Comparison

AWS ACM alternative for hybrid and multi-cloud estates

AWS Certificate Manager is deeply integrated with AWS services. CertLocker is for teams that also need host-level delivery, hybrid infrastructure, endpoint verification, secrets, SSH access, and audit outside AWS-managed TLS.

Use AWS ACM when...

‣ All your services run inside AWS (ELB, CloudFront, API Gateway)
‣ You can manage host deployment separately when using exportable certificates
‣ You want zero-cost certificate management within the AWS ecosystem
‣ ACM-managed certs on load balancers are sufficient

Use CertLocker when...

✓ You have infrastructure outside AWS (on-prem, GCP, Azure, bare metal)
✓ You want scoped host delivery and activation alongside certificate renewal
✓ You run HAProxy, Nginx, OpenVPN, MT4, or other non-AWS-managed services
✓ You need internal CA support alongside public certs
✓ SSH access management alongside cert management

Feature comparison

Feature	CertLocker	AWS ACM
AWS-managed TLS (ALB, CloudFront, API Gateway)	⚠ Alongside	✓ Native
GCP / Azure / OpenStack host workflows	✓ Import and delivery	Exportable certs; you manage host deployment
On-premises / bare metal	✓ First-class	⚠ Only via exportable certs
Private key for host install	✓ Scoped token delivery	⚠ Exportable public certs (opt-in, paid) or Private CA export
ACME client across public issuers	✓ Built-in catalogue	✗
ACME delivery to HAProxy / Nginx / win-acme	✓ Gateway	✗
Endpoint TLS probes	✓	✗
Secrets management with version history	✓	✗
Just-in-time SSH / RDP / VNC	✓	✗
Cloud host import including EC2	✓	✗
Internal / private CA path	⚠ Upload, self-signed, CertLocker profiles	✓ ACM Private CA (extra cost)
Audit trail	✓ Built-in export	✓ CloudTrail
Pricing	Hosted onboarding; services scoped by agreement	Free for non-export public; export and PCA priced

ACM is strongest inside AWS-managed TLS

ACM remains the natural choice when TLS terminates on AWS-managed services such as ALB, NLB, CloudFront, and API Gateway. Private keys stay inside the AWS service boundary, renewal is automatic, and cost for standard public certificates is hard to beat.

The AWS exportable certificate documentation explains the host deployment path: Private CA certificates can be exported, and newer public certificates can be requested as exportable (opt-in at issuance, with separate pricing). That helps EC2 and some hybrid installs, but it is still an AWS-issued, AWS-priced path — not a multi-issuer ACME control plane, and not a host/secrets/access workflow.

CertLocker fits when certificates, secrets, probes, and just-in-time access need to span HAProxy, Nginx, Windows, OpenStack, Azure, GCP, and bare metal under one inventory, RBAC model, and audit trail. Use ACM where AWS-managed TLS is enough; use CertLocker for the operational layer outside that perimeter.

Trust control that works beyond AWS

Use ACM where it fits, then use CertLocker for the hosts, services, secrets, probes, and access workflows AWS does not cover.

Services & access