Infisical vs. Google Cloud Certificate Manager
Google Cloud Certificate Manager covers public certificates on Google Cloud. Infisical automates public and private certificates everywhere and syncs with Certificate Manager.
The Certificate Manager way
Authorizations, maps, and log queries inside Google Cloud, and by hand everywhere else.
- Create DNS authorization
- api.example.com: PROVISIONING
- laptop
- Certificate map entry
- CA Service: Enterprise tier: $200 per CA per month, plus per-certificate fees.
- Log-based alert
- Troubleshoot SSL certificates
- laptop
- Renew certificates on the AWS and on-prem services: Outside Google Cloud, so done by hand
- api-01.dc1.internal: Certificate expired
- Sam, platform team: Did anyone get an alert? Or is expiry still just a log entry?
The Infisical way
Every certificate in one place, in Google Cloud and everywhere else.
What's the difference between Infisical and Google Cloud Certificate Manager?
Certificate Manager renews public certificates for Google Cloud, but private certificates need a separate product. Infisical runs your whole certificate estate in one place and syncs with Google's services.
Evaluate
Infisical- Try the free tier with an internal CA, ACME automation, and the certificate dashboard
- Self-host the MIT-licensed open-source version
Google Cloud Certificate Manager- Adopt Google-managed public certificates quickly
- Evaluate a second product: CA Service for private certificates
Deploy/integrate
Infisical- Use managed cloud in EU or US regions
- Self-host on Docker, Kubernetes, Linux, AWS ECS, or Google GKE
- Use a gateway to reach private networks
Google Cloud Certificate Manager- Authorize every domain with DNS records or the load balancer
- Set up CA pools and pick a tier for private certificates
- Move GKE Ingress to the Gateway API to use Certificate Manager
Migrate/onboard
Infisical- Discover every certificate on your infrastructure, in Google Cloud or elsewhere
- Set up automated syncs into Certificate Manager
Google Cloud Certificate Manager- Upload outside certificates by hand and manually upload new ones if one expires
Operate
Infisical- Manage every certificate (on any infrastructure) in one dashboard
- Renew, revoke, or reissue from the dashboard or API
Google Cloud Certificate Manager- Map hostnames to certificates in certificate maps
- Chase certificates stuck in provisioning or authorization
Automate
Infisical- Renew automatically everywhere, not just on Google Cloud
- Get a Slack, email, PagerDuty, or webhook alert before expiries
Google Cloud Certificate Manager- Manually build log-based alerts
- Rely on a community cert-manager issuer for Kubernetes
- Manually script delivery to anything outside Google Cloud
Scale
Infisical- Add secrets, privileged access, AI agent security, or KMS on the same platform
Google Cloud Certificate Manager- Rebuild the setup for every other cloud and data center
- Uproot your entire workflow if you ever migrate
- Wire separate services together for each new piece of security infrastructure
Infisical vs. Google Cloud Certificate Manager at a glance
Google Cloud-native services only cover Google Cloud, while Infisical covers every certificate on any cloud or self-hosted infrastructure.
| Feature |  | Google Cloud Certificate Manager |
|---|---|---|
| Where it worksWhere certificates can be issued, managed, and installed. | Google Cloud, other clouds, on-prem, and Kubernetes | Google Cloud load balancers and Media CDN |
| Products neededHow many separate products it takes to cover public and private certificates. | Infisical Certificate Management | Certificate Manager, plus CA Service for private certificates |
| Open sourceWhether the source code is public, so your team can review exactly what runs. | MIT-licensed, 29,000+ GitHub stars | |
| Self-hostingRunning the product on your own infrastructure instead of the vendor's cloud. | Docker, Kubernetes, Linux, AWS ECS, or Google GKE | |
| Product scopeWhat Infisical and Google Cloud Certificate Manager cover beyond certificate management. | Certificates, secrets, privileged access, AI agents, and KMS | Certificates for Google Cloud services |
| Public certificates | From Google, Let's Encrypt, DigiCert, and more | Google Cloud |
| Private CA hierarchy | Built in, optionally with keys in your own HSM | Via separate CA Service and manual wiring |
| External and public CAs | Public, private, and Google's public CA in one inventory | Google's public CA, Let's Encrypt, and CA Service |
| ACMEHow tools like certbot and cert-manager request and renew certificates automatically. | Google's public CA only | |
| ESTA protocol devices and servers use to enroll for certificates securely, common in network equipment and IoT. | ||
| SCEPAn older enrollment protocol used by device management tools like Microsoft Intune and Jamf. | ||
| APIRequesting certificates directly from your own code or scripts. | ||
| Certificate discoveryScanning your networks to find certificates in use, including ones you didn't know about. | Finds every certificate on your infrastructure, from any CA | |
| InventoryA single list of every certificate, where it's used, and when it expires. | One view across clouds and on-prem | Separate per project and region |
| Automatic renewalReplacing certificates before they expire, without manual steps. | Via syncs, agents, or ACME clients | Google-managed certificates only, uploads require manual renewals |
| Expiry alertsNotifications before a certificate expires, so it gets renewed in time. | Slack, PagerDuty, email, or webhooks | Log entries you can build alerts with |
| Certificate syncsInstalling certificates automatically on the load balancers, servers, and cloud services that use them. | 13+ destinations, including Certificate Manager | Google Cloud services only |
| Access controlRules for who can read or change which secrets and certificates. | ||
| SAML SSOSigning in through your company's identity provider, like Okta or Microsoft Entra ID. | ||
| Audit logsA record of who did what, kept for security reviews and compliance. | ||
Use Google Cloud Certificate Manager and Infisical together
Infisical can issue through Google's public CA and sync with Certificate Manager, so Google Cloud services keep certificates where they expect them.
