Certificate Lifecycle Manager Reviews

For Venafi, our use case is for managing the internal certificates of the company. We use Intrust for public certificates, but the internal certificates, the certificates generated for our own system, are managed, stored, renewed, and downloaded using Venafi.

The best features of Venafi are the event part; if any changes occur on Venafi's side, they send events, allowing our service to consume these events to figure out what changes were made, which is good in Venafi. The tracking part is also very good, as it remains consistent when multiple renewals occur, and we know what actions are being performed by whom. 

Venafi solved the issue of many misplaced internal certificates, as we know that at one place we can get all the information, and the problem of notifications about expiring certificates is resolved, improving our overall system for Expedia.

The access management for Venafi is very difficult. If a specific team needs to access certain parts of the certificates, they need to contact the admin, which is complex. For that reason, we built a third-party internal service to manage Venafi's access. 

The notification part also needs improvement because the general notifications don't specify which certificate owner is responsible. Therefore, we've developed our own notification system over Venafi to send emails to the correct user. 

The AWS tracking process is quite weak. For instance, while a certificate is associated with a load balancer, Venafi does not provide a straightforward way to identify which load balancer it is linked to. To resolve this, we need to create a root user in Amazon and grant access to Venafi, which adds complexity to the process. We can determine where the certificate is being used by using the certificate ARN. We developed an external solution for this issue, but it is something that Venafi could address as well.

I've been using the solution for around three years.

For stability, I'd rate it around six out of ten since we experience some outages despite the investment.

Venafi is scalable. We have 300 to 400 human users and many bot users using cert-manager in Kubernetes to generate certificates. I would rate its scalability a nine out of ten.

The vendor support is good; we can raise tickets in their support system, and typically a developer is assigned within one to two hours for debugging. However, there have been critical errors for which the support didn't have immediate solutions, causing some delays. Overall, the vendor support for Venafi is good.

Previously, we had a manual process for storing internal certificates managed by the PKI team, and they used to store them in a vault manually, making it a hectic process with high chances for manual errors, especially if someone leaves the company. Compared to that solution, Venafi is very good and helps, so that's why we purchased a three-year license. However, now that we're using Venafi, we've started noticing some flaws such as the notification issue, so we are looking for a better solution or building our own.

It's on prem, but we'll start migrating it to the cloud. 

Deploying Venafi can be quite complex, especially since it operates on a Windows machine. Previously, the deployment process was primarily manual and could take one or two days at a new site. However, after we implemented some Terraform scripts, the deployment time has significantly reduced to about one hour. Despite this improvement, the process remains complicated for someone new to it.

Maintenance is required for Venafi due to frequent upgrades and occasional misbehavior of the Venafi node, necessitating a separate team to check the health of the servers.

Evaluating the return on investment is complex. Overall, it has saved us a lot of time and money. Originally, the outages stopped, and we no longer had issues with certificate expirations. However, we did experience one significant outage due to the expiration of our root certificate. Unfortunately, we didn’t receive a notification from Venafi because it wasn't configured correctly, which led to a loss of around 12 million dollars. In the two years prior, we didn't have any outages, but last year we faced a major issue where the entire Expedia system was down for six hours. So while it seems to average out, the time savings and improvements in our processes have been beneficial.

For our budget, Venafi's cost is moderate. It's not expensive as internal certificate generation is free, and we only pay for the public CA certificate signer and for storage in Venafi. With the top-tier license, we can store unlimited certificates, so the pricing falls between moderate and expensive.

The solution was directly purchased from Venafi. We have a three-year license.

I would recommend Venafi if someone struggles to manage internal certificates without a management tool, but if they already have a mature system in place, I would not be sure to recommend it. It depends on the user's situation; for someone starting out, Venafi can be a good choice.

I would rate Venafi a seven out of ten.

The last contract I was on, I used it with TPP, and we migrated their internal infrastructure to AWS and then back connected to the database internally in their internal network, and it worked just peachy.

The reporting analysis is what I liked the most about it; that was the nicest thing about it. It helped keep track of certificates and their status and where we needed to make improvements, update, replace things. 

The automation capabilities of Certificate Manager are generally pretty good. It's easy to manage, and whenever I automate things, I generally use PowerShell and it's pretty user-friendly and easy to follow. My background is a C# coder, so PowerShell is easy. 

