Infisical vs. AWS Certificate Manager
AWS Certificate Manager covers public certificates on AWS. Infisical automates public and private certificates everywhere and syncs with ACM.
The ACM way
Region by region inside AWS, and by hand everywhere else.
- Request certificate
- api.example.com: Pending validation
- laptop
- EventBridge rule
- AWS Private CA: $400 per CA per month, plus per-certificate fees.
- Why is my ACM certificate ineligible for managed renewal?
- laptop
- laptop
- Renew TLS on the on-prem API servers: Outside AWS, so done by hand
- api-01.dc1.internal: Certificate expired
- Sam, platform team: Why didn't anyone get the expiry alert? Does that EventBridge rule cover us-west-2?
The Infisical way
Every certificate in one place, in AWS and everywhere else.
What's the difference between Infisical and AWS Certificate Manager?
ACM renews public certificates for AWS services, but requires wiring it to a separate product for private ones. Infisical runs your whole certificate estate in one place and can sync with ACM instead of replacing it.
Evaluate
Infisical- Try the free tier with an internal CA, ACME automation, and the certificate dashboard
- Self-host the MIT-licensed open-source version
AWS Certificate Manager- Adopt and automate public certificate renewal quickly
- Evaluate a second product: AWS Private CA to manage private certificates
Deploy/integrate
Infisical- Use managed cloud in EU or US regions
- Self-host on Docker, Kubernetes, Linux, AWS ECS, or Google GKE
- Connect ACM and AWS Private CA as CAs
AWS Certificate Manager- Design a Private CA hierarchy at $400 per CA per month
- Build custom logic to get private certificates anywhere outside AWS
- Replicate certificates region by region
Migrate/onboard
Infisical- Discover every certificate on your infrastructure, in AWS or outside of it
- Set up automated syncs into ACM
AWS Certificate Manager- Import outside certificates by hand and reimport them before they expire
Operate
Infisical- Manage every certificate (on any infrastructure) in one dashboard
- Renew, revoke, or reissue from the dashboard or API
AWS Certificate Manager- Check each region's ACM console separately
- Chase certificates stuck in validation
Automate
Infisical- Renew automatically everywhere, not just on AWS services
- Get a Slack, email, PagerDuty, or webhook alert before expiries
AWS Certificate Manager- Route EventBridge events to SNS or Lambda in every region to get an alert
- Manually script delivery to anything outside AWS
- Manually connect AWS-native tools
Scale
Infisical- Add secrets, privileged access, AI agent security, or KMS on the same platform
AWS Certificate Manager- Rebuild the setup for every other cloud and data center
Infisical vs. AWS Certificate Manager at a glance
AWS-native services only cover AWS services while Infisical covers every certificate on any cloud or self-hosted infrastructure.
| Feature |  | AWS Certificate Manager |
|---|---|---|
| Where it worksWhere certificates can be issued, managed, and installed. | AWS, other clouds, on-prem, and Kubernetes | AWS services, one region at a time |
| Products neededHow many separate products it takes to cover the full certificate lifecycle and CA hierarchy. | Infisical Certificate Management | ACM, plus AWS Private CA for private certificates |
| Open sourceWhether the source code is public and auditable for your team. | MIT-licensed, 29,000+ GitHub stars | Proprietary AWS service |
| Self-hostingRunning the product in your dedicated cloud or on-premises infrastructure. | Docker, Kubernetes, Linux, AWS ECS, or Google GKE | AWS-hosted only |
| Product scopeWhat Infisical and AWS Certificate Manager cover beyond certificate management. | Certificates, secrets, privileged access, AI agents, and KMS | Certificates for AWS services |
| Public certificates | From ACM, Let's Encrypt, DigiCert, and more | Free on AWS services, renewed automatically |
| Private CA hierarchy | Built in, with keys in your own HSM if you want | AWS Private CA, $400 per CA per month, per region |
| External and public CAs | Public, private, ACM, and Private CA, in one inventory | Amazon's public CA and Private CA only |
| ACMEA protocol for tools like certbot and cert-manager to request and renew certificates. | Public certificates only | |
| ESTA protocol common in IoT and networking that helps devices and servers enroll for certificates. | ||
| SCEPA legacy enrollment protocol used by device management tools like Microsoft Intune and Jamf. | Only through AWS Private CA | |
| APIRequesting certificates from your own code or scripts. | ||
| Certificate discoveryScanning your networks to find certificates in use, including ones you didn't know about. | Finds every certificate on your infrastructure, from any CA | |
| InventoryA central list of every certificate, where it's used, and when it expires. | One view across clouds and on-prem | Per account and region |
| Automatic renewalAutomatically replacing certificates before they expire. | Via syncs, agents, or ACME clients | On AWS services, imported certificates require manual renewals |
| Expiry alertsNotifications before a certificate expires to renew them in time. | Slack, PagerDuty, email, or webhooks | Custom events routed through EventBridge |
| Certificate syncsInstalling certificates on load balancers, servers, and cloud services that use them. | 13+ destinations, including ACM and AWS load balancers | AWS services only |
| Access controlRules for who can see things or make changes. | ||
| SAML SSOSigning in through an identity provider like Okta or Microsoft Entra ID. | ||
| Audit logsA record of who did what for security reviews and compliance. | ||
Use AWS Certificate Manager, AWS Private CA, and Infisical together
Infisical can issue through ACM and AWS Private CA and sync with ACM, so AWS services keep certificates where they expect them.
What stays on AWS
Public certificates from ACM and AWS Private CA as the CA behind private certificates (if you already run it).
