How Smallstep and cert-manager differ on deployment, pricing, openness and what each is actually built for.
| Smallstep | cert-manager | |
|---|---|---|
| Type | Private CA (ACME) | Kubernetes controller |
| Deployment | Self-hosted + SaaS | Self-hosted (K8s) |
| How it works | step-ca is an open-source private certificate authority that speaks ACME, so internal services renew exactly the way public ones do. The hosted product adds device identity, SSH certificates and single sign-on integration. | A Kubernetes controller that turns Certificate resources into real certificates from any configured issuer — ACME, Vault, private CAs — and renews them automatically as secrets. A CNCF graduated project. |
| Pricing* | Free (OSS); hosted by quote | Free |
| Free tier | Yes | Yes |
| Open source | step-ca (Apache-2.0) | Apache-2.0 |
| Compliance | SOC 2 (hosted) | — |
| Best for | Internal mTLS and short-lived certificates | Certificates inside a Kubernetes cluster |
Choose Smallstep for internal mtls and short-lived certificates. Choose cert-manager for certificates inside a kubernetes cluster.
* Indicative list pricing (vendor documentation and public pricing pages, August 2026).