As an end user, I cannot specifically point out improvements, but I believe it would be beneficial to display active certificates in a separate column on the UI, so users can easily find what they need. Additionally, I think notifications for certificate expirations could include varying time frames such as 60 days or 15 days to better inform end users.
The access management for Venafi is very difficult. If a specific team needs to access certain parts of the certificates, they need to contact the admin, which is complex. For that reason, we built a third-party internal service to manage Venafi's access. The notification part also needs improvement because the general notifications don't specify which certificate owner is responsible. Therefore, we've developed our own notification system over Venafi to send emails to the correct user. The AWS tracking process is quite weak. For instance, while a certificate is associated with a load balancer, Venafi does not provide a straightforward way to identify which load balancer it is linked to. To resolve this, we need to create a root user in Amazon and grant access to Venafi, which adds complexity to the process. We can determine where the certificate is being used by using the certificate ARN. We developed an external solution for this issue, but it is something that Venafi could address as well.
Solution Engineer at a comms service provider with 10,001+ employees
Real User
Top 20
2025-03-27T09:21:07Z
Mar 27, 2025
The product was really good when it was a Venafi product. However, since its acquisition by CyberArk, there has been a lack of significant innovations. They are pushing for cloud adoption, but we prefer on-premises solutions due to regulatory concerns. They are giving support for cloud-based and SaaS solutions. I would like equivalent support for on-premises ecosystems. Integrating Venafi with CyberArk's Conjur for centralized secret management is currently challenging for us. Conjur is a central platform where applications can store all kinds of secrets, even certificates, private keys, and passwords in a central location, and that can be distributed everywhere. This integration is crucial for our seamless operations, and we have been awaiting a solution for nearly two years.
Systems Engineer at a insurance company with 51-200 employees
Real User
Top 20
2024-12-09T21:24:00Z
Dec 9, 2024
Venafi excels in automating certificate rotation and deployment but could enhance its offering by improving support for hardware security modules like Fortanix and providing more advanced, out-of-the-box integrations with public certificate authorities for DNS re-verification. Currently, the yearly DNS verification required by certificate authorities necessitates manual intervention, hindering full automation. This limitation, however, is not unique to Venafi, as most tools lack the API integration necessary to automate the verification process with certificate authorities. Until such integration is achieved, the added security layer of domain verification will continue to pose a challenge for fully automated public certificate management.
Learn what your peers think about CyberArk Certificate Manager. Get advice and tips from experienced pros sharing their opinions. Updated: September 2025.
Global Security Systems Consultant at a insurance company with 10,001+ employees
Real User
Top 5
2024-12-09T15:53:00Z
Dec 9, 2024
Venafi could enhance its offerings by providing more automation features. Currently, specific processes require manual installations due to the lack of built-in integrations. While custom scripts can address some gaps, expanding the range of out-of-the-box integrations would significantly improve the user experience.
Lead System Operation Engineer at a tech services company with 51-200 employees
MSP
2022-11-14T09:59:09Z
Nov 14, 2022
For Java applications, we currently convert the certificate in JKS manually. It would be helpful to have the capability to download certificates in JKS automatically. Venafi only provides CER and no other format. They provide an option for JKS, but that certificate doesn't work because of some configuration issues.
Vise President at a tech services company with 51-200 employees
Real User
2022-01-04T21:22:00Z
Jan 4, 2022
The user interface could be always improved. But I am a technologist, so I don't care so much about user interface, but the importance that it is user friendly is always appreciated by customers. In terms of additional features I would like to see included in the next release of Venafi, I would say integration with the cloud HSM's, Hardware Security Module. Additionally, I would say other cloud services, because it is not only cloud that's essential. If you have a customer that has a lot of their IT moved into cloud, integration with different cloud services is always an area to improve.
CyberArk Certificate Manager automates and streamlines certificate processes, reducing errors and enhancing efficiency. It centralizes management, supports compliance, and improves certificate lifecycle management with customizable features.CyberArk Certificate Manager offers a streamlined approach to managing certificates, focusing on automation that minimizes manual intervention and errors. Its discovery and centralized management enhance operational efficiency, while integration...
As an end user, I cannot specifically point out improvements, but I believe it would be beneficial to display active certificates in a separate column on the UI, so users can easily find what they need. Additionally, I think notifications for certificate expirations could include varying time frames such as 60 days or 15 days to better inform end users.
I've been using it so long that it's kind of second nature to me. Documentation could use some improvement, but that's about all.
The access management for Venafi is very difficult. If a specific team needs to access certain parts of the certificates, they need to contact the admin, which is complex. For that reason, we built a third-party internal service to manage Venafi's access. The notification part also needs improvement because the general notifications don't specify which certificate owner is responsible. Therefore, we've developed our own notification system over Venafi to send emails to the correct user. The AWS tracking process is quite weak. For instance, while a certificate is associated with a load balancer, Venafi does not provide a straightforward way to identify which load balancer it is linked to. To resolve this, we need to create a root user in Amazon and grant access to Venafi, which adds complexity to the process. We can determine where the certificate is being used by using the certificate ARN. We developed an external solution for this issue, but it is something that Venafi could address as well.
We have not faced any kind of disadvantage regarding Venafi, but they could improve on the bugs, as sometimes the system gets stuck.
The product was really good when it was a Venafi product. However, since its acquisition by CyberArk, there has been a lack of significant innovations. They are pushing for cloud adoption, but we prefer on-premises solutions due to regulatory concerns. They are giving support for cloud-based and SaaS solutions. I would like equivalent support for on-premises ecosystems. Integrating Venafi with CyberArk's Conjur for centralized secret management is currently challenging for us. Conjur is a central platform where applications can store all kinds of secrets, even certificates, private keys, and passwords in a central location, and that can be distributed everywhere. This integration is crucial for our seamless operations, and we have been awaiting a solution for nearly two years.
Venafi excels in automating certificate rotation and deployment but could enhance its offering by improving support for hardware security modules like Fortanix and providing more advanced, out-of-the-box integrations with public certificate authorities for DNS re-verification. Currently, the yearly DNS verification required by certificate authorities necessitates manual intervention, hindering full automation. This limitation, however, is not unique to Venafi, as most tools lack the API integration necessary to automate the verification process with certificate authorities. Until such integration is achieved, the added security layer of domain verification will continue to pose a challenge for fully automated public certificate management.
Venafi could enhance its offerings by providing more automation features. Currently, specific processes require manual installations due to the lack of built-in integrations. While custom scripts can address some gaps, expanding the range of out-of-the-box integrations would significantly improve the user experience.
Venafi's overall installation could be made easier. You have to install the client, then go to the console and push the certificate.
For Java applications, we currently convert the certificate in JKS manually. It would be helpful to have the capability to download certificates in JKS automatically. Venafi only provides CER and no other format. They provide an option for JKS, but that certificate doesn't work because of some configuration issues.
The user interface could be always improved. But I am a technologist, so I don't care so much about user interface, but the importance that it is user friendly is always appreciated by customers. In terms of additional features I would like to see included in the next release of Venafi, I would say integration with the cloud HSM's, Hardware Security Module. Additionally, I would say other cloud services, because it is not only cloud that's essential. If you have a customer that has a lot of their IT moved into cloud, integration with different cloud services is always an area to improve.