sslbrain vs CyberArk Certificate Manager (formerly Venafi)

Short answer

CyberArk Certificate Manager, formerly Venafi, comes as SaaS with a Standard and an Enterprise package, as Next-Gen Trust Security from Palo Alto Networks and as Self-Hosted.^1,2,3 The Enterprise package pushes to machines and cloud keystores through VSatellite or cloud APIs, and Next-Gen Trust Security connects through VSatellite directly to application keystores on machines; both have an ACMEv2 server. Self-Hosted installs agentless from the Trust Protection Foundation server or through Server Agent. The Standard package has issuance, discovery and monitoring, but no push.^{1,4,5,6,7,8,9} All editions require a sales conversation. CyberArk has been owned by Palo Alto Networks since 11-02-2026.^1,10,3,11,12

sslbrain runs as an appliance in your own network. The catalogue has 72 integrations. On Windows and Linux servers, a service agent installs the certificate. To network equipment and cloud services, the appliance pushes over API or SSH. Where there is no integration, you use a custom agent or ACME.

How to read the table

Every answer about another vendor carries a small number. It leads to the source at the foot of the page, with the date the source was last checked.
"Not stated" means it does not appear in the sources we reviewed. It does not mean no.
Prices are in the vendor's own currency, not converted. Where only the yearly or the monthly price is stated, the other is calculated and marked.
The sslbrain column has no source numbers. It comes from our own prices and our integration catalogue and links to those pages.

Every edition of CyberArk (Venafi) and sslbrain

The table scrolls sideways.