What Infisical adds
On top of what AWS covers:
- A private CA hierarchy that works outside of AWS
- One inventory for all certificates
- Automated renewal and alerts for every certificate
How they connect
Infisical can issue through ACM's public CA or AWS Private CA. It can also sync certificates into ACM.
Frequently asked questions
Everything you need to know. Can't find an answer? Talk to our team.
Public certificates for AWS services like load balancers and CloudFront are free. Certificates exported for use outside AWS and certificates issued over ACME are charged per domain, and private certificates need AWS Private CA, which is billed separately. The real cost is often in the infrastructure costs and engineering overhead: EventBridge alert rules, reimport scripts, certificates in every region, and separate tooling for everything outside AWS. Infisical works out of the box across AWS and beyond, and has a free tier.
AWS Private CA costs $400 per CA per month in general-purpose mode, plus a fee for each certificate, and a root plus an intermediate is two CAs. A short-lived mode costs $50 per CA per month for certificates valid up to seven days. Infisical's private CAs are built in, with no per-CA fee.
ACM issues and manages certificates for AWS services, and AWS Private CA is a separate service that runs private certificate authorities. To get private certificates in ACM, you set up Private CA first and pay $400 per CA per month separately. Infisical covers public and private certificates in one product.
Private certificates from AWS Private CA can be exported with their private key. Public certificates can only be exported if you request them as exportable, a paid option chosen at request time. Standard public certificates stay inside AWS services. Infisical issues certificates you can install anywhere, and syncs them into ACM for the AWS services that need them.
ACM emits an event before a certificate expires, but getting a person notified takes your own EventBridge rule routed to SNS or Lambda, in every region you use. Infisical alerts by email, Slack, PagerDuty, or webhook out of the box.
Yes. Infisical pushes certificates into ACM for load balancers, CloudFront, and API Gateway, and can attach them to load balancer listeners directly. It can also issue through ACM's public CA and AWS Private CA, so AWS stays your CA where you want it to.
Not on its own. ACM issues public certificates itself and renews them for free on AWS services. Private certificates come from AWS Private CA, a separate service at $400 per CA per month plus per-certificate fees, and getting them onto anything that isn't an AWS service is up to your team. Infisical runs private CAs built in, alongside public certificates, and delivers both anywhere.
How to migrate from AWS Certificate Manager to Infisical
Most teams keep ACM for AWS services and move everything else to Infisical, one application at a time.
- 01
Connect AWS
Connect ACM and AWS Private CA as CAs in Infisical, so you keep issuing from them.
- 02
Discover certificates
Run discovery to find every certificate anywhere.
- 03
Move one application
Manage certificates in Infisical, and sync them into ACM or to wherever they're served.
- 04
Retire the wiring
Route expiry alerts through Infisical. Remove EventBridge rules and reimport scripts as each application moves.
Our team can help you plan and run the migration.
Start managing certificates, then add secrets, privileged access, KMS, or agent access.
Add products when you need them, on the platform you already run.
- OpenAI: API, Codex
- Let's Encrypt
- Vercel
- Gemini CLI
- Apache Airflow
- Spring Boot
- OpenCode
- DigiCert
- Jenkins
- Terraform: Terraform, Terraform Cloud
- Render
- Azure: Key Vault, App Configuration, DevOps, Entra ID, CLI
- NetScaler
- Databricks
- KMIP
- GoDaddy
- Pulumi
- Okta
- Ansible
- Cloudflare: Workers, Pages, Custom certificates
- Sectigo
- Laravel
- Hermes
- SAP HANA
- ClickHouse
- OpenRouter
- Supabase
- Docker
- Snowflake
- Venafi
- Rails
- Humanitec
- Tailscale
- 1Password
- OpenClaw
- Cassandra
- Northflank
- Redis
- Datadog
- Google Cloud: Secret Manager, Certificate Manager, IAM, KMS
- Dell PowerEdge
- Bitbucket
- Claude Code
- Railway
- dbt Cloud
- Windows Server
- Chef
- .NET
- PostgreSQL
- AWS: Secrets Manager, Parameter Store, Certificate Manager, Elastic Load Balancing, Private CA, IAM, KMS, CloudHSM, ECS, Amplify
- Linux servers
- Auth0
- Oracle: Oracle Database, OCI Vault
- Octopus Deploy
- Fly.io
- MySQL
- F5 BIG-IP
- LDAP
- TeamCity
- Qovery
- Nutanix Prism Central
- Microsoft: Active Directory, AD CS
- Windmill
- LiteLLM
- Netlify
- RabbitMQ
- Spacelift
- Kubernetes
- CircleCI
- GitLab
- SQL Server
- Stripe
- DigitalOcean
- GitHub: GitHub, GitHub Actions
- Couchbase
- MongoDB: MongoDB, MongoDB Atlas
- Heroku
- SSH
- Salesforce
- HashiCorp Vault
- Travis CI
- Kemp LoadMaster
- Next.js
- Django
- Sigstore Cosign
- Elasticsearch
- Certificate ManagementToday
- Secrets ManagementWhen you need it
- Privileged Access ManagementWhen you need it
- KMSWhen you need it
- Agent VaultWhen you need it
Talk to our team
Starting with Infisical is simple, fast, and free.
- SOC 2, HIPAA, and FIPS 140-3 compliant
- Open source, in our cloud or yours
Talk to your boss
Need a yes from your boss?
Here's a message to send your manager. Edit it, then paste it into Slack, Teams, or an email.
Trusted by teams at
