CMDashCybersecurity Maturity Dashboard

← All landscape areas

Identity & Access · Core

PKI & Certificate Management

Issues and manages cryptographic certificates.

10 options listedTypical cost: $10k-$200k/yrPROTECT (PR)

Overview

PKI platforms issue, renew, and govern the certificates and keys that secure TLS, code signing, and device identity. Certificate-lifecycle automation prevents outages and rogue certs at scale. Public CA costs differ from internal CA and machine-identity governance. Crypto-agility for post-quantum migration is a rising driver.

Underpins TLS, code signing, and device identity; prevents cert outages.

Advantages

DigiCert/Sectigo trusted public CAs
Venafi/EJBCA strong machine-identity governance
Let's Encrypt free
lifecycle automation prevents outages.

Trade-offs

Venafi enterprise pricing
internal PKI needs real expertise
certificate sprawl is hard to inventory
post-quantum migration looms.

Vendors & tools in this area

DigiCertCommercial

Public CA + certificate lifecycle automation.

CyberArk (Venafi)Commercial

PAM gold standard; deep but complex; also machine identity.

SectigoCommercial

Public CA + CLM; cost-competitive.

EntrustCommercial

PKI, HSM and identity; certificate + crypto.

AWS PCACommercial

AWS Private Certificate Authority.

EJBCAOpen source

Enterprise open-source PKI/CA.

step-caOpen source

Smallstep online CA / ACME.

Let's EncryptOpen source

Free public CA (ACME).

Keyfactor CommandCommercial

Certificate lifecycle automation + PKI-as-a-Service from the company behind EJBCA.

GlobalSignCommercial

Cloud-based managed PKI and certificate lifecycle management from a longstanding public CA.

Start free trial Browse the full atlas

PKI & Certificate Management — Cybersecurity Landscape Atlas — CMDash