Infisical vs. Sectigo Certificate Manager
Sectigo Certificate Manager automates certificates through agents and connectors you run in your network. Infisical automates every certificate out of the box, with no agent on the target.
The SCM way
Agents, connectors, approvals, and validations to keep running.
- Add Department
- Domain Control Validation
- Understanding network agents
- Network Discovery Task
- Approve auto-install for api.example.com: Waiting on an SCM admin
- Network Agent Disconnected: No discovery or installs on this network until it reconnects.
- Sectigo Connector for F5 BIG-IP
- iis-01
- api-01.dc1.internal: Certificate expired
- Sam, platform team: Is there an agent for the Kubernetes clusters, or do we set up cert-manager with EAB keys too?
The Infisical way
Every certificate in one place, renewed and installed automatically.
What's the difference between Infisical and Sectigo Certificate Manager?
Sectigo Certificate Manager is a capable hosted certificate platform, but requires installing and maintaining agents, gateways, and connectors. Infisical works out of the box for your entire infrastructure.
Evaluate
Infisical- Try the free tier with an internal CA, ACME automation, and the certificate dashboard
- Self-host the MIT-licensed open-source version
Sectigo Certificate Manager- Start an SCM Pro trial, then talk to sales for Enterprise
- Can't audit or self-host the code
Deploy/integrate
Infisical- Use managed cloud in EU or US regions
- Self-host on Docker, Kubernetes, Linux, AWS ECS, or Google GKE
- Use a gateway to reach private networks
Sectigo Certificate Manager- Install network agents, Microsoft agents, and gateways in your network
- Set up organizations, departments, and domain validation before issuing
Migrate/onboard
Infisical- Connect the CAs you already use, Sectigo included
- Discover every certificate on your infrastructure, from any CA
Sectigo Certificate Manager- Add separate connectors or agents for each kind of target
Operate
Infisical- Manage every certificate (on any infrastructure) in one dashboard
- Renew, revoke, or reissue from the dashboard or API
Sectigo Certificate Manager- Approve agent install requests one by one
- Keep agents connected, or discovery and installs stop
Automate
Infisical- Renew automatically and sync certificates to 13+ destinations, with no agent on the target
- Get a Slack, email, PagerDuty, or webhook alert before expiries
Sectigo Certificate Manager- Install certificates through agents and per-target connectors
Scale
Infisical- Add secrets, privileged access, AI agent security, or KMS on the same platform
Sectigo Certificate Manager- Buy separate products for secrets, PAM, or other security infrastructure
Infisical vs. Sectigo Certificate Manager at a glance
Sectigo Certificate Manager covers the certificate lifecycle with agents and connectors in your network. Infisical covers it out of the box.
| Feature |  | Sectigo Certificate Manager |
|---|---|---|
| Open sourceWhether the source code is public, so your team can review exactly what runs. | MIT-licensed, 29,000+ GitHub stars | |
| Self-hostingRunning the product on your own infrastructure instead of the vendor's cloud. | Docker, Kubernetes, Linux, AWS ECS, or Google GKE | |
| Managed cloudA version the vendor hosts and operates for you. | US and EU regions | |
| Products neededHow many separate products it takes to cover issuance, lifecycle management, and code signing. | Infisical Certificate Management | Sectigo Certificate Manager |
| Components to runThe servers, agents, and connectors your team deploys and keeps up to date. | One platform, plus a gateway | Network agents, Microsoft agents, gateways, and connectors |
| Product scopeWhat Infisical and Sectigo Certificate Manager cover beyond certificate management. | Certificates, secrets, privileged access, AI agents, and KMS | Certificates |
| Private CA hierarchy | Built in, optionally with keys in your own HSM | Sectigo Private PKI, a hosted service |
| External and public CAs | ||
| Code signing | Built in, with signing approvals and signtool, jarsigner, and cosign support | Issues and manages code signing certificates |
| ACMEHow tools like certbot and cert-manager request and renew certificates automatically. | ||
| ESTA protocol devices and servers use to enroll for certificates securely, common in network equipment and IoT. | ||
| SCEPAn older enrollment protocol used by device management tools like Microsoft Intune and Jamf. | ||
| APIRequesting certificates directly from your own code or scripts. | ||
| Certificate discoveryScanning your networks to find certificates in use, including ones you didn't know about. | Finds every certificate on your infrastructure, from any CA | Internal hosts need a network agent |
| InventoryA single list of every certificate, where it's used, and when it expires. | ||
| Automatic renewalReplacing certificates before they expire, without manual steps. | No agent on the target | Through agents/connectors |
| Expiry alertsNotifications before a certificate expires, so it gets renewed in time. | Slack, PagerDuty, email, or webhooks | Email, Slack, Teams, or webhooks |
| Certificate syncsInstalling certificates automatically on the load balancers, servers, and cloud services that use them. | 13+ destinations, no agent on the target | Agents and per-target connectors |
| Access controlRules for who can read or change which secrets and certificates. | ||
| SAML SSOSigning in through your company's identity provider, like Okta or Microsoft Entra ID. | ||
| Audit logsA record of who did what, kept for security reviews and compliance. | ||
| Pricing modelWhat the price is based on. | Quote-based subscription or free tier | SCM Pro subscription tiers. SCM Enterprise by quote |
| Free tierWhat you can use without paying. | An internal CA, ACME, and the certificate dashboard | 30-day trial only |
Frequently asked questions
Everything you need to know. Can't find an answer? Talk to our team.
