--- title: "Infisical vs. Keyfactor" description: "How Infisical compares with Keyfactor Command, EJBCA and Signum: issuance, lifecycle management, and code signing, plus ACME, EST, and SCEP, deployment effort, and how to migrate." canonical: "https://infisical.com/compare/infisical-vs-keyfactor" last-reviewed: "2026-10-08" source-index: https://infisical.com/llms.txt --- # Infisical vs. Keyfactor Looking for a Keyfactor alternative? Infisical automates certificate management in one place, without three products to deploy and connect. ## Keyfactor and Infisical in brief Facts checked against current docs on 2026-10-08. Each section below goes deeper.
| | Infisical | Keyfactor | |---|---|---| | What it is | One platform for certificates, secrets, privileged access, and KMS | Command for lifecycle management, EJBCA for CAs, and Signum or SignServer for code signing | | License | MIT-licensed open-source core | Proprietary. EJBCA Community Edition is not meant for production | | Deployment | Infisical Cloud in US and EU regions, or self-hosted on Docker, Kubernetes, Linux packages, AWS ECS with Fargate, or Google GKE | Keyfactor-hosted, or self-hosted on Windows Server with IIS or on Kubernetes | | Database | PostgreSQL and Redis | Microsoft SQL Server, plus databases for the ACME server and the AnyCA Gateway | | Software in your network | One gateway, only where Infisical has to reach a private network | Universal Orchestrators, and a CA Connector Client next to on-premises CAs | | Certificate authorities | Built-in private CA hierarchy, plus public and enterprise CAs | EJBCA, AD CS, or third-party CAs through the AnyCA Gateway | | Enrollment | ACME, EST, SCEP, and a REST API, all built in | A separate ACME server, a separate SCEP server, EST through EJBCA, and a REST API | | Delivery to targets | Certificate syncs to 13+ destinations with no agent, the Infisical Agent, or cert-manager | An orchestrator extension for each type of certificate store | | Discovery | Scans IP ranges and domains for TLS certificates | SSL discovery through orchestrator pools | | Expiry alerts | Email, Slack, PagerDuty, and webhooks | Email. Anything else is a workflow step you build | | Code signing | Built in, with approvals | Signum or SignServer, separate products | | Sign-in | SAML, OIDC, and LDAP | Active Directory or OIDC. No native SAML | | Post-quantum | ML-DSA certificates | ML-DSA and SLH-DSA in EJBCA | | Automation | REST API, Terraform provider, cert-manager issuer, and a docs MCP server for AI agents | REST API, the kfutil CLI, a Terraform provider, and cert-manager issuers | | Getting started | Sign up free, or self-host the open-source core | A 30-day test drive, then a quote |
## What's the difference between Infisical and Keyfactor? Infisical manages the full certificate lifecycle of any certificate on your infrastructure and lets you stand up your own CA hierarchy. Doing the same with Keyfactor requires implementing, maintaining, and integrating three different products.
| Stage | Infisical | Keyfactor | |---|---|---| | Evaluate | Try the free tier to test-drive an internal CA, ACME, and the certificate dashboard; Use the open-source version to audit and test the code | Lengthy sales process; Quote and professional services before you start; Can't audit all the code | | Deploy/integrate | Use managed cloud, or self-host on Docker, Kubernetes, Linux, AWS ECS, or Google GKE; One gateway to reach private networks | Stand up three products for different use cases and wire them together; Install orchestrators and a CA connector on your network; Requires Microsoft SQL Server to self-host | | Migrate/onboard | Connect CAs you already issue from or create a new hierarchy in minutes; Automatically discover every certificate on your network; Set up syncs wherever they're needed | Spend four months deploying with five staff¹; Buy professional services on top of the license | | Control access | Sign in with whatever SSO you already use; Set clear rules for visibility and access control | No native SAML: Sign in through Active Directory or OIDC | | Operate | Keep one platform and gateway up to date; Certificates renew automatically via API, SCEP, ACME, or EST | Patch Keyfactor Command, EJBCA, the ACME and SCEP servers, the orchestrators, and the CA connector; Budget 2.5 full-time staff to run it¹ | | Automate | Get an email, Slack, PagerDuty, or webhook alert before anything expires; Certificates land on consuming services with no agent to install | Manually wire up renewal alerts; Build a renewal workflow before an alert can lead to a renewal; Add an orchestrator extension for every kind of target | | Scale | Sign code with approvals, without buying another product; Add secrets, privileged access, or KMS on the same platform when you need them | Buy Signum for code signing; Bring in another vendor for secrets management or other security infrastructure |
## Infisical vs. Keyfactor at a glance Both Infisical and Keyfactor are capable certificate lifecycle management solutions. The biggest difference is in operational and deployment complexity. ### Platform and deployment Where each product runs, what it's built on, and what it covers.
