Comparison
AWS Secrets Manager is built for AWS-native infrastructure. CertLocker is built for bare metal, VMs, OpenStack, and hybrid environments. They serve different deployment models.
AWS Secrets Manager is a managed secrets store designed for AWS-native workloads. It integrates deeply with IAM, RDS, Lambda rotation functions, and other AWS services. It can store credentials used outside AWS, but it does not manage TLS certificate lifecycle, just-in-time host access, or endpoint monitoring as first-class workflows. CertLocker manages TLS certificates, secrets with full version history, just-in-time SSH/RDP access, and endpoint probes across bare metal, VMs, and hybrid infrastructure.
| Capability | CertLocker | AWS Secrets Manager |
|---|---|---|
| Secrets storage and retrieval | ✓ | ✓ |
| Secret version history and restore | ✓ Full history | ⚠ Up to 100 versions |
| One-time secret sharing | ✓ | ✗ |
| Private (user-scoped) secrets | ✓ | ✗ |
| Automated rotation for AWS DBs / SaaS | ✗ | ✓ Managed and Lambda |
| TLS certificate lifecycle | ✓ Built-in | ✗ Use ACM |
| ACME automation and delivery | ✓ | ✗ |
| Just-in-time SSH / bastion access | ✓ | ✗ (can store SSH key material only) |
| Endpoint TLS probes | ✓ | ✗ |
| Cloud host import | ✓ Multi-cloud | ✗ |
| Works outside AWS | ✓ First-class | ⚠ API-reachable; AWS-centric IAM |
| AWS IAM / RDS / Lambda native | ✗ | ✓ |
| RBAC and audit trails | ✓ Built-in export | ✓ IAM and CloudTrail |
| Pricing model | Hosted onboarding; services scoped by agreement | Per-secret + API calls |
AWS Secrets Manager is excellent at what it does: managing secrets for AWS-native workloads with automated rotation tied to AWS services. If your entire stack is on AWS and you are using RDS, Lambda, and ECS, it is a natural fit.
The limitation is scope. AWS Secrets Manager does not manage TLS certificate lifecycle — that is ACM's job, which is strongest on AWS-managed services. It can store SSH key material, but it does not provide just-in-time host access, bastion workflows, or endpoint probes. Version history is capped (up to 100 versions per secret), and the operating model remains AWS IAM-centric.
CertLocker is designed for teams running outside the AWS perimeter - bare metal racks, OpenStack clusters, colocation, or hybrid environments with both cloud and physical infrastructure. It combines secrets, TLS certificate lifecycle, SSH access, and endpoint monitoring because those problems are deeply related for infrastructure teams, and solving them separately means maintaining multiple tools with separate audit trails.
Related: CertLocker vs AWS ACM · CertLocker for bare metal infrastructure
AWS Secrets Manager is a cloud-native secrets store tightly integrated with the AWS ecosystem. CertLocker adds TLS certificate lifecycle, ACME automation, SSH access management, and endpoint monitoring alongside secrets - for teams on bare metal, VMs, or hybrid infrastructure.
Not for AWS-native workloads. For teams running on bare metal or hybrid infrastructure alongside AWS, CertLocker handles the non-AWS layer while AWS Secrets Manager handles the AWS-native layer. They can coexist.
Secret version history records every change to a secret's value - who changed it, what the previous value was, and when. This is required by SOC 2, PCI-DSS, and internal audit programmes that need to answer "what was the database credential on this date." AWS Secrets Manager retains a limited number of previous versions; CertLocker keeps full history.
Certificates, secrets, SSH access, and endpoint monitoring for bare metal and hybrid infrastructure teams.
Services & accessSee eight certificate management alternatives and when each fits, or read the detailed tool comparisons.