CertForge positioned against 10 CLM and PKI platforms across deployment, lifecycle, governance, security, integrations, compliance, and market fit. Governance-first, self-serve, built for mid-market teams and MSPs.
| CertForge | CyberArk (ex-Venafi) |
DigiCert TLS Mgmt |
Sectigo Cert Mgr |
Keyfactor Command |
GlobalSign Managed PKI |
HID PKI-as-a-Svc |
AppViewX AVX ONE |
Infisical | CertKit certkit.io |
cert-manager / Smallstep OSS |
|
|---|---|---|---|---|---|---|---|---|---|---|---|
| Deployment | |||||||||||
| SaaS / cloud-hosted | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Smallstep paid |
| Self-hosted / on-prem | Yes | Yes | Yes✓ | Limited | Yes | — | — | Yes | Yes | Keys only (Ent.)✓ | Yes |
| Air-gap / offline CA | Yes | Yes | Limited | ? | Yes | — | — | ? | ? | — | Partial |
| Data residency / multi-region | US + EU | Yes | Yes | ? | ? | ? | ? | ? | ? | US only | Self-host |
| MSP / multi-tenant | Yes | Partial✓ | MSP Hub✓ | Partner Platform✓ | Partial | Partial | Partial | Partial | — | Yes✓ | — |
| MSP onboarding & per-customer billing | Yes | Custom / PS | Limited | Yes✓ | ? | ? | ? | ? | — | Sub-accounts✓ | — |
| Certificate Lifecycle | |||||||||||
| Certificate discovery | CT + active + CA import | Yes | Yes | Yes | Yes | Basic | Basic | Yes | — | CT logs, Business+✓ | — |
| Automated renewal | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Closed-loop delivery | Yes | Yes | Sensor + connectors✓ | ACME only | Yes | ACME only | Partial | Yes | SDK only | Yes✓ | K8s only |
| Network device renewal | F5, AudioCodes + | Yes | F5 +✓ | ? | Yes | ? | ? | Yes | ? | F5, Palo Alto, Citrix +✓ | — |
| Multi-CA support | Yes | Yes | Yes✓ | Yes | Yes | Partial | Partial | Yes | Partial | Yes✓ | Yes |
| Built-in private CA | Yes | Via integration | Seat-licensed✓ | Yes | Yes | Yes | Yes | Via integration | Yes | Business+✓ | Smallstep |
| Connect customer's own internal CA | Yes | Yes✓ | MS CA, AWS PCA✓ | ? | Yes | ? | ? | Yes | ? | ADCS sub-CA✓ | Yes |
| ACME endpoint (RFC 8555) | Yes | Yes | Yes | Yes | Yes | Yes | ? | Yes | Yes | ? | Yes |
| DNS CNAME delegation | All plans | Yes | Yes | ? | ? | ? | ? | ? | ? | All plans✓ | Manual config |
| Governance & Approval | |||||||||||
| Human approval workflows | Yes | Policy-based | Yes✓ | Yes✓ | Workflow engine | — | — | Yes | Secrets only | — | Policy only |
| Time-bounded pre-auth grants Unique | Yes✓ | — | — | — | — | — | — | — | — | — | — |
| Change windows | Enterprise | Via policy | — | — | — | — | — | Via workflow | — | — | — |
| Tamper-evident audit trail | Hash-chained | Not advertised | Not advertised | Not advertised | Not advertised | Not advertised | Not advertised | Not advertised | Not advertised | Logs, Business+✓ | — |
| Domain trust policies | Yes | Yes | Yes | ? | Yes | ? | ? | ? | ? | — | — |
| Security | |||||||||||
| AI risk assessment (every request) | Yes | ? | ? | ? | Risk surfacing, preview✓ | ? | ? | Migration risk scoring✓ | ? | —✓ | — |
| AI agent / MCP access | Enterprise | ? | ? | GA Jun 2026✓ | Experimental✓ | ? | ? | Jul 2026✓ | ? | ? | — |
| SSO / OIDC | Enterprise | Yes | Yes | Yes | Yes | ? | ? | Yes | Yes | Business+✓ | Partial |
| SIEM integration | All plans | Yes | Yes | ? | Yes | ? | ? | ? | ? | — | — |
| Integrations | |||||||||||
| cert-manager / Kubernetes | External issuer | Yes | ACME only✓ | Partial | Yes | ACME only | — | Yes | Partial | TLS secret sync✓ | Native |
| Open-source connectors Unique | Discovery, device, issuer, AKV — Apache 2.0 | Proprietary agents | Proprietary sensors | Proprietary | Proprietary agents | — | — | Proprietary | — | — | OSS (K8s only) |
| Azure Key Vault delivery | Yes | Yes | ? | ? | Yes | ? | ? | Yes | ? | — | — |
| ITSM (ServiceNow / Jira) | Roadmap | Yes | ServiceNow✓ | Limited | Yes | — | — | Yes | — | — | — |
| Compliance & Reporting | |||||||||||
| Framework reports (SOC 2, ISO, PCI, HIPAA) | Pro+ | Yes | Yes | Yes | Yes | Yes | Yes | Yes | — | — | — |
| Export / data pack | Pro+ | Yes | Yes | Yes | Yes | ? | ? | Yes | Limited | Limited | — |
| Expiry alerts & dashboards | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Basic | Yes | Metrics only |
| Market Position | |||||||||||
| Starting price | $179/mo | Quote (est. $100k+/yr) | Quote (est. $50k+/yr) | Quote | Quote (est. $100k+/yr) | Quote | Quote | Quote | Published | $99/mo✓ | Free (OSS) |
| Free tier | 10 certs, 1 domain | — | — | — | — | — | — | — | Yes | 2 certs, non-commercial✓ | OSS |
| Procurement model | Self-serve | Sales-led | Sales-led | Sales-led | Sales-led | Sales-led | Sales-led | Sales-led | Self-serve | Self-serve✓ | Self-serve |
| Time to value | Minutes | Months | Weeks–months | ? | Months | ? | ? | ? | ? | Minutes | Hours |
| Primary target | Mid-market & MSPs | Fortune 500 | Enterprise | Mid-market | Federal / regulated | Enterprise PKI | Identity-centric | Network-heavy F500 | Developer teams | IT teams & MSPs | DevOps / K8s |