Question	sslbrain	SaaS Standard	SaaS Enterprise	Next-Gen Trust Security	Self-Hosted
Price
Price per year and per month	Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint. See the prices	Not public, requires a sales conversation¹	Not public, requires a sales conversation¹	Not public, requires a sales conversation¹⁰	Not public, requires a sales conversation³
Automation
How the certificate gets there	Both agents/push and ACME Full answer a service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH.	No automatic installation¹ Full answer The Standard package has issuance, discovery and monitoring, but neither push provisioning nor ACME/SCEP/EST	Both agents/push and ACME^1,4 Full answer push to machines and cloud keystores via VSatellite or cloud APIs, plus an ACMEv2 server for the customer's ACME clients (the manufacturer's package table calls ACME/SCEP/EST "partial" for Enterprise)	Both agents/push and ACME^5,6,7 Full answer machines that let Next-Gen Trust Security connect directly to application keystores via VSatellite, plus an ACMEv2 server for the customer's ACME clients	Both agents/push and ACME^8,9 Full answer agentless installation from the Trust Protection Foundation server or via Server Agent on the server, plus an ACME server (certbot, win-acme, acme.sh) and EST
Direct agents and connectors	72 integrations in the catalogue See the integrations	0¹ Full answer push provisioning connectors are not included in Standard	24¹³ Full answer 21 machine types with provisioning guidance, AWS ACM and Google Cloud Certificate Manager as cloud keystores, Akamai CDN as a cloud provider	24¹³ Full answer 21 machine types with provisioning guidance, AWS ACM and Google Cloud Certificate Manager as cloud keystores, Akamai CDN as a cloud provider	21¹⁴ Full answer 20 agentless installation targets plus Server Agent
Without a direct agent	Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME	The manufacturer refers to the Enterprise package for push and automation¹ Full answer no other installation method is stated for Standard	Common KeyStore machine (PEM/JKS/PKCS#12 via SSH or WinRM), Microsoft Windows (PowerShell) machine with the customer's own script, an ACMEv2 server for the customer's ACME client, or a custom connector built with the manufacturer's connector framework^5,4,15	Common KeyStore machine (PEM/JKS/PKCS#12 via SSH or WinRM), Microsoft Windows (PowerShell) machine with the customer's own script, an ACMEv2 server for the customer's ACME client, or a custom connector built with the manufacturer's connector framework^5,4,15	The Java Keystore driver for Tomcat and others, the Adaptable Application driver (the customer's PowerShell script), third-party drivers via CyberArk Marketplace, Server Agent, ACME clients or EST¹⁴
Named systems
FortiGate	Yes Full answer Fortinet FortiGate: push from the appliance over the API, port 443	No¹ Full answer The Standard package has neither push provisioning connectors nor ACME/SCEP/EST	Yes¹⁶ Full answer Fortinet FortiGate machine, REST API from VSatellite, port 443 by default	Yes¹⁶ Full answer Fortinet FortiGate machine, REST API from VSatellite, port 443 by default	Not stated
F5 BIG-IP	Yes Full answer F5 BIG-IP: push from the appliance over the API, port 443	No¹ Full answer The Standard package has neither push provisioning connectors nor ACME/SCEP/EST	Yes¹⁷ Full answer F5 BIG-IP LTM machine via VSatellite, versions 13.1.x-17.1.x	Yes¹⁷ Full answer F5 BIG-IP LTM machine via VSatellite, versions 13.1.x-17.1.x	Yes¹⁸ Full answer F5 LTM Advanced driver, iControl over HTTPS 443
NetScaler	Yes Full answer Citrix NetScaler / ADC: push from the appliance over the API, port 443	No¹ Full answer The Standard package has neither push provisioning connectors nor ACME/SCEP/EST	Yes¹⁹ Full answer Citrix ADC machine via VSatellite, versions 11.1, 12.1 and 13.0	Yes¹⁹ Full answer Citrix ADC machine via VSatellite, versions 11.1, 12.1 and 13.0	Yes²⁰ Full answer NetScaler driver, Nitro API over 443/tcp
SonicWall	Yes Full answer SonicWall SonicOS: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Not stated
Palo Alto	Yes Full answer Palo Alto Networks PAN-OS: push from the appliance over the API, port 443	No¹ Full answer The Standard package has neither push provisioning connectors nor ACME/SCEP/EST	Yes²¹ Full answer Palo Alto Networks Panorama machine via VSatellite	Yes²¹ Full answer Palo Alto Networks Panorama machine via VSatellite	Yes¹⁴ Full answer Palo Alto Networks NGFW driver, XML API
Check Point	Yes Full answer Check Point HTTPS Inspection: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Not stated
Kemp LoadMaster	Yes Full answer Kemp LoadMaster: push from the appliance over the API, port 443	No¹ Full answer The Standard package has neither push provisioning connectors nor ACME/SCEP/EST	Yes²² Full answer Kemp Virtual LoadMaster machine via VSatellite	Yes²² Full answer Kemp Virtual LoadMaster machine via VSatellite	Not stated
Cisco	Yes Full answer Cisco Secure Firewall (FDM): push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Not stated
IIS	Yes Full answer Microsoft IIS: service agent on the server	No¹ Full answer The Standard package has neither push provisioning connectors nor ACME/SCEP/EST	Yes²³ Full answer Microsoft IIS machine, WinRM 5985/5986 from VSatellite	Yes²³ Full answer Microsoft IIS machine, WinRM 5985/5986 from VSatellite	Yes²⁴ Full answer CAPI driver via WinRM, IIS driver via DCOM, or Server Agent
