Comparison

CertLocker vs AWS ACM

AWS Certificate Manager is deeply integrated with AWS services. CertLocker is for teams that also need host-level delivery, hybrid infrastructure, endpoint verification, secrets, SSH access, and audit outside AWS-managed TLS.

Use AWS ACM when...

  • ‣ All your services run inside AWS (ELB, CloudFront, API Gateway)
  • ‣ You don't need certs on EC2 instances, on-prem, or other clouds
  • ‣ You want zero-cost certificate management within the AWS ecosystem
  • ‣ ACM-managed certs on load balancers are sufficient

Use CertLocker when...

  • ✓ You have infrastructure outside AWS (on-prem, GCP, Azure, bare metal)
  • ✓ You need certs on EC2 directly (ACM can't deliver private keys to EC2)
  • ✓ You run HAProxy, Nginx, OpenVPN, MT4, or other non-AWS-managed services
  • ✓ You need internal CA support alongside public certs
  • ✓ SSH access management alongside cert management

Feature comparison

Feature CertLocker AWS ACM
Works on AWS ✓ ✓
Works on GCP / Azure ✓ ✗
Works on-premises ✓ ✗
Works on bare metal ✓ ✗
EC2 instance cert delivery ✓ (private key access) ✗ (ACM hides private keys)
HAProxy / Nginx / OpenVPN support ✓ Native ✗
MT4/MT5 support ✓ ✗
Internal CA support ✓ ✓ (ACM PCA, extra cost)
SSH access management ✓ ✗
Audit trail ✓ ✓ (via CloudTrail)
Certificate-scoped access keys ✓ ✗
Cost TBD ✓ Free for public certs; PCA is ~$400/mo

ACM's key limitation: no private key access

ACM's security model intentionally hides private keys from you — which is fine for load balancers it manages directly (ALB, NLB, CloudFront), but breaks down the moment you need a cert on anything else.

If you need TLS on an EC2 instance running Nginx directly (not behind a load balancer), ACM can't help you. Same for on-premise servers, VMs in other clouds, or any service that needs to hold its own private key.

CertLocker delivers certificate material to approved targets with scoped tokens so only the right machine can access it. That model fits infrastructure that lives outside AWS-managed services, and it keeps the delivery and access trail in one place.

Trust control that works beyond AWS

Use ACM where it fits, then use CertLocker for the hosts, services, secrets, probes, and access workflows AWS does not cover.