| Feature | Infisical | Keyfactor | |---|---|---| | Open source | MIT-licensed core your team can audit | Proprietary, closed to review | | Self-hosting | Docker, Kubernetes, Linux, AWS ECS, or Google GKE, on PostgreSQL and Redis | Requires Microsoft SQL Server | | Managed cloud | US and EU regions. One gateway where it has to reach a private network | Hosted, but you install and patch orchestrators and a CA connector | | Products needed | Infisical Certificate Management | Three products to deploy and connect: Keyfactor Command for lifecycle, EJBCA for private CAs, and Signum for code signing | | Components to run | One platform, plus a gateway for private networks | Command, EJBCA, separate ACME and SCEP servers, orchestrators, a CA connector, the AnyCA Gateway, and Signum, each one more thing to deploy and keep current | | Product scope | Certificates, secrets, privileged access, and KMS on one platform | Certificates and code signing. Secrets need another vendor |
**Open source.** Infisical's core is published under the MIT license, so a security team can read the code it deploys and run it in a test environment before talking to anyone. Keyfactor Command is proprietary and ships only with a license key. Keyfactor's open-source CA, EJBCA Community Edition, is described in its own README as not intended for production use.² Docs: [Deployment models](https://infisical.com/docs/documentation/getting-started/concepts/deployment-models). **Self-hosting.** Infisical self-hosts as a single Docker container, with Docker Compose, on Kubernetes with the official Helm chart, as a Linux package without containers, or on AWS and GCP managed services. It needs PostgreSQL and Redis, nothing else. Self-hosted Keyfactor Command needs Microsoft SQL Server in every case, and either Windows Server with IIS or a Kubernetes cluster. On Kubernetes, Command can't use Active Directory sign-in or talk to a Microsoft CA directly. Docs: [Self-hosting overview](https://infisical.com/docs/self-hosting/overview), [Kubernetes with Helm](https://infisical.com/docs/self-hosting/deployment-options/kubernetes-helm), [Requirements](https://infisical.com/docs/self-hosting/configuration/requirements). **Managed cloud.** Infisical Cloud runs in US and EU regions, with dedicated instances available. Where it has to reach a private network, one gateway connects out through a relay, so no inbound firewall rules change. Keyfactor also hosts Command, but customers still install and patch Universal Orchestrators in their own network, allowlist their IP addresses, and run a CA Connector Client next to any on-premises Microsoft or EJBCA CA. Docs: [Networking](https://infisical.com/docs/documentation/setup/networking), [Gateways](https://infisical.com/docs/documentation/platform/gateways/overview). **Products needed.** Infisical Certificate Management covers private and external CAs, enrollment over ACME, EST, and SCEP, discovery, renewal, delivery, alerts, and code signing in one product. Matching that with Keyfactor takes Command for lifecycle management, EJBCA (or an existing CA) to issue, and Signum or SignServer to sign code, each bought, deployed, and connected separately. Docs: [Certificate Management overview](https://infisical.com/docs/documentation/platform/pki/overview). **Components to run.** Infisical is one platform, plus a gateway where it has to reach a private network, and the Infisical Agent on hosts that no sync reaches. A complete Keyfactor deployment can include Command, SQL Server, an identity provider, Universal Orchestrators with their extensions, a CA Connector Client, the AnyCA Gateway with its own database, the ACME server with its own schema, the SCEP server, EJBCA, and Signum or SignServer. Each one is another thing to deploy, patch, and monitor. The full list is under "What you run with each" below. Docs: [Gateways](https://infisical.com/docs/documentation/platform/gateways/overview). **Product scope.** Secrets Management, Certificate Management, Privileged Access Management, KMS, and Agent Vault run on the same Infisical platform, with shared identities, audit logs, and gateway. A team that starts with certificates adds the rest without another vendor. Keyfactor covers certificates, PKI, code signing, and cryptographic posture. Secrets management needs another vendor. Docs: [Secrets Management](https://infisical.com/docs/documentation/platform/secrets-mgmt/overview), [Privileged Access Management](https://infisical.com/docs/documentation/platform/pam/overview), [KMS](https://infisical.com/docs/documentation/platform/kms/overview). ### Certificate authorities Which CAs sign public and private certificates.