Exchange	Yes Full answer Microsoft Exchange: service agent on the server	Not stated	Not stated	Not stated	Not stated
nginx and Apache	Yes Full answer Nginx: service agent on the server; Apache HTTP Server: service agent on the server	No¹ Full answer The Standard package has neither push provisioning connectors nor ACME/SCEP/EST	Yes^25,13 Full answer Common KeyStore machine, PEM files via SSH from VSatellite; or an ACME client connecting to the ACMEv2 server	Yes^25,13 Full answer Common KeyStore machine, PEM files via SSH from VSatellite; or an ACME client connecting to the ACMEv2 server	Yes^14,8,9 Full answer Apache/PEM driver, agentless or with Server Agent; also the customer's ACME client such as certbot or acme.sh
Tomcat (JKS)	Yes Full answer Apache Tomcat: service agent on the server	No¹ Full answer The Standard package has neither push provisioning connectors nor ACME/SCEP/EST	Yes²⁵ Full answer Common KeyStore machine with keystore type JKS or PKCS#12	Yes²⁵ Full answer Common KeyStore machine with keystore type JKS or PKCS#12	Yes¹⁴ Full answer Java Keystore driver via SSH or Server Agent
Azure Key Vault	Yes Full answer Azure Key Vault: push from the appliance over the API, port 443	No¹ Full answer The Standard package has neither push provisioning connectors nor ACME/SCEP/EST	Yes²⁶ Full answer Microsoft Azure Key Vault machine or cloud keystore; requires an active VSatellite	Yes²⁶ Full answer Microsoft Azure Key Vault machine or cloud keystore; requires an active VSatellite	Yes¹⁴ Full answer Azure Key Vault driver, API
AWS Certificate Manager	Yes Full answer AWS Certificate Manager: push from the appliance over the API, port 443	No¹ Full answer The Standard package has neither push provisioning connectors nor ACME/SCEP/EST	Yes²⁷ Full answer AWS ACM as a cloud keystore; requires an active VSatellite	Yes²⁷ Full answer AWS ACM as a cloud keystore; requires an active VSatellite	Not stated
Push without an agent
Push with no software on the destination	50 destinations Show the list Akamai CPS (push from the appliance over the API, port 443) Aruba/HPE ClearPass (push from the appliance over the API, port 443) AWS Certificate Manager (push from the appliance over the API, port 443) AWS CloudFront (push from the appliance over the API, port 443) AWS ELB & API Gateway (push from the appliance over the API, port 443) Azure App Service (push from the appliance over the API, port 443) Azure Application Gateway (push from the appliance over the API, port 443) Azure Front Door (push from the appliance over the API, port 443) Azure Key Vault (push from the appliance over the API, port 443) Barracuda CloudGen Firewall (push from the appliance over the API, port 8443) Barracuda Web Application Firewall (push from the appliance over the API, port 8443) Bunny.net CDN (push from the appliance over the API, port 443) Check Point HTTPS Inspection (push from the appliance over the API, port 443) Cisco ASA / ASAv (push from the appliance over SSH, port 22) Cisco ISE (push from the appliance over the API, port 443) Cisco Secure Firewall (FDM) (push from the appliance over the API, port 443) Cisco Secure Firewall (FMC) (push from the appliance over the API, port 443) Citrix NetScaler / ADC (push from the appliance over the API, port 443) Cloudflare (push from the appliance over the API, port 443) Dell iDRAC (push from the appliance over the API, port 443) F5 BIG-IP (push from the appliance over the API, port 443) Fortinet FortiADC (push from the appliance over the API, port 443) Fortinet FortiGate (push from the appliance over the API, port 443) Fortinet FortiMail (push from the appliance over SSH, port 22) Fortinet FortiManager (push from the appliance over the API, port 443) Fortinet FortiNAC (push from the appliance over the API, port 8443) Fortinet FortiWeb WAF (push from the appliance over the API, port 443) Google Cloud Certificate Manager (push from the appliance over the API, port 443) HPE iLO (push from the appliance over the API, port 443) Infoblox NIOS Grid Manager (push from the appliance over the API, port 443) Ivanti Connect Secure (push from the appliance over the API, port 443) Juniper SRX / vSRX (push from the appliance over SSH, port 22) Kemp LoadMaster (push from the appliance over the API, port 443) Kubernetes (push from the appliance over the API, port 6443) NetApp ONTAP (push from the appliance over the API, port 443) OPNsense (push from the appliance over the API, port 443) Palo Alto Networks PAN-OS (push from the appliance over the API, port 443) pfSense (push from the appliance over SSH, port 22) Proxmox Backup Server (push from the appliance over the API, port 8007) Proxmox Mail Gateway (push from the appliance over the API, port 8006) Proxmox VE (push from the appliance over the API, port 8006) SonicWall SonicOS (push from the appliance over the API, port 443) Sophos Firewall (push from the appliance over the API, port 4444) Synology DSM (push from the appliance over the API, port 5001) TrueNAS SCALE / CORE (push from the appliance over the API, port 443) Ubiquiti UniFi (push from the appliance over SSH, port 22) VMware Avi / NSX ALB (push from the appliance over the API, port 443) VMware ESXi (push from the appliance