What stays on Google Cloud
Google-managed public certificates on your load balancers and Media CDN.
What Infisical adds
On top of what Google Cloud covers:
- A private CA hierarchy that works outside of Google Cloud
- One inventory for all certificates
- Automated renewal and alerts for every certificate
How they connect
Infisical can issue public certificates from Google's public CA over ACME, sync certificates into Certificate Manager, and keep their certificate map entries current.
Frequently asked questions
Everything you need to know. Can't find an answer? Talk to our team.
How to migrate from Google Cloud Certificate Manager to Infisical
Most teams keep Certificate Manager for Google Cloud services and move everything else to Infisical, one application at a time.
- 01
Connect Google Cloud
Connect Certificate Manager as a sync destination, and Google's public CA as a CA in Infisical.
- 02
Discover certificates
Run discovery to find every certificate anywhere.
- 03
Move one application
Manage certificates in Infisical, and sync them into Certificate Manager or to wherever they're served.
- 04
Retire the wiring
Route expiry alerts through Infisical. Remove log-based alerts and upload scripts as each application moves.
Our team can help you plan and run the migration.
Start managing certificates, then add secrets, privileged access, KMS, or agent access.
Add products when you need them, on the platform you already run.
- OpenAI: API, Codex
- Let's Encrypt
- Vercel
- Gemini CLI
- Apache Airflow
- Spring Boot
- OpenCode
- DigiCert
- Jenkins
- Terraform: Terraform, Terraform Cloud
- Render
- Azure: Key Vault, App Configuration, DevOps, Entra ID, CLI
- NetScaler
- Databricks
- KMIP
- GoDaddy
- Pulumi
- Okta
- Ansible
- Cloudflare: Workers, Pages, Custom certificates
- Sectigo
- Laravel
- Hermes
- SAP HANA
- ClickHouse
- OpenRouter
- Supabase
- Docker
- Snowflake
- Venafi
- Rails
- Humanitec
- Tailscale
- 1Password
- OpenClaw
- Cassandra
- Northflank
- Redis
- Datadog
- Google Cloud: Secret Manager, Certificate Manager, IAM, KMS
- Dell PowerEdge
- Bitbucket
- Claude Code
- Railway
- dbt Cloud
- Windows Server
- Chef
- .NET
- PostgreSQL
- AWS: Secrets Manager, Parameter Store, Certificate Manager, Elastic Load Balancing, Private CA, IAM, KMS, CloudHSM, ECS, Amplify
- Linux servers
- Auth0
- Oracle: Oracle Database, OCI Vault
- Octopus Deploy
- Fly.io
- MySQL
- F5 BIG-IP
- LDAP
- TeamCity
- Qovery
- Nutanix Prism Central
- Microsoft: Active Directory, AD CS
- Windmill
- LiteLLM
- Netlify
- RabbitMQ
- Spacelift
- Kubernetes
- CircleCI
- GitLab
- SQL Server
- Stripe
- DigitalOcean
- GitHub: GitHub, GitHub Actions
- Couchbase
- MongoDB: MongoDB, MongoDB Atlas
- Heroku
- SSH
- Salesforce
- HashiCorp Vault
- Travis CI
- Kemp LoadMaster
- Next.js
- Django
- Sigstore Cosign
- Elasticsearch
- Certificate ManagementToday
- Secrets ManagementWhen you need it
- Privileged Access ManagementWhen you need it
- KMSWhen you need it
- Agent VaultWhen you need it
Talk to our team
Starting with Infisical is simple, fast, and free.
- SOC 2, HIPAA, and FIPS 140-3 compliant
- Open source, in our cloud or yours
Talk to your boss
Need a yes from your boss?
Here's a message to send your manager. Edit it, then paste it into Slack, Teams, or an email.
Trusted by teams at