| Feature | Infisical | Keyfactor | |---|---|---| | Private CA hierarchy | Built in, with HSM-backed keys | Needs EJBCA unless you already run a CA | | External and public CAs | Public and private certificates in one inventory, from DigiCert, Sectigo, Let's Encrypt, AD CS, Venafi, and more | Through AnyCA, a separate component with its own database | | Code signing | Built in, with signing approvals and signtool, jarsigner, and cosign support | Signum or SignServer, separate products to buy and connect |
**Private CA hierarchy.** Infisical creates root and intermediate CAs, with RSA, ECDSA, or post-quantum ML-DSA keys, configurable path length, CRL distribution, and OCSP. CA keys can stay in an HSM through PKCS#11. An Infisical intermediate can also be signed by a root you already own. Keyfactor Command doesn't issue certificates itself: private issuance needs EJBCA or another CA such as Microsoft AD CS. Docs: [Private CA](https://infisical.com/docs/documentation/platform/pki/ca/private-ca), [HSM connectors](https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors), [CRL distribution](https://infisical.com/docs/documentation/platform/pki/ca/crl-distribution), [OCSP](https://infisical.com/docs/documentation/platform/pki/ca/ocsp). **External and public CAs.** Infisical issues through any ACME CA (Let's Encrypt, DigiCert, Sectigo, Google Trust Services, ZeroSSL, and others, with DNS-01 through Route 53, Cloudflare, Azure DNS, and Google Cloud DNS), DigiCert CertCentral directly, AWS Private CA, the AWS public CA, GoDaddy, Microsoft AD CS, and Venafi TPP. Their certificates land in the same inventory as Infisical's own. Keyfactor reaches third-party CAs through the AnyCA Gateway, a separate component with its own SQL Server database and one plugin per CA. On Keyfactor's newest SaaS, each deployment gets a single third-party CA connection. Docs: [External CAs](https://infisical.com/docs/documentation/platform/pki/ca/external-ca), [ACME CAs](https://infisical.com/docs/documentation/platform/pki/ca/acme-ca), [Microsoft AD CS](https://infisical.com/docs/documentation/platform/pki/ca/adcs). **Code signing.** Infisical signs with keys that never leave it, through signers with their own roles and multi-step approvals that can be scoped to a binary's checksum, host, or user. It works with Windows signtool through a key storage provider, any PKCS#11 tool, and guides cover jarsigner, cosign, osslsigncode, apksigner, gpg, and OpenSSL. With Keyfactor, code signing is a separate product: Signum, delivered as SaaS with an agent on every signing host, or SignServer, which you host. Docs: [Code signing](https://infisical.com/docs/documentation/platform/pki/code-signing/overview), [Signing approvals](https://infisical.com/docs/documentation/platform/pki/code-signing/approvals), [Sign container images with cosign](https://infisical.com/docs/documentation/platform/pki/guides/code-signing/cosign). ### Issuance and enrollment How servers, devices, and apps request certificates.
| Feature | Infisical | Keyfactor | |---|---|---| | ACME | Yes | A separate ACME server with its own database, deployed on IIS or Kubernetes | | EST | Yes | Only through EJBCA | | SCEP | Yes | A separate SCEP server on IIS, or EJBCA's | | API | Yes | Yes |
**ACME.** Infisical is an ACME server (RFC 8555) with a directory URL for each application and profile, secured by external account binding. certbot, cert-manager, win-acme, and any other compliant client work unchanged. Keyfactor's ACME server is a separate install on IIS or Kubernetes, with its own database schema and an OIDC identity provider. EJBCA has its own ACME endpoint as well. Docs: [ACME enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/acme), [cert-manager over ACME](https://infisical.com/docs/documentation/platform/pki/guides/applications/k8s-cert-manager-acme). **EST.** Infisical serves EST (RFC 7030) with certificate-based authentication and re-enrollment, for network equipment and devices. In Keyfactor, the EST endpoint is always EJBCA. Command can relay EJBCA's EST requests to a Microsoft CA only when Command signs users in with Active Directory. Docs: [EST enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/est). **SCEP.** Infisical serves SCEP with a challenge password, for device fleets managed by Jamf Pro, Microsoft Intune, Ivanti, and Workspace ONE. Keyfactor offers SCEP through a separate SCEP server that runs on IIS in front of a Microsoft CA, or through EJBCA. Docs: [SCEP enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/scep), [Microsoft Intune](https://infisical.com/docs/documentation/platform/pki/guides/applications/microsoft-intune-scep), [Jamf Pro](https://infisical.com/docs/documentation/platform/pki/guides/applications/jamf-pro-scep). **API.** Both have a REST API. Infisical issues a certificate with one call to POST /api/v1/cert-manager/certificates, naming a profile, and authenticates machines with short-lived tokens from machine identities (Kubernetes, AWS, Azure, GCP, OIDC, and more). A Terraform provider and a cert-manager issuer sit on top of it. Keyfactor's API takes Active Directory basic or Windows authentication, or OAuth client credentials. Docs: [API enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/api), [Create certificate endpoint](https://infisical.com/docs/api-reference/endpoints/certificates/create-certificate), [Machine identities](https://infisical.com/docs/documentation/platform/identities/machine-identities). ### Lifecycle automation Finding, tracking, renewing, and installing certificates.