over SSH, port 22) VMware vCenter (push from the appliance over the API, port 443) WatchGuard Firebox (Local: SSH 4118 · Cloud: HTTPS 443) See the integrations	Not stated	24 destinations Show the list A10 Thunder ADC²¹ Akamai CDN (cloud provider via VSatellite; only for existing Akamai enrollments)^28,29 Amazon Secrets Manager²¹ AWS Certificate Manager (ACM), cloud keystore via VSatellite^27,29 Citrix ADC (NetScaler)²¹ Cloudflare²¹ Common KeyStore: PEM, JKS or PKCS#12 on Linux via SSH or Windows via WinRM^25,13 F5 BIG-IP LTM²¹ F5 Distributed Cloud²¹ Fortinet FortiGate²¹ Google Cloud Certificate Manager (cloud keystore)^30,29 Google Cloud Classic Load Balancer²¹ IBM DataPower Gateway²¹ Imperva WAF²¹ Kemp Virtual LoadMaster²¹ Microsoft Azure API Management⁵ Microsoft Azure Application Gateway²¹ Microsoft Azure Key Vault²¹ Microsoft IIS (WinRM from VSatellite)²³ Microsoft SQL Server (WinRM from VSatellite; the PowerShell module dbatools must be installed on the SQL server)^21,6 Windows certificate store (CAPI) via WinRM (Microsoft Windows (PowerShell) machine); the customer’s PowerShell function binds the certificate after installation^5,31 Palo Alto Networks Panorama²¹ Radware Alteon ADC²¹ VMware NSX Advanced Load Balancer (AVI)²¹ What the list covers: The machine types with a provisioning guide in the vendor’s docs (docs.venafi.cloud and docs.paloaltonetworks.com have the same 21 types) plus cloud keystores and the cloud provider Akamai. Azure Application Registration is discovery only and is not counted. The vendor’s docs are the complete catalogue of built-in machine types; partner connectors in CyberArk Marketplace are not counted⁵	24 destinations Show the list A10 Thunder ADC²¹ Akamai CDN (cloud provider via VSatellite; only for existing Akamai enrollments)^28,29 Amazon Secrets Manager²¹ AWS Certificate Manager (ACM), cloud keystore via VSatellite^27,29 Citrix ADC (NetScaler)²¹ Cloudflare²¹ Common KeyStore: PEM, JKS or PKCS#12 on Linux via SSH or Windows via WinRM^25,13 F5 BIG-IP LTM²¹ F5 Distributed Cloud²¹ Fortinet FortiGate²¹ Google Cloud Certificate Manager (cloud keystore)^30,29 Google Cloud Classic Load Balancer²¹ IBM DataPower Gateway²¹ Imperva WAF²¹ Kemp Virtual LoadMaster²¹ Microsoft Azure API Management⁵ Microsoft Azure Application Gateway²¹ Microsoft Azure Key Vault²¹ Microsoft IIS (WinRM from VSatellite)²³ Microsoft SQL Server (WinRM from VSatellite; the PowerShell module dbatools must be installed on the SQL server)^21,6 Windows certificate store (CAPI) via WinRM (Microsoft Windows (PowerShell) machine); the customer’s PowerShell function binds the certificate after installation^5,31 Palo Alto Networks Panorama²¹ Radware Alteon ADC²¹ VMware NSX Advanced Load Balancer (AVI)²¹ What the list covers: The machine types with a provisioning guide in the vendor’s docs (docs.venafi.cloud and docs.paloaltonetworks.com have the same 21 types) plus cloud keystores and the cloud provider Akamai. Azure Application Registration is discovery only and is not counted. The vendor’s docs are the complete catalogue of built-in machine types; partner connectors in CyberArk Marketplace are not counted⁵	20 destinations Show the list AWS Elastic Load Balancing (ALB and Classic ELB; the vendor’s AWS driver, REST API)^14,32,33 Amazon CloudFront (the vendor’s AWS driver, REST API)^14,32,33 AWS IAM server certificates (the vendor’s AWS driver, REST API)^14,32,33 Apache HTTP Server (Apache-driver, SSH CLI)^14,33 Azure Key Vault (API via SDK)^14,33 Citrix NetScaler VPX and MPX (with HSM) (REST/Nitro API over HTTPS or SSH CLI)^14,33,20 F5 BIG-IP LTM (iControl over HTTPS; API via SDK or REST)^14,33,18 Google Cloud Load Balancer (external proxies only)¹⁴ HashiCorp Vault PKI¹⁴ IBM Sterling Connect:Direct¹⁴ IBM WebSphere DataPower (REST/XML-API or SSH CLI; FTP for transferring certificate files)^14,33,34 Imperva MX (SSH CLI)^14,33 File-based keystores on servers: PEM, Java Keystore (JKS and JCEKS), PKCS#12 and IBM GSK (SSH CLI)^14,33 Windows certificate store (CAPI driver via WinRM)^24,33 Microsoft IIS (the CAPI driver binds to IIS 7.0 and later via WinRM; IIS driver via DCOM)^24,14,33 Apache Tomcat (via the Java Keystore driver, SSH CLI)^14,33 Oracle iPlanet (NSS-keystore, SSH CLI)^14,33 Palo Alto Networks Next Generation Firewall (XML-RPC API)^14,33 Riverbed SteelHead WAN Optimizer (SSH CLI)^14,33 Tealeaf PCA (Passive Capture Appliance) (SSH CLI)^14,33 What the list covers: The vendor’s two lists of native installation drivers in version 26.1 ("Supported Appliances" and "Supported Keystores and Applications for Provisioning"), with duplicates merged. Adaptable Application (the customer’s script) and third-party Marketplace drivers are not counted; the vendor itself states that the list is not exhaustive as to what can be automated¹⁴
Private keys
Where the private key is kept	On-prem appliance See the architecture	Not stated	On-prem at the customer³⁵ The destination⁴	On-prem at the customer³⁵ The destination⁴	On-prem at the customer³⁶ The destination³⁶
Network
