Self-Hosted Certificate Tools vs Vaults for SSH Access
A vault can store secrets. A certificate tool can issue certs. An SSH access platform can broker sessions. The awkward part is that production often needs all three at once.
HashiCorp Vault, Smallstep, JumpServer, Infisical, and similar tools each solve a real part of the problem. The question is whether your team wants separate systems or one operational workflow for certs, secrets, access, and proof.
How the tool categories split
Operational coverage by category
Strong storage and policy; often needs extra delivery and endpoint proof.
Strong issuance and renewal; less focused on human access.
Strong access brokering; not usually certificate lifecycle systems.
Best fit when certs, secrets, host access, and audit need one trail.
Where vaults are strong
Vaults are good at protected storage, policy, dynamic credentials, and internal PKI when the team can operate them properly. HashiCorp Vault is still a serious tool when you have the people to run it.
The gap usually appears around delivery and proof. A stored value is not the same as HAProxy serving the renewed certificate, IIS using the right binding, or a contractor SSH session expiring cleanly.
Where certificate tools are strong
Certificate-focused tools like Smallstep, Certify The Web, TrackSSL, and enterprise CLM platforms have useful depth around issuance, renewal, monitoring, or private CA workflows.
They are less useful when the operational question crosses into secrets, access tokens, RDP, SSH, groups, agent credentials, and audit evidence.
The CertLocker angle
CertLocker is built for the team that has TLS, private keys, API secrets, SSH/RDP access, ACME clients, endpoint probes, and audit questions in the same week.
It is not trying to be a generic GRC platform. It is trying to make the production trust workflow easier to run and easier to prove.
Choose by the workflow you actually need
- ✓ Need only encrypted storage and dynamic credentials? Evaluate a vault.
- ✓ Need SSH certificates and private CA depth? Evaluate Smallstep-style tooling.
- ✓ Need Windows/IIS certificate automation? Look at Certify The Web and compare delivery needs.
- ✓ Need live SSL monitoring only? TrackSSL-style tooling may be enough.
- ✓ Need certificates, secrets, scoped tokens, SSH/RDP, probes, and audit in one place? Evaluate CertLocker.
Related reading and workflows
CertLocker vs HashiCorp Vault
A practical comparison for teams using Vault around certificates and secrets.
Secrets management vs certificate management
Where the categories overlap and where they do not.
SSH access management
Short-lived SSH access, browser sessions, 2FA, groups, and audit.
Zero-trust SSH use case
A practical model for replacing long-lived PEM files.
Short-lived SSH access with 2FA
How CertLocker handles scoped server access and audit trails.
Help with onboarding
Bring your existing inventory to a hosted walkthrough with the CertLocker engineers.
CertLocker for DevOps teams
The broader trust-control workflow for platform and infrastructure teams.
Compare CertLocker with scripts
Where spreadsheets, cron jobs, and shared files stop being enough.
Try the workflow against real infrastructure
Use the hosted evaluation at trust.certlocker.io for a walkthrough, or run a one-month onsite evaluation against your own certificates, hosts, secrets, and access paths.