| Feature | Infisical | Keyfactor | |---|---|---| | Certificate discovery | Scans IP ranges and domains, public or private | Needs separate universal orchestrators | | Inventory | Yes | Yes | | Automatic renewal | Via syncs, agents, or ACME clients | Only for orchestrator-managed stores, through an alert workflow you set up | | Expiry alerts | Slack, PagerDuty, email, or webhooks | Email, or custom PowerShell workflows | | Certificate syncs | Pushed to 13+ destinations with no agent on the target | Separate orchestrator extension for each target type |
**Certificate discovery.** Infisical scans domains, IP addresses, and CIDR ranges on the ports you choose, on a schedule, and matches what it finds to the inventory by fingerprint. Certificates issued elsewhere can be imported into the inventory. Private networks are reached through the gateway. Keyfactor's SSL discovery runs on pools of Universal Orchestrators, and each pool needs access to the network it scans. Docs: [Discovery](https://infisical.com/docs/documentation/platform/pki/discovery/overview), [Network discovery](https://infisical.com/docs/documentation/platform/pki/discovery/network). **Inventory.** Infisical keeps every certificate it issues, imports, or discovers in one inventory, filterable by application, profile, source, and metadata, with renew, revoke, and export as PEM or PKCS#12 from the same view. Keyfactor builds its inventory from CA synchronization and orchestrator inventory jobs, organized into saved searches called collections. Docs: [Certificates](https://infisical.com/docs/documentation/platform/pki/applications/certificates). **Automatic renewal.** Infisical renews certificates automatically through syncs, agents, or ACME clients. Certificates enrolled through the API renew server-side before they expire and push the new certificate to every sync destination. On hosts, the Infisical Agent, cert-manager, and certbot renew on their own schedule. Keyfactor renews automatically only certificates that sit in a certificate store an orchestrator manages, through an expiration alert with a renewal workflow step you configure. Docs: [Certificate renewal](https://infisical.com/docs/documentation/platform/pki/applications/certificate-renewal), [Infisical Agent](https://infisical.com/docs/documentation/platform/pki/guides/applications/infisical-agent). **Expiry alerts.** Infisical alerts on expiration, issuance, renewal, and revocation through email, Slack, PagerDuty, and signed webhooks, up to 365 days ahead, for one application or across all of them. Keyfactor's expiry alerts are email (or SMS through email gateways). Slack, Teams, or a webhook means building a workflow step with a REST call, an Azure Function, a Lambda, or PowerShell. Docs: [Alerting](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview), [Alerts across applications](https://infisical.com/docs/documentation/platform/pki/settings/alerts). **Certificate syncs.** Infisical pushes certificates and their renewals to AWS Certificate Manager, AWS Elastic Load Balancer, AWS Secrets Manager, Azure Key Vault, GCP Certificate Manager, Cloudflare, Chef, NetScaler, Kemp LoadMaster, F5 BIG-IP, Nutanix Prism Central, Linux servers over SSH, and Windows servers over WinRM. Nothing is installed on the target. Keyfactor delivers through Universal Orchestrators, with a separate extension and certificate store type for each kind of target. Docs: [Certificate syncs](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview), [Linux servers](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/linux-server), [Windows servers](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/windows-server). ### Access and governance Who can see and change what, access requests and approvals, and audit logs.
| Feature | Infisical | Keyfactor | |---|---|---| | Access control | Yes | Yes | | SAML SSO | Yes | No native SAML. Active Directory or OIDC sign-in only | | Audit logs | Yes | Yes |
**Access control.** Infisical scopes access by application, with Admin, Operator, and Auditor roles, separate roles for code-signing signers, and approval policies that can require one or more approvers before a certificate issues. Keyfactor uses security roles mapped to identity provider users and groups through claims, with permissions per collection and certificate store container. Docs: [Access control](https://infisical.com/docs/documentation/platform/pki/concepts/access-control), [Issuance approvals](https://infisical.com/docs/documentation/platform/pki/applications/approvals). **SAML SSO.** Infisical signs users in with SAML or OIDC through Okta, Microsoft Entra ID, JumpCloud, Keycloak, Google, Auth0, and others, as well as LDAP. Keyfactor Command accepts Active Directory or an OIDC provider, one type per server. A SAML identity provider has to sit behind an OIDC broker such as Keycloak. Docs: [SSO](https://infisical.com/docs/documentation/platform/sso/overview). **Audit logs.** Both keep audit logs. Infisical can also stream them to Datadog, Splunk, Microsoft Sentinel, Cribl, Sumo Logic, Better Stack, Cortex XSIAM, or any HTTPS endpoint. Docs: [Audit logs](https://infisical.com/docs/documentation/platform/audit-logs), [Audit log streams](https://infisical.com/docs/documentation/platform/audit-log-streams/audit-log-streams). ### Pricing What drives the cost, and what you can use for free.
