Open-source Keyfactor alternatives

cert-manager is an open-source Kubernetes add-on that treats certificates and certificate issuers as native cluster resources. Instead of requesting, installing and renewing TLS certificates by hand, operators declare what they need and the controller obtains and maintains it, which reduces the chance of an outage caused by an expired certificate.

It can issue certificates from several sources, including Let's Encrypt through ACME, HashiCorp Vault and CyberArk Certificate Manager, as well as from an issuer running inside the cluster itself. It also watches expiry dates and attempts renewal at a suitable time before a certificate lapses. A common use is securing Ingress resources automatically.

The project is written in Go and released under the Apache-2.0 license. It runs inside your own cluster, with several installation methods documented on cert-manager.io, plus a getting started guide and a quick start for nginx-ingress. Community help is available through the Kubernetes Slack channels and the issue tracker.

Certimate is an open-source, free, self-hosted tool for managing SSL certificates through the ACME protocol. It automates the full lifecycle, from issuing a certificate to deploying it, renewing it and watching its status, using a visual workflow instead of hand-written scripts.

It can request single-domain, multi-domain and wildcard certificates as well as IP address certificates, in RSA or ECC, using DNS-01 or HTTP-01 challenges, and export them as PEM, PFX or JKS. It supports more than 70 domain providers, such as AWS, Cloudflare, GoDaddy, Alibaba Cloud and Tencent Cloud, and more than 160 deployment targets including Kubernetes, CDNs, WAFs and load balancers. ACME authorities include Let's Encrypt, Google Trust Services, ZeroSSL, SSL.com and Actalis, and notifications can go to email, Discord, Slack, Telegram, DingTalk, Feishu and WeCom.

Certimate is a single Go program with no database or runtime to install, uses little memory, and runs on Windows, Linux and macOS, either as a downloaded binary or in Docker. All data is stored locally. It is MIT licensed and suits administrators who manage many certificates across providers.

step-ca, published as smallstep/certificates, is an online private certificate authority built for automated certificate management in DevOps environments. It is the server counterpart to the step command-line tool, and both are maintained by Smallstep Labs.

It can issue HTTPS server and client certificates trusted by browsers, as well as TLS certificates for virtual machines, containers, APIs, database connections and Kubernetes pods. It also issues SSH certificates: users can obtain them with single sign-on tokens, and hosts can obtain them using cloud instance identity documents. As an ACME server it supports the popular challenge types, and a Go wrapper and the step CLI help with scripting.

step-ca is written in Go and released under Apache-2.0. It is tuned for a two-tier PKI, and the README points teams that need multiple authorities, active revocation through CRL or OCSP, device attestation or a web admin UI to Smallstep's separate commercial product.

OpenBao is a software solution for managing, storing and distributing sensitive data such as secrets, certificates and keys. It is a community-led project, run under open-governance principles, that intends to stay available under an OSI-approved open-source licence, currently MPL-2.0.

The README describes the problem it targets: modern systems need many secrets, including database credentials, API keys for external services and credentials for service-to-service communication, and tracking who accesses what is hard without a dedicated tool. OpenBao encrypts key/value secrets before they reach persistent storage, so access to the raw storage alone does not expose them. It can write to disk, PostgreSQL and other backends, and it can generate dynamic secrets on demand for systems such as AWS or SQL databases.

OpenBao is written in Go and is widely known as a fork of HashiCorp Vault, which makes it a candidate for teams looking for an open-governance alternative in that space. It runs on your own infrastructure, and the project coordinates through a mailing list, GitHub Discussions and chat channels, with working groups for areas such as namespaces and the UI.