x509.systems

← All comparisons

Smallstep vs Sectigo

How Smallstep and Sectigo differ on deployment, pricing, openness and what each is actually built for.

SmallstepSectigo
TypePrivate CA (ACME)Public CA + CLM
DeploymentSelf-hosted + SaaSSaaS
How it worksstep-ca is an open-source private certificate authority that speaks ACME, so internal services renew exactly the way public ones do. The hosted product adds device identity, SSH certificates and single sign-on integration.Formerly Comodo CA. Issues public TLS, code-signing and S/MIME at volume through a large reseller channel. Sectigo Certificate Manager handles discovery, renewal and private PKI alongside the public roots.
Pricing*Free (OSS); hosted by quoteFrom $110/yr (1-yr DV)
Free tierYesNo
Open sourcestep-ca (Apache-2.0)—
ComplianceSOC 2 (hosted)WebTrust, CA/B Forum
Best forInternal mTLS and short-lived certificatesCost-sensitive estates that still want a CLM

Smallstep

  • Genuinely quick to stand up
  • ACME internally — same tooling as public TLS
  • Excellent short-lived certificate and SSH support
  • Not a public CA — internal trust only
  • Smaller company than the incumbents

Sectigo

  • Markedly cheaper than DigiCert for equivalent certificates
  • Public and private PKI in one console
  • Wide reseller availability
  • Brand still carries the old Comodo association
  • Support quality varies by channel

Bottom line

Choose Smallstep for internal mtls and short-lived certificates. Choose Sectigo for cost-sensitive estates that still want a clm.

* Indicative list pricing (vendor documentation and public pricing pages, August 2026).