It handled compliance and regulatory requirements, such as HIPAA, very well overall. The reports that come with it generally are enough to satisfy the auditors, and if they're not, writing a new report is pretty easy, especially using the wizards built in.

I've been using it so long that it's kind of second nature to me. Documentation could use some improvement, but that's about all.

I have been using it since 2010. I last used Certificate Manager in May this year.

I would rate it a nine out of ten for performance and stability.

Scalability is great because it's easy to interconnect different Certificate Manager servers in different segments of the network, so once you've got that open door through the firewall, it's not hard at all.

A couple of years ago, I contacted the technical support for something small and a patch fixed it. I'd rate the support at least a nine out of ten. The support is very good in terms of speed and quality. 

Positive

I've done it manually, managed certificates manually, managed them through Microsoft tools, and frankly, Certificate Manager is the easiest and most comprehensive.

The initial deployment was easy for me. For the first time, it took about three days. The easiest part of it is using the discovery tool.

In terms of maintenance, you just have to keep up with the updates. They've generally got something new or good to patch, and if something doesn't work 100%, you'll find a patch on it generally pretty much monthly that could be your solution.

There were three of us for the deployment. Basically a manager and two contractors were involved.

Overall, I'd rate Certificate Manager a nine out of ten.

Certificate Manager is a certificate lifecycle management tool that I utilize as middleware to manage certificates; it's not the actual creator of the certificate, but it's what comes between the creator and the consumers.

The automation capabilities of Certificate Manager are great; it's not complete, but it's a work in progress. The automation capabilities of Certificate Manager have helped my organization reduce errors. It is probably the best out there. The PKI space is super niche and the automation pieces are all just coming together, so they haven't been fully fine-tuned. The automation part of it is not mature anywhere in the industry, but Certificate Manager is probably the best that you're going to get. 

There are lots of benefits to using Certificate Manager. The automation piece is definitely the best out there. I've dealt with other CLMs in the past, and I've really struggled with products that don't work. Certificate Manager works. There are these issues here and there, but the fact that it works is a big plus. For example, we were able to do integration F5s, so our entire organization doesn't have to worry about that aspect of it, and our networking team doesn't have to be humongous. The networking team is probably one of the most overworked teams anywhere, in any enterprise, but we've managed to cut down their certificate work by loads. They're probably only doing 10%, maybe even 5%, of the certificate work they should be doing if they were doing it manually. 

Certificate Manager has definitely helped reduce risk in my organization. We can scale out certificates as quickly as we can, so in the example of the automation of the F5, just the fact that we're able to scale out some certificates pretty quickly definitely stops us from being in a non-secure manner. 

Certificate Manager has helped us reduce the mean time to respond. I don't have to go into the CA to get a certificate. I can just log in quickly to the Certificate Manager web app and get a cert with two or three clicks. That's pretty handy. 

Certificate Manager has helped my organization free up staff to work on other projects or tasks; the companies that have been able to implement it in creative ways have managed to do it to a point where the team doesn't even need to be that big. There are only just four of us dealing with certificates, and that's pretty small compared to most other companies out there. The fact that we were able to implement it correctly in the beginning and utilize the tools around the space and those that can attach to it has definitely freed up a lot of our space to a point where it's running itself.

The support is definitely great. What I like best about Certificate Manager is that it's very easy to get somebody on a call and get any of my questions answered. That's probably the biggest thing. Besides the fact that it's a mature product and it works, the support is a big deal. 

There's definitely lots of room for improvement with Certificate Manager. They have a website where we can suggest new features, and they need to take that a little bit more seriously. I don't know if they're backing out because of numerous requests, and I know developers are always working hard to get the new features out, but there's definitely a lot that can be done still. There are quite a few different technical aspects of Certificate Manager that I feel they just missed out on; I'd have to look at my notes for the specifics.

I have been using Certificate Manager since 2021, so about 4 years now.

Certificate Manager is a stable product. It's definitely more stable than others. If there's ever been an issue with Certificate Manager, it usually tends to be something else; maybe the Windows server just needs a reboot or something, and very rarely do we see big issues that are bugs. The bugs exist, but the organizations I've been in haven't been hit as much with the bugs that are out there.

Scalability with Certificate Manager is good; you can definitely use it if you have ten thousand certs, a thousand certs, a million, or a couple million. I know of an organization that I was almost hired into that has millions of certs, and they were explaining it to me, so Certificate Manager is definitely scalable.

