Google GCP CAS vs Smallstep Certificate Manager

Overview of capabilities

Google Certificate Authority Service (CAS) is a hosted certificate authority designed to work well with other Google services. It is new but has the potential to a good option if all your workloads and services run inside GCP. It’s integrated with and can provide automated certificates for load balancers and a few core GCP services. However, once you step outside of GCP things, get difficult. It lacks automation around authenticated issuance (more on that below) and instead relies on partners to help close that gap (including Smallstep). Google CAS is licensed by the number of CAs and certificates with discounted certificate charges at higher volumes. Google CAS is also available in a DevOps or Enterprise configuration. As you would expect, Enterprise costs more and brings a UI for certificates and active revocation.

From a technology perspective, Google’s primary deficiencies are around certificate management. It lacks many automated authorization methods, thus requiring operators to spend time creating certificates. Because of the manual nature of certificate creation, longer expiry times are used to avoid busy work in the future. Per certificate charges also extend certificate lifetimes, providing another incentive towards poor security practices. With smallstep, we provide end-to-end certificate management for developers and operators. We authorize and automate the lifecycle and reduce certificate lifetimes allowing your developers to move quickly and securely.