| Feature | Infisical | Keyfactor | |---|---|---| | Pricing model | Quote-based subscription or free tier | Quote-based subscription plus professional services | | Free tier | An internal CA, ACME, and the certificate dashboard | No |
**Pricing model.** Infisical is free to start on Infisical Cloud or self-hosted, and larger deployments are a subscription. Keyfactor sells Command by quote, and professional services are sold on top in packages of working sessions. Docs: [Pricing](https://infisical.com/pricing). **Free tier.** Anyone can sign up for Infisical Cloud and issue from an internal CA over ACME the same day, or self-host the open-source core. Keyfactor offers a 30-day test drive of Command and no free tier. Docs: [Get started with certificates](https://infisical.com/docs/documentation/getting-started/choose-a-product/pki). ## What you run with each ### Infisical - **Infisical platform**: The web app, API, and every product, in one container image or Helm chart. On Infisical Cloud, Infisical runs it. - **PostgreSQL and Redis**: The database and cache, when self-hosting. - **gateway (where needed)**: Reaches private networks, HSMs, AD CS, and discovery targets, connecting out through a relay. - **Infisical Agent (optional)**: Writes certificates to disk on a host and renews them, for hosts no sync reaches. - **cert-manager Infisical Issuer (optional)**: Issues cluster certificates from Infisical in Kubernetes. ### Keyfactor - **Keyfactor Command**: The lifecycle console, API, and job scheduler, on Windows Server with IIS or as seven containers on Kubernetes, unless Keyfactor hosts it. - **Microsoft SQL Server**: Command's database, when self-hosted. - **Identity provider**: Active Directory, or an OIDC provider such as the Keycloak Keyfactor supplies. - **Universal Orchestrators and extensions**: Discovery, inventory, and delivery to certificate stores, installed in your network in every deployment model. - **CA Connector Client**: Connects hosted or containerized Command to on-premises Microsoft and EJBCA CAs. - **AnyCA Gateway**: Connects Command to third-party CAs, with its own SQL Server database, unless Keyfactor hosts it. - **Keyfactor ACME server**: ACME enrollment, on IIS or Kubernetes, with its own database schema. - **Keyfactor SCEP server**: SCEP enrollment, on IIS, in front of a Microsoft CA. - **EJBCA**: The CA, as software, containers, a hardware appliance, or SaaS, and the source of EST. - **Signum or SignServer**: Code signing, as SaaS with an agent on each signing host, or self-hosted. ## When Keyfactor is the better fit Keyfactor makes sense for some teams. It fits when: - You run on Microsoft end to end (Active Directory, SQL Server, IIS, and AD CS) and will never leave it. - You have PKI specialists, or the budget to hire them, to deploy and run Command, EJBCA, the orchestrators, and the gateways. Keyfactor's own commissioned study budgets 2.5 full-time staff to keep it running.¹ - Your team has already worked with Keyfactor for years and won't need to learn the tool's complexity. ## Frequently asked questions ### Is Infisical a Keyfactor alternative? Yes. Infisical issues certificates from its own CAs or from any public and private CA you already use. It discovers certs on your network, renews them, syncs them to where they are served, and handles code signing. Keyfactor requires three different products (Command, EJBCA, and Signum) to do the same. ### What is the best open-source alternative to Keyfactor? Infisical's core is open source under the MIT license, and Infisical can be self-hosted. Infisical covers private CAs, ACME, EST, and SCEP enrollment, discovery, renewal, and certificate syncs. Keyfactor Command is proprietary, and Keyfactor describes EJBCA Community Edition (the open source version of its private CA product) as not intended for production use.² ### Do I need EJBCA to use Keyfactor Command? You need EJBCA to issue private certificates from Keyfactor Command. Keyfactor Command also works with another CA you already run, such as Microsoft AD CS. Command manages certificates but doesn't issue them. Infisical has its own private CAs built in, which means it can issue and manage certificates in the same place. ### Does Keyfactor support ACME? Yes, but only through a separate Keyfactor ACME server that runs on IIS or Kubernetes with its own database. Infisical's ACME server is built into the platform, alongside EST and SCEP, which means it requires no separate infrastructure beyond a gateway deployed once on your infrastructure. ### How long does it take to deploy Keyfactor Command? In a Forrester study Keyfactor commissioned, the composite customer took about four months to deploy Command with five staff, then needed about two and a half full-time staff to run it.