Compare the work your team needs to do
| Workflow | CertLocker | Infisical |
|---|---|---|
| Certificates | Inventory, ACME workflows, scoped delivery, and probes to check the certificate served by a live endpoint. | Internal CAs, ACME enrollment, certificate inventory, lifecycle management, and Certificate Manager-wide alerts. ACME DNS-01 providers include UltraDNS and Google Cloud DNS; advanced integrations depend on the plan. |
| Secrets | Operational secrets alongside certificate material, with version history and group-scoped access. | Developer secrets management with project and environment workflows and API integrations. |
| Host access | Time-limited SSH/RDP access and browser terminal SFTP uploads under token capabilities. | SSH certificates and privileged access offerings, including approvals and session auditing; check resource and plan coverage. |
| MCP | Hosted HTTP endpoint for allowed resources, secret reads, certificate retrieval, SSH/probes, approval, and audit. Secret creation and rotation through MCP are not yet supported. | An API MCP server with secret read/write tools and machine-identity or access-token authentication; a separate hosted MCP serves documentation. |
| Buying model | Hosted onboarding with no charge to get started. Services for infrastructure teams and enterprise estates are scoped by agreement. | Product-specific packaging for secrets, certificate management, and privileged access. Compare the combination your team needs. |
Competitor capabilities and packaging: Infisical pricing and product packaging; Infisical v0.166.1 certificate alerts; Infisical v0.166.3 ACME DNS providers; Infisical SSH certificates; Infisical official MCP server; Infisical documentation MCP. CertLocker details: feature catalogue and services and access.
Choose CertLocker when…
Your daily work crosses HAProxy, Nginx, IIS, Linux hosts, and private networks. You want to connect renewal, controlled delivery, endpoint checks, and incident access in one operating workflow, with onboarding and rollout help scoped around your estate.
Start with a certificate that must reach a real service. The delivery verification build note shows why successful issuance alone does not prove the service changed.
Choose Infisical when…
Your team already uses Infisical’s project and environment model, or its developer integrations and CA workflows meet your requirements. Extending that deployment may be easier than migrating it.
If an internal CA or an enterprise enrollment integration is the deciding requirement, check the specific supported integration and plan. CertLocker does not claim parity with every Infisical PKI feature.
Compare the whole bill
Get started with hosted CertLocker and a walkthrough of your current workflow. We agree the scope, capacity, support and commercial terms before any paid service begins. See the services and access options.
Infisical publishes separate product pricing. On 12 October 2026, its public certificate Free plan lists one internal or ACME-based external CA, up to 10 active certificates counted by unique name sets, and up to five SANs per certificate, without wildcard SANs. Certificate Enterprise uses custom pricing. Confirm the current limits and price your required secrets, certificate, and access products together using Infisical’s current pricing.
Its October releases add Certificate Manager-wide alerts and UltraDNS and Google Cloud DNS for ACME DNS-01. Include those capabilities in your evaluation. For the different billing units and rollout costs, see our certificate management pricing checklist.
Evaluate a move with one non-production service
- Record the service’s certificate, secrets, renewal owner, consumers, and current permissions.
- Import the permitted material into CertLocker and map groups and token scopes. Keep sensitive exports out of tickets and chat.
- Reconfigure one delivery client or job. Check the served certificate with an endpoint probe.
- Test allowed and denied access, review the audit record, and confirm rollback before moving another service.
For agent workflows, compare the MCP patterns in Infisical, Doppler, CertSecure, and CertLocker, then use the CertLocker MCP setup guide.
Frequently asked questions
Is CertLocker an Infisical alternative?
Yes, for teams evaluating certificates, operational secrets, host access, and audit together. Infisical also covers certificate management and privileged access. Test the integrations, permissions, and deployment workflows you need in both products.
Does Infisical manage certificates as well as secrets?
Yes. Infisical offers certificate management including internal CAs and ACME enrollment. Compare its current certificate plan with your issuance, discovery, delivery, and integration requirements.
How much does CertLocker cost?
There is no charge to get started with hosted CertLocker. We agree the scope, capacity, support and commercial terms with you before any paid service begins. See the services and access page for the available paths.
Can I move from Infisical to CertLocker?
Evaluate one non-production workflow first. Map secrets, certificates, groups, consumers, and permissions, then reconfigure clients and verify access. This is a workflow migration, not a documented one-click Infisical import.
Test the workflow on your own terms
Bring your inventory to a hosted walkthrough. We will help plan onboarding and discuss private deployment requirements where needed.