What is Venafi called now?

Venafi was acquired by CyberArk in 2024 and became CyberArk Certificate Manager. Palo Alto Networks then bought CyberArk in 2026. Palo Alto now calls the SaaS version Next-Gen Trust Security. The self-hosted version is Certificate Manager, Self-Hosted. Palo Alto Networks hasn't published a detailed roadmap for Venafi's products.

What does the Palo Alto Networks acquisition mean for Venafi customers?

Roadmap, packaging, and pricing now follow Palo Alto Networks. Palo Alto says the self-hosted products keep receiving investment. Many teams use a change of ownership as the moment to review their options.

Does self-hosted Venafi need Windows Server and SQL Server?

Yes. Self-hosted Venafi exclusively runs on Windows Server with IIS and Microsoft SQL Server, usually as a cluster of servers sharing one database. Infisical self-hosts on Docker, Kubernetes, Linux, AWS ECS, or Google GKE, with PostgreSQL and Redis.

How much does Venafi cost?

Venafi is sold by quote, and self-hosted licensing counts certificates by the application instances that use them. The real cost is often in running it: a Windows and SQL Server cluster, implementation with outside help, upgrades, and PowerShell drivers for targets the library doesn't cover. Infisical works out of the box, has a free tier, and offers an MIT-licensed open-source version.

Can I move off Venafi gradually?

Yes. Infisical can issue certificates through a self-hosted Venafi instance, through a gateway, or have Venafi sign an Infisical intermediate CA. Teams move one application at a time while Venafi keeps issuing, then switch to Infisical's own CAs.

Infisical vs. Venafi

Looking for a Venafi alternative? Infisical automates certificate lifecycles for your entire infrastructure out of the box, and can issue through Venafi while you move.

Start with Infisical Talk to an expert

MonitorAPP 2:00 AM
Certificate expired: api.example.com on bigip.internal.
Me
You 2:03 AM
Sorry for the 2 AM call. The renewal never got pushed to the F5. The driver's been failing since last week's upgrade.
YM
Your manager 2:04 AM
Didn't we open a ticket with Venafi for that?
Me
You 2:05 AM
Yeah, still waiting. Support said 24 hours.
YM
Your manager 2:07 AM
ok renew it in the console, export it, and put it on the F5 by hand. and roll back the driver script on all three servers lol
Me
You 4:48 AM
Done. Also got an email saying we're Palo Alto customers now.

The Venafi way

Manually manage policy folders, drivers, upgrades, licenses, and a ticket queue.

New Policy Folder

Path

CA template

Save

tpp-01

Next: copy the same script to tpp-02 and tpp-03

CHG-5120Patch Windows and SQL Server on the Venafi clusterNeeds a maintenance window

VenafiLicense usage reportCounted per certificate and per application instance.

bigip.internalProvisioning failed

Venafi docsAdaptable Application driver PowerShell reference

CyberArk Certificate Manager is now Next-Gen Trust SecurityContact your account team about your self-hosted roadmap.Learn more

Sat02Venafi upgrade windowEvery cluster server and the database

SSam, platform teamAny update from Venafi support on the F5 push? Their ticket says 24 hours.

The Infisical way

Every certificate in one place, renewed and pushed automatically.

What's the difference between Infisical and Venafi?

Venafi (now CyberArk Certificate Manager) is a capable enterprise certificate platform, but requires Windows Server/SQL infrastructure, specialists, and custom work to run. Infisical automates certificate lifecycles on your entire infrastructure.

Evaluate
Infisical
- Try the free tier with an internal CA, ACME automation, and the certificate dashboard
- Self-host the MIT-licensed open-source version
Venafi
- Get a quote, then plan the implementation with professional services
- Evaluate the roadmap and long-term reliability after two acquisitions in two years
Deploy/integrate
Infisical
- Use managed cloud in EU or US regions
- Self-host on Docker, Kubernetes, Linux, AWS ECS, or Google GKE
- Use a gateway to reach private networks
Venafi
- Self-host a cluster on Windows Server, IIS, and SQL Server
- Run a VSatellite in your network for the SaaS version
Migrate/onboard
Infisical
- Issue through Venafi while you move to cause no migration outages
- Discover every certificate on your network, whoever issued it
Venafi
- Build a full policy tree before issuing your first certificate
- Hire professional services or specialized engineers to implement it
Operate
Infisical
- Manage every certificate in one dashboard, no matter who issued it
- Renew, revoke, or reissue from the dashboard or API
Venafi
- Work through policy folders and application objects for each certificate
- Wait on a ticket queue when a push fails
Automate
Infisical
- Renew certificates automatically, with no agent on the target
- Get a Slack, email, PagerDuty, or webhook alert before expiries
- Sync certificates to 13+ destinations, including F5 and NetScaler
Venafi
- Write PowerShell drivers for targets the library doesn't cover
- Keep driver scripts identical on every server in the cluster
Scale
Infisical
- Add secrets, privileged access, AI agent security, or KMS on the same platform
Venafi
- Monitor how acquisitions affect product development

Infisical vs. Venafi at a glance

Venafi covers the full certificate lifecycle if you have the infrastructure, drivers, and specialists to run it. Infisical automates certificate management out of the box.

Infisical vs. Venafi feature comparison
Feature		Venafi

Open source	MIT-licensed, 29,000+ GitHub stars	Proprietary
Self-hosting	Docker, Kubernetes, Linux, AWS ECS, or Google GKE	Windows Server, IIS, and SQL Server
Managed cloud	US and EU regions	SaaS, with a VSatellite in your network
Components to run	One platform, plus a gateway	A Windows cluster, SQL Server, and PowerShell drivers
Product scope	Certificates, secrets, privileged access, AI agents, and KMS	Certificates. Code signing and secrets are separate products in CyberArk

Private CA hierarchy	Yes	Yes
External and public CAs	Public, private, and Venafi itself, in one inventory	Yes

ACME	Yes	Yes
EST	Yes	Yes
SCEP	Yes	Yes
API	Yes	Yes

Certificate discovery	Yes	Yes
Inventory	Yes	Yes
Automatic renewal	No agent on the target	Through drivers or self-maintained PowerShell scripts
Expiry alerts	Slack, PagerDuty, email, or webhooks	Email, PagerDuty, or webhooks
Certificate syncs	13+ destinations, no agent on the target	A driver library, plus PowerShell drivers you write

Access control	Yes	Yes
SAML SSO	Yes	Yes
Audit logs	Yes	Yes

Frequently asked questions

Everything you need to know. Can't find an answer? Talk to our team.

Yes. Infisical runs its own CAs and can issue from public and enterprise CAs (including Venafi). It discovers certificates on your network, renews them, and pushes them to where they're served. Venafi covers the same lifecycle, but requires a Windows and SQL Server cluster or an in-network VSatellite. Most organizations also need implementation help, custom PowerShell drivers, and/or a dedicated PKI team with specialized engineers.

How to migrate from Venafi to Infisical

Infisical can issue through Venafi while you move, so most teams switch one application at a time.

01
Connect Venafi
Connect self-hosted Venafi through a gateway, or have Venafi's SaaS sign an Infisical intermediate CA.
02
Discover certificates
Run discovery across your networks to see what's deployed and when it expires.
03
Move one application
Point an application's ACME, EST, or SCEP client at Infisical, and sync its certificates to where they're served.
04
Switch CAs
Issue from Infisical's own CAs or the public CAs you already use as each application moves.
05
Retire Venafi
Once nothing renews through Venafi, decommission it.