Amazon AWS ACM vs Smallstep Certificate Manager

Overview of capabilities

Amazon AWS ACM PCA is a hosted certificate authority designed to work well with other Amazon services. It is a good option if all your workloads and services run inside AWS. It’s well integrated with load balancers and core services and can provide automated certificates for some of the Amazon cloud services. However, once you step outside of AWS things, get difficult. It lacks automation around authenticated issuance (more on that below) and cannot build longer PKI chains (which help in complex multi-cloud environments). AWS ACM PCA is licensed by the number of CAs and certificates with discounted certificate charges at higher volumes.

From a technology perspective, Amazon’s primary deficiencies are around certificate management. It lacks many automated authorization methods, thus requiring operators to spend time creating certificates. Because of the manual nature of certificate creation, longer expiry times are used to avoid busy work in the future. Per certificate charges also extend certificate lifetimes, providing another incentive towards poor security practices. With smallstep, we provide end-to-end certificate management for developers and operators. We authorize and automate the lifecycle and reduce certificate lifetimes allowing your developers to move quickly and securely.