¹ Infisical runs as one platform with no separate enrollment servers to install. ### Does Keyfactor Command need software on my network? Yes. Self-hosted Command needs Microsoft SQL Server, plus Windows Server and IIS unless you run it on Kubernetes. Hosted Command needs Universal Orchestrators near your targets and a CA connector to reach on-premises CAs. Whether cloud- or self-hosted, any team using Keyfactor installs, patches, and monitors Keyfactor software. Infisical Cloud needs only one gateway to reach a private network. ### How do I migrate from Keyfactor to Infisical? Connect the CAs you issue from today, run discovery to build your inventory, then move enrollment and syncs one application at a time. Certificates you already track can be imported as PEM or PKCS#12. ## Choosing between Infisical and Keyfactor ### What is the best Keyfactor alternative for Kubernetes? Infisical runs natively on Kubernetes and issues cluster certificates through cert-manager. Self-host it with the official Helm chart on PostgreSQL and Redis, then point cert-manager at Infisical over ACME or through the Infisical Issuer. Keyfactor Command on Kubernetes still needs Microsoft SQL Server and loses Active Directory sign-in and direct Microsoft CA access. Docs: [Kubernetes with Helm](https://infisical.com/docs/self-hosting/deployment-options/kubernetes-helm), [cert-manager Infisical Issuer](https://infisical.com/docs/documentation/platform/pki/guides/applications/k8s-cert-manager-issuer). ### Is Infisical an alternative to EJBCA? Yes. Infisical runs a private CA hierarchy with HSM-backed keys, CRLs, and OCSP, and enrolls over ACME, EST, and SCEP, which covers what most teams use EJBCA for. It also manages the certificates it issues, which with Keyfactor takes Command on top of EJBCA. Keyfactor describes EJBCA Community Edition as not intended for production use.² Docs: [Private CA](https://infisical.com/docs/documentation/platform/pki/ca/private-ca). ### Can Infisical replace Keyfactor Command, EJBCA, and Signum? Yes. Infisical Certificate Management issues from its own CAs or yours, manages the lifecycle, and signs code, which with Keyfactor are three products. Teams usually replace them one application at a time while both run. Docs: [Certificate Management overview](https://infisical.com/docs/documentation/platform/pki/overview). ### Is Keyfactor open source? No. Keyfactor Command is proprietary. EJBCA Community Edition is open source, but Keyfactor says it is not intended for production use and points production deployments to the commercial EJBCA Enterprise.² Infisical's core is open source under the MIT license. ### Can Infisical work with our existing Microsoft AD CS? Yes. Infisical issues through AD CS over a gateway, using the certificate templates you already have, so AD CS stays the issuing CA while Infisical handles inventory, renewal, alerts, and delivery. Or AD CS can sign an Infisical intermediate CA, so certificates chain to the root your devices already trust. Docs: [Microsoft AD CS](https://infisical.com/docs/documentation/platform/pki/ca/adcs). ### What replaces Keyfactor Signum in Infisical? Infisical's built-in code signing. Signers hold keys that never leave Infisical, approvals can require several people per signature, and signtool, jarsigner, cosign, and any PKCS#11 tool sign through it. Docs: [Code signing](https://infisical.com/docs/documentation/platform/pki/code-signing/overview). ### Does Keyfactor Command support SAML? Not natively. Command signs users in through Active Directory or an OIDC provider, one type per server, so a SAML identity provider has to sit behind an OIDC broker such as Keycloak. Infisical supports SAML and OIDC directly. Docs: [Infisical SSO](https://infisical.com/docs/documentation/platform/sso/overview). ### Does Keyfactor send certificate alerts to Slack or PagerDuty? Not natively. Keyfactor's expiry alerts go out by email, and Slack, Teams, or PagerDuty means building a workflow step with a REST call or a script. Infisical sends alerts to email, Slack, PagerDuty, and webhooks out of the box. Docs: [Alerting](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview). ### Which is easier to run, Infisical or Keyfactor? Infisical. It runs as one platform on PostgreSQL and Redis, plus a gateway where it has to reach a private network. Keyfactor spreads the same job across Command, SQL Server, orchestrators, gateways, enrollment servers, and EJBCA, and the customer in a Forrester study Keyfactor commissioned needed about two and a half full-time staff to run it.¹ ### Can Infisical and Keyfactor run side by side during a migration? Yes. Infisical can issue through the same CAs Keyfactor uses, discover and import the certificates Keyfactor tracks, and take over one application at a time, so nothing has to move at once. Docs: [External CAs](https://infisical.com/docs/documentation/platform/pki/ca/external-ca). ## Issuing and delivering certificates with Infisical ### How do I issue a certificate from Infisical with certbot? Add ACME enrollment to a certificate profile in an application, then reveal its directory URL and account binding credentials. Run certbot with --server set to the directory URL and --eab-kid and --eab-hmac-key set to the credentials. Docs: [ACME enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/acme), [NGINX with