Side by side
acme.sh vs cert-manager
Both stand on certificate management software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan LinuxMacSelf-hosted+1
acme.sh combines certificate issuance, installation, and renewal with multiple validation methods and certificate authorities. Automatic renewal has a stated exception: manual DNS validation requires a new TXT record for each renewal.
Visit acme.sh
Free plan APILinuxSelf-hosted
cert-manager handles certificate lifecycle work for Kubernetes and OpenShift, with options for TLS and private-PKI mTLS. Teams should review the hardening guidance and account for the project's release support policy.
Visit cert-managerThe facts
| acme.sh | cert-manager | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Not published |
| Runs on | Linux, Mac, Self-hosted, Windows | API, Linux, Self-hosted |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 1 | 1 |
| Maker | Not published | Not published |
| Website | github.com | cert-manager.io |
| On certificate management software | #3 of 31 | #7 of 31 |
acme.sh: what it does well
- Works with Bash, dash, and sh.
- General use does not require Python, root, or sudo.
- Supports multiple certificate types and validation modes.
- Automatic renewal includes a 30-day fallback rule.
- DNS provider APIs cover most providers, according to the project.
What to know first
- Manual DNS mode cannot renew automatically.
- Windows is listed as tested through Cygwin.
- Release tags through version 3.1.5 are unsigned.
cert-manager: what it does well
- Automates certificate issuance and renewal.
- Supports public and private issuers.
- Installation includes Helm and static manifests.
- trust-manager distributes cluster trust bundles.
- The project publishes threat and hardening guidance.
What to know first
- Default Helm values are not production-hardened.
- The open-source project does not maintain LTS releases.
- Release support ends after the second subsequent version.
Alternatives to acme.sh Alternatives to cert-manager The whole list