Yes. Infisical runs its own CAs, issues from public and enterprise CAs, discovers certificates on your network, renews them, and installs them where they're served, with no agent on the target. Sectigo Certificate Manager covers the same lifecycle, but reaches your network through agents, gateways, and connectors you install and keep running.
Yes, for anything inside your network. Discovering internal hosts and installing certificates on them takes a Sectigo network agent on each network, plus Microsoft agents, gateways, or connectors for specific targets. If an agent disconnects, discovery and installs on that network stop. Infisical installs certificates on 13+ kinds of targets with no agent, and reaches private networks through one gateway.
Sectigo runs Sectigo Certificate Manager as a hosted service. It is not open-source and only its agents, gateways, and connectors run in your network. Infisical can be self-hosted on Docker, Kubernetes, Linux, AWS ECS, or Google GKE, or used as Infisical Cloud.
SCM Pro has self-serve subscription tiers, and SCM Enterprise is sold by quote. The real cost is often in running it: the engineering effort of keeping agents and gateways in every network, a connector per kind of target, organization and domain validation setup, and approving installs. Infisical works out of the box, has a free tier, and offers an MIT-licensed open-source version.
Yes. Infisical issues Sectigo certificates through Sectigo's ACME endpoint with external account binding, alongside your other CAs, so changing how you manage certificates doesn't mean changing where you buy them.
How to migrate from Sectigo Certificate Manager to Infisical
Most teams keep their certificates flowing while they move management to Infisical, one application at a time.
- 01
Connect your CAs
Connect CAs you issue from, including Sectigo over ACME, or create Infisical's own.
- 02
Discover certificates
Run discovery to find every certificate on your infrastructure.
- 03
Move one application
Manage its certificates in Infisical, and sync them to wherever they're served.
- 04
Retire SCM
Remove SCM agents and connectors as each application moves.
Our team can help you plan and run the migration.
Start managing certificates, then add secrets, privileged access, KMS, or agent access.
Add products when you need them, on the platform you already run.
- OpenAI: API, Codex
- Let's Encrypt
- Vercel
- Gemini CLI
- Apache Airflow
- Spring Boot
- OpenCode
- DigiCert
- Jenkins
- Terraform: Terraform, Terraform Cloud
- Render
- Azure: Key Vault, App Configuration, DevOps, Entra ID, CLI
- NetScaler
- Databricks
- KMIP
- GoDaddy
- Pulumi
- Okta
- Ansible
- Cloudflare: Workers, Pages, Custom certificates
- Sectigo
- Laravel
- Hermes
- SAP HANA
- ClickHouse
- OpenRouter
- Supabase
- Docker
- Snowflake
- Venafi
- Rails
- Humanitec
- Tailscale
- 1Password
- OpenClaw
- Cassandra
- Northflank
- Redis
- Datadog
- Google Cloud: Secret Manager, Certificate Manager, IAM, KMS
- Dell PowerEdge
- Bitbucket
- Claude Code
- Railway
- dbt Cloud
- Windows Server
- Chef
- .NET
- PostgreSQL
- AWS: Secrets Manager, Parameter Store, Certificate Manager, Elastic Load Balancing, Private CA, IAM, KMS, CloudHSM, ECS, Amplify
- Linux servers
- Auth0
- Oracle: Oracle Database, OCI Vault
- Octopus Deploy
- Fly.io
- MySQL
- F5 BIG-IP
- LDAP
- TeamCity
- Qovery
- Nutanix Prism Central
- Microsoft: Active Directory, AD CS
- Windmill
- LiteLLM
- Netlify
- RabbitMQ
- Spacelift
- Kubernetes
- CircleCI
- GitLab
- SQL Server
- Stripe
- DigitalOcean
- GitHub: GitHub, GitHub Actions
- Couchbase
- MongoDB: MongoDB, MongoDB Atlas
- Heroku
- SSH
- Salesforce
- HashiCorp Vault
- Travis CI
- Kemp LoadMaster
- Next.js
- Django
- Sigstore Cosign
- Elasticsearch
- Certificate ManagementToday
- Secrets ManagementWhen you need it
- Privileged Access ManagementWhen you need it
- KMSWhen you need it
- Agent VaultWhen you need it
Talk to our team
Starting with Infisical is simple, fast, and free.
- SOC 2, HIPAA, and FIPS 140-3 compliant
- Open source, in our cloud or yours
Talk to your boss
Need a yes from your boss?
Here's a message to send your manager. Edit it, then paste it into Slack, Teams, or an email.
Trusted by teams at
