Hashicorp Vault vs Smallstep Certificate Manager

Overview of capabilities

Hashicorp Vault is a great secrets management product that includes some PKI functionality. It a good option if you are already using Vault and have simple PKI needs. However, it defaults to a centralized security model (just like secrets) where client certificates are generated server-side. This approach can help with some workflows, but it does require you to copy the private key over the network to a client. Vault also gets pretty expensive to license when you want to do things like securing the private keys in an HSM or run a highly available cluster (although the new hosted Vault offering may help here).

From a technology perspective, Vault’s primary deficiencies are around certificate management. It lacks many automated authorization methods, thus requiring operators to spend time creating certificates. Because of the manual nature of certificate creation, longer expiry times are used, increasing the threat window. With smallstep, we provide end-to-end certificate management for developers and operators. We automate the lifecycle and reduce certificate lifetimes allowing your developers to move quickly and securely.