The support is definitely great. It is easy to get somebody on a call or get any of my questions answered, so that's probably the biggest thing. I would rate their customer support a nine out of ten because there are situations where support could be improved. They could improve their technical support team by just training up; it's a work in progress.

Positive

I have used NCLM, which is Nokia's product for certificate lifecycle management, in the past.

I've just always known how to do the initial setup for Certificate Manager; they have their documents, but we also have the support of the vendor if we have any questions.

I have evaluated other solutions before choosing Certificate Manager; there's Keyfactor, DigiCert, Entrust, and a whole bunch. It always seems to be between Keyfactor and Certificate Manager for me. Certificate Manager has always been the tool that I've utilized; I haven't really gotten into Keyfactor quite yet, so I can't really speak to that.

I would say that using Certificate Manager is not for beginners, but the documentation is there, and they make it really easy for you to use. You should have an idea of what PKI is before you jump into it. You need a little bit of training to use Certificate Manager; it's not something that you would just jump in and be able to do right without some training. 

It's definitely worth the money to have Certificate Manager as a tool; it's definitely miles away from the competition, in my opinion. Deployment with Certificate Manager is very easy. I would recommend Certificate Manager to other people. 

I would rate Certificate Manager a nine out of ten.

My use cases for Certificate Manager were for the Certificate Manager Trust Protection Platform, managing infrastructure PKI and certificates.

Certificate Manager's automation capabilities are very good, which is why we used it. Certificate Manager's ability to stay updated on the most current certification renewals was also very good. Certificate Manager's ability to safeguard my financial services infrastructure was good; we had no problems with that. Certificate Manager's ability to help with compliance and regulatory requirements, including SOX and Swift, was great. This is a major selling point.

In terms of areas for improvement, one thing that we did not appreciate about Certificate Manager was having agents on everything. An agent needed to be installed everywhere to handle the certificate management. Having the agents everywhere is not ideal and is always problematic. Having the agent everywhere is not the best for security, which was our other significant concern.

I have been using Certificate Manager for about two years in my career. I am not currently using it at my current job, but rather at my previous position.

I have no issues about Certificate Manager's stability; it demonstrated good stability.

Certificate Manager's scalability was good as well.

I have contacted Certificate Manager's technical support and customer support. We worked with their consulting group during implementation. I went through the whole implementation phase and they were very effective. For Certificate Manager's support, I would rate them eight or nine out of ten.

Positive

I have not used any alternatives to Certificate Manager; nothing at that scale of management.

It took me about six months to a year to fully deploy Certificate Manager across the entire enterprise.

The implementation involved a whole team operation with approximately five or six people in total, including myself, several colleagues, and consultants.

The mean time to respond was significantly reduced with Certificate Manager.

When I was working with Certificate Manager, I was working in financial services as a user of the product and not a partner of Certificate Manager. On a scale from 1 to 10, I would rate Certificate Manager overall for everything an eight.

In my testing and support role as an analyst, I handle a certificates list, checking their expiry dates, and if a certificate is expiring within a month, we ask if there are any private keys to add; if not, we put a public key for renewal or creation based on the expiry date, and we obsolete certificates not in use from the Venafi tool.

The best feature I appreciate about Venafi is its user interface, which allows me to search for any particular certificate and immediately see the certificate details and expiry. I mostly appreciate how user-friendly the UI is. The Venafi solution has helped my organization by allowing us to manage certificates directly instead of relying on server administrators to perform tasks such as renewing and obsoleting.

As an end user, I cannot specifically point out improvements, but I believe it would be beneficial to display active certificates in a separate column on the UI, so users can easily find what they need. Additionally, I think notifications for certificate expirations could include varying time frames such as 60 days or 15 days to better inform end users.

I have been using the Venafi tool for almost six plus years when I worked for Lloyds Banking Group, particularly for certification tasks such as obsoleting, creating, and renewing.

For the stability of the solution itself, I would rate it a seven.

I am not sure about the total users across the whole company, but in our team, there are about 10 to 15 people.

I only utilize Venafi for certificate renewal, so I cannot compare it to other products.

We do not handle the deployment ourselves as different teams manage the installation.

The overall time saved from automating processes compared to manual work could be around ten percent.

