License: MIT (OSS) · Kind: web · Deploy: saas, docker, native, k8s, package · SSO: none
Sectigo Certificate Manager
Sectigo (formerly Comodo CA) is one of the largest commercial Certificate Authorities, claiming the highest volume of TLS certificate issuance globally.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Smallstep Enterprise
Smallstep Enterprise is a commercial managed PKI platform built on the open-source step-ca, adding a web console, certificate inventory, team management, ACME and SSH CA, and automated high availability.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
step-ca / Smallstep
step-ca is a modern, lightweight online Certificate Authority designed for internal PKI and DevOps workflows.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none
Venafi
Venafi is the market leader in machine identity management and certificate lifecycle management (CLM).
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
XCA
XCA (X Certificate and Key management) is a desktop GUI application for managing X.509 certificates, RSA/EC keys, PKCS#10 requests, and certificate revocation lists.
License: BSD-3-Clause (OSS) · Kind: web · Deploy: package · SSO: none