Servers with an agent or ACME	The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports	Not stated	No agent on the servers^15,37 Full answer VSatellite (Linux server at the customer) connects only outbound to the SaaS region’s API on 443 (e.g. api.eu.venafi.cloud:443) and dl/registry.venafi.cloud:443, no inbound internet connection. ACME clients connect to the ACMEv2 server in the SaaS service; port not stated	No agent on the servers^15,37 Full answer VSatellite (Linux server at the customer) connects only outbound to the SaaS region’s API on 443 (e.g. api.eu.venafi.cloud:443) and dl/registry.venafi.cloud:443, no inbound internet connection. ACME clients connect to the ACMEv2 server in the SaaS service; port not stated	Server Agent initiates the connection to the Trust Protection Foundation server’s URL over HTTPS (proxy possible)^38,34 Full answer ACME clients connect to the server’s ACME URL; EST on port 50443. The server is on-prem at the customer; whether it must be reachable from the internet is not stated (port 80 is required only for SCEP and timestamping)
Equipment without an agent	The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet	Not stated	VSatellite in the customer’s network connects to the equipment: HTTPS 443 by default to ADCs/firewalls (e.g. F5, Citrix, Kemp, FortiGate), WinRM 5985/5986 and Kerberos 88 to Windows, SSH to Linux (port specified per machine).^39,23,21 Full answer Azure API Management, Cloudflare and Imperva WAF are reached directly from the SaaS service without VSatellite; AWS ACM and Azure Key Vault require an active VSatellite	VSatellite in the customer’s network connects to the equipment: HTTPS 443 by default to ADCs/firewalls (e.g. F5, Citrix, Kemp, FortiGate), WinRM 5985/5986 and Kerberos 88 to Windows, SSH to Linux (port specified per machine).^39,23,21 Full answer Azure API Management, Cloudflare and Imperva WAF are reached directly from the SaaS service without VSatellite; AWS ACM and Azure Key Vault require an active VSatellite	The Trust Protection Foundation server initiates the connection: SSH 22, HTTPS 443 (F5 iControl, NetScaler Nitro), DCOM 135 (IIS), FTP 21 (DataPower), WinRM (CAPI)^8,34
Windows and Linux
Windows	Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports	Not stated	Agentless from VSatellite via WinRM (TCP 5985/5986, Kerberos 88): IIS, SQL Server, Windows (PowerShell) or Common KeyStore machine²³	Agentless from VSatellite via WinRM (TCP 5985/5986, Kerberos 88): IIS, SQL Server, Windows (PowerShell) or Common KeyStore machine²³	Agentless via WinRM (CAPI driver) or DCOM 135 (IIS driver), or Server Agent on the server (Windows Server 2012-2025)⁸ Full answer JKS/PEM/PKCS#12 on Windows without an agent requires a third-party SSH server
Linux	Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports	Not stated	Agentless from VSatellite via SSH (Common KeyStore: PEM, JKS, PKCS#12; optional restart of systemd service), or the customer’s ACME client against the ACMEv2 server^40,13	Agentless from VSatellite via SSH (Common KeyStore: PEM, JKS, PKCS#12; optional restart of systemd service), or the customer’s ACME client against the ACMEv2 server^40,13	Agentless via SSH 22 (PEM, JKS, PKCS#12, GSK) or Server Agent (RHEL, CentOS, SUSE), or ACME client (certbot, acme.sh)⁸
Branch offices
Remote sites and branch offices	One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports	Not stated	VSatellites are installed in the private networks to be reached (multiple can be grouped for high availability)^41,15 Full answer each VSatellite requires only an outbound connection. VPN requirements are not stated	VSatellites are installed in the private networks to be reached (multiple can be grouped for high availability)^41,15 Full answer each VSatellite requires only an outbound connection. VPN requirements are not stated	Multiple Trust Protection Foundation servers as "processing engines" per site (Management Zones), Server Agent when the server cannot reach the device, and jump server for SSH drivers^42,43
Vendor and EU
Vendor	FairSSL A/S, Denmark	CyberArk (Israel/USA), owned by Palo Alto Networks, Inc. (USA) since 11-02-2026.^11,12 Full answer The EULA for Self-Hosted lists CyberArk entities in USA, UK, Israel, Canada, Singapore, Japan, India, Australia, Turkey and Venafi, Inc. (USA); no entity in the EU	CyberArk (Israel/USA), owned by Palo Alto Networks, Inc. (USA) since 11-02-2026.^11,12 Full answer The EULA for Self-Hosted lists CyberArk entities in USA, UK, Israel, Canada, Singapore, Japan, India, Australia, Turkey and Venafi, Inc. (USA); no entity in the EU	Palo Alto Networks, Inc. (USA)²	CyberArk (Israel/USA), owned by Palo Alto Networks, Inc. (USA) since 11-02-2026.^11,12 Full answer The EULA for Self-Hosted lists CyberArk entities in USA, UK, Israel, Canada, Singapore, Japan, India, Australia, Turkey and Venafi, Inc. (USA); no entity in the EU
Hosting and the EU	EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud) See the infrastructure	The customer chooses the region³⁷ Full answer Europe is one of six regions (USA, Australia, Canada, Europe, Singapore, UK). The data centre country within Europe is not stated	The customer chooses the region³⁷ Full answer Europe is one of six regions (USA, Australia, Canada, Europe, Singapore, UK). The data centre country within Europe is not stated	The region is selected at activation and cannot be changed^10,44 Full answer the vendor has NAT gateways in USA, Europe, UK, Australia, Canada and Singapore	On-prem at the customer: Trust Protection Foundation servers and database (e.g. Microsoft SQL) in the customer’s own environment³⁴

