--- title: "Infisical vs. Sectigo Certificate Manager" description: "How Infisical and Sectigo Certificate Manager (SCM) differ on agents, connectors, self-hosting, renewal, and delivery, what SCM costs to run, and how to keep buying Sectigo certificates through Infisical." canonical: "https://infisical.com/compare/infisical-vs-sectigo-certificate-manager" last-reviewed: "2026-10-09" source-index: https://infisical.com/llms.txt ---

# Infisical vs. Sectigo Certificate Manager

Sectigo Certificate Manager automates certificates through agents and connectors you run in your network. Infisical automates every certificate out of the box, with no agent on the target.

## What's the difference between Infisical and Sectigo Certificate Manager?

Sectigo Certificate Manager is a capable hosted certificate platform, but requires installing and maintaining agents, gateways, and connectors. Infisical works out of the box for your entire infrastructure.

| Stage | Infisical | Sectigo Certificate Manager |
|---|---|---|
| Evaluate | Try the free tier with an internal CA, ACME automation, and the certificate dashboard; Self-host the MIT-licensed open-source version | Start an SCM Pro trial, then talk to sales for Enterprise; Can't audit or self-host the code |
| Deploy/integrate | Use managed cloud in EU or US regions; Self-host on Docker, Kubernetes, Linux, AWS ECS, or Google GKE; Use a gateway to reach private networks | Install network agents, Microsoft agents, and gateways in your network; Set up organizations, departments, and domain validation before issuing |
| Migrate/onboard | Connect the CAs you already use, Sectigo included; Discover every certificate on your infrastructure, from any CA | Add separate connectors or agents for each kind of target |
| Operate | Manage every certificate (on any infrastructure) in one dashboard; Renew, revoke, or reissue from the dashboard or API | Approve agent install requests one by one; Keep agents connected, or discovery and installs stop |
| Automate | Renew automatically and sync certificates to 13+ destinations, with no agent on the target; Get a Slack, email, PagerDuty, or webhook alert before expiries | Install certificates through agents and per-target connectors |
| Scale | Add secrets, privileged access, AI agent security, or KMS on the same platform | Buy separate products for secrets, PAM, or other security infrastructure |

## Infisical vs. Sectigo Certificate Manager at a glance

Sectigo Certificate Manager covers the certificate lifecycle with agents and connectors in your network. Infisical covers it out of the box.

### Platform and deployment

Where each product runs, what it's built on, and what it covers.

| Feature | Infisical | Sectigo Certificate Manager |
|---|---|---|
| Open source | MIT-licensed, 29,000+ GitHub stars | No |
| Self-hosting | Docker, Kubernetes, Linux, AWS ECS, or Google GKE | No |
| Managed cloud | US and EU regions | Yes |
| Products needed | Infisical Certificate Management | Sectigo Certificate Manager |
| Components to run | One platform, plus a gateway | Network agents, Microsoft agents, gateways, and connectors |
| Product scope | Certificates, secrets, privileged access, AI agents, and KMS | Certificates |

### Certificate authorities

Which CAs sign public and private certificates.

| Feature | Infisical | Sectigo Certificate Manager |
|---|---|---|
| Private CA hierarchy | Built in, optionally with keys in your own HSM | Sectigo Private PKI, a hosted service |
| External and public CAs | Yes | Yes |
| Code signing | Built in, with signing approvals and signtool, jarsigner, and cosign support | Issues and manages code signing certificates |

### Issuance and enrollment

How servers, devices, and apps request certificates.

| Feature | Infisical | Sectigo Certificate Manager |
|---|---|---|
| ACME | Yes | Yes |
| EST | Yes | Yes |
| SCEP | Yes | Yes |
| API | Yes | Yes |

### Lifecycle automation

Finding, tracking, renewing, and installing certificates.

