Editions & Pricing
From a free self-hosted starting point to a government-ready package: with no per-domain metering. Premium features unlock with an offline-verifiable license, so even air-gapped deployments stay licensed without ever contacting a server.
Free· self-hosted, unlimited certs
Teams getting started
$5,000per month · unlimited domains
Businesses & platform teams
Optional· stack onto Commercial
Scale support & security
Contact sales· tailored to your ATO
Public sector & regulated
Commercial is one flat monthly price with unlimited domains and certificates. There is no per-domain metering. Optional add-ons (Premium Support, HSM / PKCS#11, Onboarding & Professional Services) stack on top. Runs on a FIPS 140-3-validated cryptographic module on RHEL/Alma 9 (CMVP #4857). Need an OEM/MSP arrangement or volume terms? Talk to us.
The detailed view. Every edition is the same application; higher tiers unlock with a signed license.
| Capability | Community | Commercial | Government |
|---|---|---|---|
| Core lifecycle | |||
| Request → approve → sign → issue pipeline | ✓ | ✓ | ✓ |
| Per-template signing policy & auto-sign | ✓ | ✓ | ✓ |
| Revocation (CRL / OCSP) | ✓ | ✓ | ✓ |
| On-demand renewal & expiry warnings | ✓ | ✓ | ✓ |
| Automated background renewal | — | ✓ | ✓ |
| Fleet inventory, groups & audit log | ✓ | ✓ | ✓ |
| CA backends | |||
| OpenBao / Vault PKI | ✓ | ✓ | ✓ |
| ACME client (incl. cloud DNS-01 solvers) | — | ✓ | ✓ |
| Microsoft AD CS · EJBCA · Venafi · AWS Private CA · CyberArk | — | ✓ | ✓ |
| Built-in local CA (OCSP, hosted CRL, S/MIME, ML-DSA) | — | ✓ | ✓ |
| Enrollment & machine identity | |||
| Built-in ACME server (RFC 8555) | — | ✓ | ✓ |
| EST (RFC 7030) · SCEP (RFC 8894) · CMP (RFC 4210) | — | ✓ | ✓ |
| Code-signing (CMS) & RFC 3161 timestamping | — | ✓ | ✓ |
| DNSSEC KSK/ZSK rollover (NetScaler / ADC) | — | ✓ | ✓ |
| Keys & delivery | |||
| Encrypted (sealed) keystore | — | ✓ | ✓ |
| HSM / PKCS#11 key anchoring | — | Add-on | Add-on |
| Delivery: SSH · Kubernetes · Vault · pull · webhook · CyberArk | — | ✓ | ✓ |
| Chat integrations (Slack / Teams / Discord) + webhooks | — | ✓ | ✓ |
| Security & deployment | |||
| Air-gapped install, no phone-home, offline license | ✓ | ✓ | ✓ |
| FIPS 140-3 validated crypto (RHEL/Alma 9, CMVP #4857) | ✓ | ✓ | ✓ |
| Local + CAC / PIV (mTLS) authentication | ✓ | ✓ | ✓ |
| VM · container · Kubernetes (Helm) deployment | ✓ | ✓ | ✓ |
| Government pack | |||
| DoD / service subject profiles, OU presets, consent banners | — | — | ✓ |
| WORM tamper-evident audit | — | — | ✓ |
| Separation of duties & dual control | — | — | ✓ |
| Federal PKI trust anchors & chain validation | — | — | ✓ |
| NIST 800-53 mapping, OSCAL / eMASS export, STIG/SCAP | — | — | ✓ |
| CNSA 2.0 report & PQC migration tooling | — | — | ✓ |
| Offline CRL / revocation & cross-domain transfer bundles | — | — | ✓ |
| Support | |||
| Self-serve docs & community channels | ✓ | ✓ | ✓ |
| Standard support (3-business-day response) & product updates | — | ✓ | ✓ |
| Compliance assistance | — | — | ✓ |
| Premium Support: named engineer, response-time SLA (24 h standard, up to 1 h) | — | Add-on | ✓ Included (uncleared) |
| Cleared support engineers (Secret / Top Secret / TS-SCI) | — | — | Add-on |
| Onboarding & professional services | — | Add-on | Add-on |
Some listed integrations are still being validated end-to-end against their live third-party systems. See the roadmap & validation status for exactly what is production-proven today versus validated per engagement.
"Unlimited" remains a valid license type and is equivalent to Commercial: one flat plan, uncapped domains.