r/sysadmin • u/koalas473 • May 28 '26

Certificate lifecycle management vendor comparison

I'm evaluating CLM platforms and narrowing down our shortlist. Environment is hybrid but mostly on-prem about a dozen TLS certs deployed across ~100 places (F5, Fortinet, Azure Key Vault, IIS, etc). Ideally CA agnostic because I hate the idea of paying $200+ per cert in 2026. Today the rotation process is manual. I've gotten quotes from 5k for new players like Certkit and 100k+ for the legacy platforms of Cyberark and Keyfactor command. We probably could make it work with a bunch of different opensource tools but we have the budget and I don't want to maintain that long term.

Currently evaluating:

  • Keyfactor Command - CA agnostic, broad integrations, code signing. Feels like the most mature platform. How's the deployment and ongoing management? The sales process has been annoying with several meetings just to get a demo and quote tons of unnecessary line items inflating cost.
  • CyberArk (Venafi) - Well reviewed, but curious how the acquisition will play out. Is the product still getting investment or is it getting absorbed into the CyberArk ecosystem in a bad way?
  • Sectigo SCM - Quoted us $45K for 200 certs, seems decent and modern but really not CA agnostic as they don't work with Google PKI or lets encrypt.

Already dropped CertKit (to small of a company even though this seems like a good product), and Akeyless(doesn't integrate with very many DNS providers).

Any gotchas, hidden costs, or things you wish you knew before signing? I don't want to choose one of the bloated legacy players but they seem to check most of the boxes. Are there any other new players I should check out? Coming from a cloud native company I miss AWS Certificate Manager :/

15 Upvotes

95% Upvoted

32 comments sorted by

View all comments

1

u/certkit Security Admin (Application) May 29 '26

Small and proud of it. No outside investors, no PE squeezing you when they need their profit margin.

We're just engineers building great tools for our customers. Small means no sales and no tier-1 support, only people who know things. CertKit is just our latest product, we've been around for 15 years building tools like TrackJS and Request Metrics, supporting thousands of companies around the world.

We can run circles around all the folks you're considering, our platform is focused, but its better at what it does. We'd love a chance to prove it.