Although I am not fully aware of compliance matters, I believe Venafi maintains good authentication since only authorized users can log in, preventing compliance issues. Different clients such as Walmart and Lloyds will have their certificates in separate folders to ensure that data from one client does not mix with another. I am not aware of Venafi's pricing.

Overall, I would rate Venafi a seven because, from my perspective, that feels accurate.

We are using Certificate Manager as a certificate lifecycle management tool and for notifications, specifically certificate expiry notifications. Currently, we are working on automation by using Certificate Manager for automatically installing the certificates on different key stores.

By using Certificate Manager, we have reduced our potential risk significantly due to certificate expiry, as all teams are getting emails before 60 days and 90 days, which is helpful.

It has reduced our manual efforts significantly. Earlier, if it took us 10 minutes to issue one certificate, by using Certificate Manager, we are now issuing it in 5 minutes, which is a 50% time saving. 

We are actively monitoring every certificate within our organization. It allows us to know which specific part or server each certificate is being used for. Through our monitoring efforts, we can provide detailed information about each certificate, ensuring our organization is well-informed.

It has improved our operational efficiency by 70% to 80%.

Certificate Manager is a versatile tool, providing many services beyond the tools present in the market. The best feature is that Certificate Manager automatically discovers certificates in the environment and onboards them in the dashboard. Using Certificate Manager, we can automate and install certificates on target machines without human intervention, making it an excellent tool for automation and certificate lifecycle management.

Certification renewal is the fundamental aspect of Certificate Manager, and it meets current market standards, setting the benchmark. We are monitoring each certificate, so our organization is aware of which server uses that certificate, and based on the monitoring, we can access all certificate details, which provides great help.

The solution's ease of use is moderate, and I suggest that the documentation by Certificate Manager should be more linear or simpler because when new associates or trainees try to learn the tool, the documentation is difficult to understand.

Integrating Certificate Manager into existing systems is quite easy; however, the documentation should be improved as we have to conduct analysis from our end, and the documentation hasn't presented information in a proper or linear fashion.

The support from Certificate Manager needs improvement based on my experience. The response time needs improvement, and it takes too long to resolve or provide solutions for some tickets.

I have been working with Certificate Manager for three years.

It's stable. I would assess the stability as eight out of ten. 

It's scalable. Scalability is rated an eight out of ten.

In our organization, we currently have around 15 members working on Certificate Manager, with more than 300 to 400 people having read access to the dashboard to view their certificates.

The support from Certificate Manager needs improvement. I would rate the technical support a seven out of ten.

Positive

The initial setup process can be a bit complex, but I would classify it as medium-level difficulty. One area for improvement is the documentation, as clearer guidelines would facilitate more effective automation. Based on the current documentation, it typically takes us four to five weeks to deploy any updates or changes. Unfortunately, we've encountered difficulties in locating the necessary information.

We perform maintenance on a quarterly or semi-annual basis to ensure everything runs smoothly.

It brings value from day one; deploying this solution definitely provides beneficial value.

Certificate Manager is versatile, providing numerous features compared to other tools in the market. If I were to recommend a tool to anyone, I would choose Certificate Manager over others.

For certificate-related tasks, we can work on the PCI and DSS components, but regarding Certificate Manager specifically, there isn't a need for PCI and DSS compliance. If we want to install private keys, we need to consider compliance issues, but if we are not installing private keys, there is no need to comply with current governance rules.

I would rate Certificate Manager an eight out of ten, as it has versatility and offers many features compared to tools available in the market for certificate lifecycle management.

We use Certificate Manager for PKI certificates.

Certificate Manager's overall installation could be made easier. You have to install the client, then go to the console and push the certificate.

I have been using Certificate Manager for three to four months.

More than 10,000 users are using Certificate Manager in our organization.

Certificate Manager was deployed in less than 30 minutes. I did Certificate Manager's deployment by myself, but we had to go through some processes to get the PKI certificate for the enterprise side. Then, they create the certificate, and we deploy it.

Certificate Manager has some additional functionalities for managing PKI certificates compared to other certificate deployment products. I would recommend Certificate Manager to other users.

Overall, I rate Certificate Manager an eight out of ten.

We use this product for our clients' server authentication and application ID certificate. We create the certificate so that when a user tries to access an application, it looks for that specific certificate based on the volume information and it authenticates on that basis. I'm a lead system operation engineer and we are customers of Venafi. 