| Feature | Infisical | Sectigo Certificate Manager |
|---|---|---|
| Certificate discovery | Finds every certificate on your infrastructure, from any CA | Internal hosts need a network agent |
| Inventory | Yes | Yes |
| Automatic renewal | No agent on the target | Through agents/connectors |
| Expiry alerts | Slack, PagerDuty, email, or webhooks | Email, Slack, Teams, or webhooks |
| Certificate syncs | 13+ destinations, no agent on the target | Agents and per-target connectors |

### Access and governance

Who can see and change what, access requests and approvals, and audit logs.

| Feature | Infisical | Sectigo Certificate Manager |
|---|---|---|
| Access control | Yes | Yes |
| SAML SSO | Yes | Yes |
| Audit logs | Yes | Yes |

### Pricing

What drives the cost, and what you can use for free.

| Feature | Infisical | Sectigo Certificate Manager |
|---|---|---|
| Pricing model | Quote-based subscription or free tier | SCM Pro subscription tiers. SCM Enterprise by quote |
| Free tier | An internal CA, ACME, and the certificate dashboard | 30-day trial only |

## Frequently asked questions

### Is Infisical a Sectigo Certificate Manager alternative?

Yes. Infisical runs its own CAs, issues from public and enterprise CAs, discovers certificates on your network, renews them, and installs them where they're served, with no agent on the target. Sectigo Certificate Manager covers the same lifecycle, but reaches your network through agents, gateways, and connectors you install and keep running.

### Does Sectigo Certificate Manager need agents?

Yes, for anything inside your network. Discovering internal hosts and installing certificates on them takes a Sectigo network agent on each network, plus Microsoft agents, gateways, or connectors for specific targets. If an agent disconnects, discovery and installs on that network stop. Infisical installs certificates on 13+ kinds of targets with no agent, and reaches private networks through one gateway.

### Can I self-host Sectigo Certificate Manager?

Sectigo runs Sectigo Certificate Manager as a hosted service. It is not open-source and only its agents, gateways, and connectors run in your network. Infisical can be self-hosted on Docker, Kubernetes, Linux, AWS ECS, or Google GKE, or used as Infisical Cloud.

### How much does Sectigo Certificate Manager cost?

SCM Pro has self-serve subscription tiers, and SCM Enterprise is sold by quote. The real cost is often in running it: the engineering effort of keeping agents and gateways in every network, a connector per kind of target, organization and domain validation setup, and approving installs. Infisical works out of the box, has a free tier, and offers an MIT-licensed open-source version.

### Can I keep buying certificates from Sectigo if I use Infisical?

Yes. Infisical issues Sectigo certificates through Sectigo's ACME endpoint with external account binding, alongside your other CAs, so changing how you manage certificates doesn't mean changing where you buy them.

## Start managing certificates, then add secrets, privileged access, KMS, or agent access.

- **[Secrets Management](https://infisical.com/platform/secrets-management)**: Store, rotate, and deliver secrets.
- **[Certificate Management](https://infisical.com/platform/certificate-management)**: Issue, renew, and track every certificate.
- **[Privileged Access Management](https://infisical.com/platform/pam)**: Time-bound access without shared credentials.
- **[KMS](https://infisical.com/docs/documentation/platform/kms/overview)**: Encrypt and sign data through an API.
- **[Agent Vault](https://infisical.com/platform/agent-vault)**: Give AI agents access without handing them credentials.

## How to migrate from Sectigo Certificate Manager to Infisical

Most teams keep their certificates flowing while they move management to Infisical, one application at a time.

1. **Connect your CAs.** Connect CAs you issue from, including Sectigo over ACME, or create Infisical's own.
2. **Discover certificates.** Run discovery to find every certificate on your infrastructure.
3. **Move one application.** Manage its certificates in Infisical, and sync them to wherever they're served.
4. **Retire SCM.** Remove SCM agents and connectors as each application moves.

Our team can help you plan and run the migration: [talk to an expert](https://infisical.com/talk-to-us).

## Get started

- Start free: https://app.infisical.com/signup
- Talk to an expert: https://infisical.com/talk-to-us
- All comparisons: https://infisical.com/compare.md