sslbrain

Price

Price per year and per month: Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint.

See the prices

Automation

How the certificate gets there: Both agents/push and ACME

Full answer

a service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH.
Direct agents and connectors: 72 integrations in the catalogue

See the integrations
Without a direct agent: Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME

Named systems

FortiGate: Yes

Full answer

Fortinet FortiGate: push from the appliance over the API, port 443
F5 BIG-IP: Yes

Full answer

F5 BIG-IP: push from the appliance over the API, port 443
NetScaler: Yes

Full answer

Citrix NetScaler / ADC: push from the appliance over the API, port 443
SonicWall: Yes

Full answer

SonicWall SonicOS: push from the appliance over the API, port 443
Palo Alto: Yes

Full answer

Palo Alto Networks PAN-OS: push from the appliance over the API, port 443
Check Point: Yes

Full answer

Check Point HTTPS Inspection: push from the appliance over the API, port 443
Kemp LoadMaster: Yes

Full answer

Kemp LoadMaster: push from the appliance over the API, port 443
Cisco: Yes

Full answer

Cisco Secure Firewall (FDM): push from the appliance over the API, port 443
IIS: Yes

Full answer

Microsoft IIS: service agent on the server
Exchange: Yes

Full answer

Microsoft Exchange: service agent on the server
nginx and Apache: Yes

Full answer

Nginx: service agent on the server; Apache HTTP Server: service agent on the server
Tomcat (JKS): Yes

Full answer

Apache Tomcat: service agent on the server
Azure Key Vault: Yes

Full answer

Azure Key Vault: push from the appliance over the API, port 443
AWS Certificate Manager: Yes

Full answer

AWS Certificate Manager: push from the appliance over the API, port 443

Push without an agent

Push with no software on the destination: 50 destinations

Show the list

Akamai CPS (push from the appliance over the API, port 443)
Aruba/HPE ClearPass (push from the appliance over the API, port 443)
AWS Certificate Manager (push from the appliance over the API, port 443)
AWS CloudFront (push from the appliance over the API, port 443)
AWS ELB & API Gateway (push from the appliance over the API, port 443)
Azure App Service (push from the appliance over the API, port 443)
Azure Application Gateway (push from the appliance over the API, port 443)
Azure Front Door (push from the appliance over the API, port 443)
Azure Key Vault (push from the appliance over the API, port 443)
Barracuda CloudGen Firewall (push from the appliance over the API, port 8443)
Barracuda Web Application Firewall (push from the appliance over the API, port 8443)
Bunny.net CDN (push from the appliance over the API, port 443)
Check Point HTTPS Inspection (push from the appliance over the API, port 443)
Cisco ASA / ASAv (push from the appliance over SSH, port 22)
Cisco ISE (push from the appliance over the API, port 443)
Cisco Secure Firewall (FDM) (push from the appliance over the API, port 443)
Cisco Secure Firewall (FMC) (push from the appliance over the API, port 443)
Citrix NetScaler / ADC (push from the appliance over the API, port 443)
Cloudflare (push from the appliance over the API, port 443)
Dell iDRAC (push from the appliance over the API, port 443)
F5 BIG-IP (push from the appliance over the API, port 443)
Fortinet FortiADC (push from the appliance over the API, port 443)
Fortinet FortiGate (push from the appliance over the API, port 443)
Fortinet FortiMail (push from the appliance over SSH, port 22)
Fortinet FortiManager (push from the appliance over the API, port 443)
Fortinet FortiNAC (push from the appliance over the API, port 8443)
Fortinet FortiWeb WAF (push from the appliance over the API, port 443)
Google Cloud Certificate Manager (push from the appliance over the API, port 443)
HPE iLO (push from the appliance over the API, port 443)
Infoblox NIOS Grid Manager (push from the appliance over the API, port 443)
Ivanti Connect Secure (push from the appliance over the API, port 443)
Juniper SRX / vSRX (push from the appliance over SSH, port 22)
Kemp LoadMaster (push from the appliance over the API, port 443)
Kubernetes (push from the appliance over the API, port 6443)
NetApp ONTAP (push from the appliance over the API, port 443)
OPNsense (push from the appliance over the API, port 443)
Palo Alto Networks PAN-OS (push from the appliance over the API, port 443)
pfSense (push from the appliance over SSH, port 22)
Proxmox Backup Server (push from the appliance over the API, port 8007)
Proxmox Mail Gateway (push from the appliance over the API, port 8006)
Proxmox VE (push from the appliance over the API, port 8006)
SonicWall SonicOS (push from the appliance over the API, port 443)
Sophos Firewall (push from the appliance over the API, port 4444)
Synology DSM (push from the appliance over the API, port 5001)
TrueNAS SCALE / CORE (push from the appliance over the API, port 443)
Ubiquiti UniFi (push from the appliance over SSH, port 22)
VMware Avi / NSX ALB (push from the appliance over the API, port 443)
VMware ESXi (push from the appliance over SSH, port 22)
VMware vCenter (push from the appliance over the API, port 443)
WatchGuard Firebox (Local: SSH 4118 · Cloud: HTTPS 443)

See the integrations

Private keys

Where the private key is kept: On-prem appliance

See the architecture

Network

Servers with an agent or ACME: The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports
Equipment without an agent: The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet

Windows and Linux

Windows: Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports
Linux: Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports

Branch offices

Remote sites and branch offices: One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports

Vendor and EU

Vendor: FairSSL A/S, Denmark
Hosting and the EU: EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud)

See the infrastructure

SaaS Standard

Price

Price per year and per month: Not public, requires a sales conversation¹

Automation

How the certificate gets there: No automatic installation¹

Full answer

The Standard package has issuance, discovery and monitoring, but neither push provisioning nor ACME/SCEP/EST
Direct agents and connectors: 0¹

Full answer

push provisioning connectors are not included in Standard
Without a direct agent: The manufacturer refers to the Enterprise package for push and automation¹

Full answer

no other installation method is stated for Standard

Named systems

FortiGate: No¹

Full answer

The Standard package has neither push provisioning connectors nor ACME/SCEP/EST
F5 BIG-IP: No¹