If you want to automate anything, renew the certificate and apply to whatever environment you need, whether it is on-premise or cloud, automation is possible. You just need to have your integration set up. Venafi takes care of automatically renewing and deploying your certificate so that you don't need to worry when it expires. It also minimizes downtime and has good integration. 

For Java applications, we currently convert the certificate in JKS manually. It would be helpful to have the capability to download certificates in JKS automatically. Venafi only provides CER and no other format. They provide an option for JKS, but that certificate doesn't work because of some configuration issues. 

I've been using this solution for six years. 

The solution is stable.

We didn't test the scalability but I believe it has that capacity. We have 500 users. 

The customer support was great. 

Positive

I previously used the Microsoft SSL ADMIN tool. The difference between the two is that with Venafi, if you have access to policy, you can create, delete, import and export anything within the tool. With SSL ADMIN, unless you own the certificate, you can't make any changes to that specific activity. If you've been designated as the 'owner' and you leave the company, it's hard to change ownership. Venafi is much more flexible because it allows you to add a group instead of individuals. Even if someone leaves the group, it doesn't affect the system.

The initial setup is straightforward although it does require some security training to gain access. 

I rate this solution nine out of 10. 

In terms of how Venafi has improved our customers' organizations, the most important thing is that it reduces the risk of the outage of some of their IT systems. Sometimes these systems would be directly connected to the revenue generating activities that the client may have. So that risk reduction that can be directly calculated into money for our clients. If their IT system that is connected to production is down one day, they will know exactly how much it would cost them. So, from the perspective of risk reduction, it can be directly quantified in the value for the customer. If I was going to single out the most important feature, that would be probably be it.

The feature that I have found most valuable is their certificate discovery.

The user interface could be always improved. But I am a technologist, so I don't care so much about user interface, but the importance that it is user friendly is always appreciated by customers.

In terms of additional features I would like to see included in the next release of Venafi, I would say integration with the cloud HSM's, Hardware Security Module. Additionally, I would say other cloud services, because it is not only cloud that's essential. If you have a customer that has a lot of their IT moved into cloud, integration with different cloud services is always an area to improve.

I haven't heard negative things about the stability.

In terms of scalability, given that we were in the situation where it was on-prem, there were certain limitations there. But I guess on the cloud they should not have limitations.

To my knowledge, it began with the initial proto-concept. After that, there were some professional services needed to fine tune and integrate with everything that the customer wanted.

From the top of my head, I think it took less than two months, maybe 6, 7, or 8 weeks, but about two months or less.

The technical team needed for the installation really depends on the customer's prior knowledge. If they have a good technical team, then the things are much easier. If they don't have... 

The technical team includes engineers, architects, managers, and administrators for different stages. I guess the architects and system administrators are also involved in the process of purchasing and evaluating if it's a good fit for them. Then the architects are not necessarily needed anymore, but you would have system administrators involved given that certain privileges must be given to this system in order to operate correctly. And then you would have your general IT security administrators for ongoing monitoring of what the Venafi system provides you. This can be taught. You don't have to have a PhD in cryptography to understand this, just be a regular IT business person who has specialized a little bit on security issues. I think they can comfortably master this.

As I mentioned, there is the risk reduction. If they see the risk reduction, then I think they should go for Venafi or a similar solution. Of course, as products improve and prices go down, even more so. But it is way better to have this kind of solution compared to not having anything, because I see from the IT security business that I have been working in almost 30 years now, if they are not running this or a similar type of solution, they are just asking for trouble. It's more a question of when an outage will happen, than if. So, coming back to the risk reduction, depending of course on the size of the company and their revenues and what type of critical systems they have, they all need to make their decision. But at the end of the day, the vast majority of the customers will see a return on investment if they value the risk reduction.

Our customers need to pay for a license, and understanding the pricing and how it might develop in the future is a bit of a pain point. But, it is not too complex either. Sometimes people ask the vendors to predict the future, whereas they themselves cannot provide enough of the information to the vendor in order to be able to estimate correctly. So it kind of goes both ways. I would say the price is fairly good. Is it perfect? No. Is it the worst I've ever seen? Absolutely not.

I would say Venafi is definitely among the three most important vendors in this area.

On a scale of one to ten, I would give Venafi a seven.