certbot](https://infisical.com/docs/documentation/platform/pki/guides/applications/nginx-certbot). ### How do I connect cert-manager to Infisical? Two ways. Create an ACME ClusterIssuer that points at an Infisical directory URL with external account binding, or install the Infisical Issuer with Helm and authenticate it as a machine identity, which needs no HTTP or DNS challenges. Docs: [cert-manager over ACME](https://infisical.com/docs/documentation/platform/pki/guides/applications/k8s-cert-manager-acme), [cert-manager Infisical Issuer](https://infisical.com/docs/documentation/platform/pki/guides/applications/k8s-cert-manager-issuer). ### How do I issue a certificate through the Infisical API? Send POST /api/v1/cert-manager/certificates with a profile ID, and either the certificate attributes, so Infisical generates and keeps the key, or your own CSR. Certificates with keys Infisical manages renew server-side. Docs: [API enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/api), [Create certificate endpoint](https://infisical.com/docs/api-reference/endpoints/certificates/create-certificate). ### How does a service authenticate to Infisical's API? As a machine identity. It logs in with an auth method that fits where it runs, such as Universal Auth, Kubernetes, AWS, Azure, GCP, or OIDC, and gets a short-lived access token to send as a bearer token. Docs: [Machine identities](https://infisical.com/docs/documentation/platform/identities/machine-identities), [API authentication](https://infisical.com/docs/api-reference/overview/authentication). ### Is there a Terraform provider for Infisical certificate management? Yes. The Infisical Terraform provider manages internal and external CAs, certificate policies and profiles, applications, certificates, and certificate syncs as code. Docs: [Terraform](https://infisical.com/docs/integrations/frameworks/terraform). ### How do I get certificates onto a server without installing an agent? Use a certificate sync. Infisical writes certificates to Linux servers over SSH and Windows servers over WinRM, and pushes them to load balancers, CDNs, and cloud key stores, then repeats the push on every renewal. Nothing is installed on the target. Docs: [Certificate syncs](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview). ### What does the Infisical Agent do for certificates? It requests certificates as a machine identity, writes them to disk with the paths and permissions you set, renews them before expiry, and runs a command after each renewal, such as reloading NGINX. Start it with infisical cert-manager agent. Docs: [Infisical Agent guide](https://infisical.com/docs/documentation/platform/pki/guides/applications/infisical-agent), [Infisical Agent reference](https://infisical.com/docs/documentation/platform/pki/reference/infisical-agent). ### How do I import existing certificates into Infisical? Upload them as PEM files or as a PKCS#12 keystore with its password, in the dashboard or through the API. Imported certificates get expiry alerts right away, and attaching a certificate profile hands their renewal to Infisical. Docs: [Importing certificates](https://infisical.com/docs/documentation/platform/pki/applications/certificates#importing-certificates), [Import certificate endpoint](https://infisical.com/docs/api-reference/endpoints/certificates/import-certificate). ### How do I chain an Infisical intermediate CA to our existing root? Create an intermediate CA in Infisical, download its CSR, sign it with your root, and import the signed certificate and chain. Microsoft AD CS and Venafi can sign it automatically instead. Docs: [Private CA](https://infisical.com/docs/documentation/platform/pki/ca/private-ca). ### How do I get alerts before certificates expire in Infisical? Create an expiration alert for an application, or one across all applications, choose how far ahead it fires, and send it to email, Slack, PagerDuty, or a webhook. Alerts can also fire on issuance, renewal, and revocation. Docs: [Alerting](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview). ### Does Infisical publish CRLs and run OCSP? Yes. Every certificate from an Infisical CA carries a CRL distribution point, CRLs regenerate on each revocation, and each internal CA can run an OCSP responder. Docs: [CRL distribution](https://infisical.com/docs/documentation/platform/pki/ca/crl-distribution), [OCSP](https://infisical.com/docs/documentation/platform/pki/ca/ocsp). ### Can an AI coding agent read Infisical's docs directly? Yes. Connect Claude Code, Cursor, Codex, or another agent to Infisical's docs MCP server at https://infisical.com/docs/mcp and it can look up current instructions while it works. Docs: [Build with AI tools](https://infisical.com/docs/documentation/getting-started/set-up-with-ai). ## Security and compliance ### Can Infisical keep CA keys in an HSM? Yes. Root and intermediate CAs can be HSM-backed through PKCS#11, so every signing operation runs on the HSM and the key never leaves it. Docs: [HSM connectors](https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors). ### Does Infisical support post-quantum