Full answer

The Standard package has neither push provisioning connectors nor ACME/SCEP/EST
NetScaler: No¹

Full answer

The Standard package has neither push provisioning connectors nor ACME/SCEP/EST
SonicWall: Not stated
Palo Alto: No¹

Full answer

The Standard package has neither push provisioning connectors nor ACME/SCEP/EST
Check Point: Not stated
Kemp LoadMaster: No¹

Full answer

The Standard package has neither push provisioning connectors nor ACME/SCEP/EST
Cisco: Not stated
IIS: No¹

Full answer

The Standard package has neither push provisioning connectors nor ACME/SCEP/EST
Exchange: Not stated
nginx and Apache: No¹

Full answer

The Standard package has neither push provisioning connectors nor ACME/SCEP/EST
Tomcat (JKS): No¹

Full answer

The Standard package has neither push provisioning connectors nor ACME/SCEP/EST
Azure Key Vault: No¹

Full answer

The Standard package has neither push provisioning connectors nor ACME/SCEP/EST
AWS Certificate Manager: No¹

Full answer

The Standard package has neither push provisioning connectors nor ACME/SCEP/EST

Push without an agent

Push with no software on the destination: Not stated

Private keys

Where the private key is kept: Not stated

Network

Servers with an agent or ACME: Not stated
Equipment without an agent: Not stated

Windows and Linux

Windows: Not stated
Linux: Not stated

Branch offices

Remote sites and branch offices: Not stated

Vendor and EU

Vendor: CyberArk (Israel/USA), owned by Palo Alto Networks, Inc. (USA) since 11-02-2026.^11,12

Full answer

The EULA for Self-Hosted lists CyberArk entities in USA, UK, Israel, Canada, Singapore, Japan, India, Australia, Turkey and Venafi, Inc. (USA); no entity in the EU
Hosting and the EU: The customer chooses the region³⁷

Full answer

Europe is one of six regions (USA, Australia, Canada, Europe, Singapore, UK). The data centre country within Europe is not stated

SaaS Enterprise

Price

Price per year and per month: Not public, requires a sales conversation¹

Automation

How the certificate gets there: Both agents/push and ACME^1,4

Full answer

push to machines and cloud keystores via VSatellite or cloud APIs, plus an ACMEv2 server for the customer's ACME clients (the manufacturer's package table calls ACME/SCEP/EST "partial" for Enterprise)
Direct agents and connectors: 24¹³

Full answer

21 machine types with provisioning guidance, AWS ACM and Google Cloud Certificate Manager as cloud keystores, Akamai CDN as a cloud provider
Without a direct agent: Common KeyStore machine (PEM/JKS/PKCS#12 via SSH or WinRM), Microsoft Windows (PowerShell) machine with the customer's own script, an ACMEv2 server for the customer's ACME client, or a custom connector built with the manufacturer's connector framework^5,4,15

Named systems

FortiGate: Yes¹⁶

Full answer

Fortinet FortiGate machine, REST API from VSatellite, port 443 by default
F5 BIG-IP: Yes¹⁷

Full answer

F5 BIG-IP LTM machine via VSatellite, versions 13.1.x-17.1.x
NetScaler: Yes¹⁹

Full answer

Citrix ADC machine via VSatellite, versions 11.1, 12.1 and 13.0
SonicWall: Not stated
Palo Alto: Yes²¹

Full answer

Palo Alto Networks Panorama machine via VSatellite
Check Point: Not stated
Kemp LoadMaster: Yes²²

Full answer

Kemp Virtual LoadMaster machine via VSatellite
Cisco: Not stated
IIS: Yes²³

Full answer

Microsoft IIS machine, WinRM 5985/5986 from VSatellite
Exchange: Not stated
nginx and Apache: Yes^25,13

Full answer

Common KeyStore machine, PEM files via SSH from VSatellite; or an ACME client connecting to the ACMEv2 server
Tomcat (JKS): Yes²⁵

Full answer

Common KeyStore machine with keystore type JKS or PKCS#12
Azure Key Vault: Yes²⁶

Full answer

Microsoft Azure Key Vault machine or cloud keystore; requires an active VSatellite
AWS Certificate Manager: Yes²⁷

