What is the difference between CertLocker and HashiCorp Vault?

Vault is a general-purpose secrets platform with a configurable PKI engine and (since Vault 1.14) ACME server support. CertLocker is purpose-built for certificate operations, ACME client and delivery workflows, secrets with version history, just-in-time host access, endpoint probes, and audit evidence as first-class features. Vault typically needs a dedicated platform team; CertLocker is designed for smaller infrastructure teams.

When should I use HashiCorp Vault instead of CertLocker?

Use Vault when you already run it for secrets management and want to consolidate PKI on the same platform, when you need Vault's broader secrets capabilities, or when you have a dedicated team to operate the Vault cluster. Enterprise Vault features such as HSM integration and DR replication are not available in CertLocker.

Can CertLocker replace Vault for certificate management?

CertLocker can replace Vault for teams that use Vault primarily for certificate inventory, public-CA ACME issuance, and delivery to HAProxy or win-acme. For teams that use Vault as a full secrets platform or internal CA at scale, CertLocker can complement rather than replace it.

Comparison

HashiCorp Vault alternative for certificate management

Vault is capable secrets infrastructure. CertLocker is focused on operational workflows: certificates, ACME delivery, secrets, just-in-time host access, endpoint verification, and audit evidence.

Use Vault when...

‣ You already run Vault for secrets management and want to consolidate
‣ You have a dedicated platform team to operate and maintain the Vault cluster
‣ You need Vault's broader secrets management capabilities alongside PKI
‣ Enterprise Vault features (HSM, DR replication) are required

Use CertLocker when...

✓ You want cert and secrets workflows without operating a Vault cluster
✓ You need public-CA ACME issuance plus Gateway delivery to HAProxy / win-acme
✓ Just-in-time SSH, probes, and audit belong with certificate operations
✓ Smaller team without dedicated Vault expertise to maintain the cluster

Feature comparison

Feature	CertLocker	HashiCorp Vault
Certificate inventory and lifecycle	✓ First-class	⚠ Via PKI engine + configuration
Internal CA / PKI issuer	⚠ Self-signed and CertLocker ACME profiles	✓ PKI secrets engine
ACME client to public CAs (Let's Encrypt, ZeroSSL, …)	✓ Built-in issuer catalogue	✗ Not an ACME client
ACME server for HAProxy, win-acme, and clients	✓ CertLocker Gateway	✓ PKI ACME (Vault 1.14+)
Secrets with version history and restore	✓ Built-in	✓ KV versions
One-time secret sharing and private secrets	✓	⚠ Build with policies / tools
Just-in-time SSH / bastion access	✓ Browser terminal and tokens	✓ SSH secrets engine
Browser RDP / VNC	✓ Guacamole-backed	✗
Endpoint TLS probes	✓ Built-in	✗
Cloud host import (AWS, Azure, GCP, OpenStack)	✓	✗
AI agents / MCP scoped tokens	✓	✗
PQ Ready inventory (ML-DSA / MTC)	✓	⚠ Depends on configuration
Self-hosted / in-house deploy	✓	✓
Managed SaaS	✓	✓ HCP Vault
Operational complexity	Low	High — cluster management required
Pricing	Hosted onboarding; services scoped by agreement	OSS / Enterprise / HCP
Audit evidence	✓ CSV and JSONL export	✓

The real cost: operational overhead

Vault is a serious piece of infrastructure. A production Vault cluster requires HA setup, storage backend (etcd, Consul, or integrated raft), unsealing strategy, DR replication, and ongoing maintenance. That's before you've written a single certificate policy.

For teams that already run Vault for secrets management, adding PKI makes sense - the operational cost is already paid. For teams that only need certificate management, adopting Vault means paying the full operational cost for one use case.

CertLocker is purpose-built for certificate operations, operational secrets, scoped access, and SSH workflows. It does not try to replace every Vault use case. That focus means faster setup for public-CA ACME issuance, inventory, probes, and access work — with less cluster overhead than running Vault for one job. Vault PKI can also speak ACME as an internal CA; CertLocker adds the multi-issuer ACME client, Gateway delivery, endpoint verification, and just-in-time host access under one operational model.

Further reading: How to replace HashiCorp Vault for certificate management

Use Vault when you need Vault. Use CertLocker when the job is certs, secrets, and access.

Bring certificate delivery, secrets, JIT host access, endpoint verification, and audit into one focused workflow.

Services & access