certificates? Yes. Infisical CAs issue with ML-DSA (FIPS 204) alongside RSA and ECDSA, so teams can test post-quantum certificates before they need them. Docs: [Post-quantum algorithms](https://infisical.com/docs/documentation/platform/pki/reference/pqc-algorithms). ### Is Infisical SOC 2 and HIPAA compliant, and does it support FIPS 140-3? Yes. Infisical is SOC 2 and HIPAA compliant, and runs in a FIPS 140-3 mode for self-hosted deployments. Reports are in Infisical's Trust Center. Docs: [Production hardening](https://infisical.com/docs/self-hosting/guides/production-hardening#fips-140-3-compliance). ## What it costs ### How much does Infisical cost? Infisical is free to start, on Infisical Cloud or self-hosted. Larger deployments are a subscription, and the team can size one with you. Docs: [Pricing](https://infisical.com/pricing). ### How is Keyfactor priced? By quote. Keyfactor sells Command and its other products through its sales team, with professional services for deployment sold on top, and offers a 30-day test drive of Command rather than a free tier. ## Start managing certificates, then add secrets, privileged access, KMS, or agent access. - **[Secrets Management](https://infisical.com/platform/secrets-management)**: Store, rotate, and deliver secrets. - **[Certificate Management](https://infisical.com/platform/certificate-management)**: Issue, renew, and track every certificate. - **[Privileged Access Management](https://infisical.com/platform/pam)**: Time-bound access without shared credentials. - **[KMS](https://infisical.com/docs/documentation/platform/kms/overview)**: Encrypt and sign data through an API. - **[Agent Vault](https://infisical.com/platform/agent-vault)**: Give AI agents access without handing them credentials. ## How to migrate from Keyfactor to Infisical Most teams move one application at a time, so both systems run side by side until the last workload moves. ### 1. Connect your CAs Connect the public and private CAs you issue from today or have your existing root sign an Infisical intermediate CA. Add the CAs you issue from today as external CAs: any ACME CA, DigiCert, AWS Private CA, or Microsoft AD CS through the gateway. To keep your existing root, generate a CSR for an Infisical intermediate CA, sign it with the root, and import the signed certificate, or let AD CS sign it automatically. Docs: [External CAs](https://infisical.com/docs/documentation/platform/pki/ca/external-ca), [Private CA](https://infisical.com/docs/documentation/platform/pki/ca/private-ca). ### 2. Build the inventory Discover certificates across your networks and import the certificates Keyfactor tracks. Run network discovery over the ranges your Keyfactor SSL networks scan, and import the certificates Keyfactor tracks as PEM files or PKCS#12 keystores. Attach a certificate profile to an imported certificate to hand its renewal to Infisical. Docs: [Network discovery](https://infisical.com/docs/documentation/platform/pki/discovery/network), [Importing certificates](https://infisical.com/docs/documentation/platform/pki/applications/certificates#importing-certificates). ### 3. Move enrollment and delivery Point ACME, EST, and SCEP clients at Infisical and replace orchestrator jobs with certificate syncs. Give ACME clients the application's directory URL and account binding, move SCEP profiles in Intune or Jamf Pro and EST devices to Infisical's endpoints, and replace each orchestrator store job with a certificate sync to the same target, or the Infisical Agent on hosts no sync reaches. Docs: [Enrollment methods](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/overview), [Certificate syncs](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview). ### 4. Retire Keyfactor Once everything runs through Infisical, decommission Keyfactor. When the inventory shows every certificate renewing through Infisical, stop the orchestrators and decommission Command, its gateways, and their databases. Our team can help you plan and run the migration: [talk to an expert](https://infisical.com/talk-to-us). ## Sources 1. [Forrester Consulting, "The Total Economic Impact of Keyfactor," commissioned by Keyfactor, April 2026](https://tei.forrester.com/go/keyfactor/saas) 2. [Keyfactor, EJBCA Community Edition on GitHub](https://github.com/Keyfactor/ejbca-ce) ## Get started - Start free: https://app.infisical.com/signup - Get started with certificates: https://infisical.com/docs/documentation/getting-started/choose-a-product/pki - Self-host Infisical: https://infisical.com/docs/self-hosting/overview - Issue certificates in Kubernetes with cert-manager: https://infisical.com/docs/documentation/platform/pki/guides/applications/k8s-cert-manager-acme - Issue a certificate with certbot: https://infisical.com/docs/documentation/platform/pki/guides/applications/nginx-certbot - Connect an AI agent to the docs: https://infisical.com/docs/documentation/getting-started/set-up-with-ai - Talk to an expert: https://infisical.com/talk-to-us - All comparisons: https://infisical.com/compare.md
/compare/infisical-vs-keyfactor.md · raw source