How cert-manager and Sectigo differ on deployment, pricing, openness and what each is actually built for.
| cert-manager | Sectigo | |
|---|---|---|
| Type | Kubernetes controller | Public CA + CLM |
| Deployment | Self-hosted (K8s) | SaaS |
| How it works | A Kubernetes controller that turns Certificate resources into real certificates from any configured issuer — ACME, Vault, private CAs — and renews them automatically as secrets. A CNCF graduated project. | Formerly Comodo CA. Issues public TLS, code-signing and S/MIME at volume through a large reseller channel. Sectigo Certificate Manager handles discovery, renewal and private PKI alongside the public roots. |
| Pricing* | Free | From $110/yr (1-yr DV) |
| Free tier | Yes | No |
| Open source | Apache-2.0 | — |
| Compliance | — | WebTrust, CA/B Forum |
| Best for | Certificates inside a Kubernetes cluster | Cost-sensitive estates that still want a CLM |
Choose cert-manager for certificates inside a kubernetes cluster. Choose Sectigo for cost-sensitive estates that still want a clm.
* Indicative list pricing (vendor documentation and public pricing pages, August 2026).