Full answer

AWS ACM as a cloud keystore; requires an active VSatellite

Push without an agent

Push with no software on the destination: 24 destinations

Show the list

A10 Thunder ADC²¹
Akamai CDN (cloud provider via VSatellite; only for existing Akamai enrollments)^28,29
Amazon Secrets Manager²¹
AWS Certificate Manager (ACM), cloud keystore via VSatellite^27,29
Citrix ADC (NetScaler)²¹
Cloudflare²¹
Common KeyStore: PEM, JKS or PKCS#12 on Linux via SSH or Windows via WinRM^25,13
F5 BIG-IP LTM²¹
F5 Distributed Cloud²¹
Fortinet FortiGate²¹
Google Cloud Certificate Manager (cloud keystore)^30,29
Google Cloud Classic Load Balancer²¹
IBM DataPower Gateway²¹
Imperva WAF²¹
Kemp Virtual LoadMaster²¹
Microsoft Azure API Management⁵
Microsoft Azure Application Gateway²¹
Microsoft Azure Key Vault²¹
Microsoft IIS (WinRM from VSatellite)²³
Microsoft SQL Server (WinRM from VSatellite; the PowerShell module dbatools must be installed on the SQL server)^21,6
Windows certificate store (CAPI) via WinRM (Microsoft Windows (PowerShell) machine); the customer’s PowerShell function binds the certificate after installation^5,31
Palo Alto Networks Panorama²¹
Radware Alteon ADC²¹
VMware NSX Advanced Load Balancer (AVI)²¹

What the list covers: The machine types with a provisioning guide in the vendor’s docs (docs.venafi.cloud and docs.paloaltonetworks.com have the same 21 types) plus cloud keystores and the cloud provider Akamai. Azure Application Registration is discovery only and is not counted. The vendor’s docs are the complete catalogue of built-in machine types; partner connectors in CyberArk Marketplace are not counted⁵

Private keys

Where the private key is kept: On-prem at the customer³⁵
The destination⁴

Network

Servers with an agent or ACME: No agent on the servers^15,37

Full answer

VSatellite (Linux server at the customer) connects only outbound to the SaaS region’s API on 443 (e.g. api.eu.venafi.cloud:443) and dl/registry.venafi.cloud:443, no inbound internet connection. ACME clients connect to the ACMEv2 server in the SaaS service; port not stated
Equipment without an agent: VSatellite in the customer’s network connects to the equipment: HTTPS 443 by default to ADCs/firewalls (e.g. F5, Citrix, Kemp, FortiGate), WinRM 5985/5986 and Kerberos 88 to Windows, SSH to Linux (port specified per machine).^39,23,21

Full answer

Azure API Management, Cloudflare and Imperva WAF are reached directly from the SaaS service without VSatellite; AWS ACM and Azure Key Vault require an active VSatellite

Windows and Linux

Windows: Agentless from VSatellite via WinRM (TCP 5985/5986, Kerberos 88): IIS, SQL Server, Windows (PowerShell) or Common KeyStore machine²³
Linux: Agentless from VSatellite via SSH (Common KeyStore: PEM, JKS, PKCS#12; optional restart of systemd service), or the customer’s ACME client against the ACMEv2 server^40,13

Branch offices

Remote sites and branch offices: VSatellites are installed in the private networks to be reached (multiple can be grouped for high availability)^41,15

Full answer

each VSatellite requires only an outbound connection. VPN requirements are not stated

Vendor and EU

Vendor: CyberArk (Israel/USA), owned by Palo Alto Networks, Inc. (USA) since 11-02-2026.^11,12

Full answer

The EULA for Self-Hosted lists CyberArk entities in USA, UK, Israel, Canada, Singapore, Japan, India, Australia, Turkey and Venafi, Inc. (USA); no entity in the EU
Hosting and the EU: The customer chooses the region³⁷

Full answer

Europe is one of six regions (USA, Australia, Canada, Europe, Singapore, UK). The data centre country within Europe is not stated

Next-Gen Trust Security

Price

Price per year and per month: Not public, requires a sales conversation¹⁰

Automation

How the certificate gets there: Both agents/push and ACME^5,6,7

Full answer

machines that let Next-Gen Trust Security connect directly to application keystores via VSatellite, plus an ACMEv2 server for the customer's ACME clients
Direct agents and connectors: 24¹³

Full answer

21 machine types with provisioning guidance, AWS ACM and Google Cloud Certificate Manager as cloud keystores, Akamai CDN as a cloud provider
Without a direct agent: Common KeyStore machine (PEM/JKS/PKCS#12 via SSH or WinRM), Microsoft Windows (PowerShell) machine with the customer's own script, an ACMEv2 server for the customer's ACME client, or a custom connector built with the manufacturer's connector framework^5,4,15

Named systems

FortiGate: Yes¹⁶

Full answer

Fortinet FortiGate machine, REST API from VSatellite, port 443 by default
F5 BIG-IP: Yes¹⁷

Full answer

F5 BIG-IP LTM machine via VSatellite, versions 13.1.x-17.1.x
NetScaler: Yes¹⁹

Full answer

Citrix ADC machine via VSatellite, versions 11.1, 12.1 and 13.0
SonicWall: Not stated
Palo Alto: Yes²¹

Full answer

Palo Alto Networks Panorama machine via VSatellite
Check Point: Not stated
Kemp LoadMaster: Yes²²

Full answer

Kemp Virtual LoadMaster machine via VSatellite
Cisco: Not stated
IIS: Yes²³

Full answer

Microsoft IIS machine, WinRM 5985/5986 from VSatellite
Exchange: Not stated
nginx and Apache: Yes^25,13

Full answer

Common KeyStore machine, PEM files via SSH from VSatellite; or an ACME client connecting to the ACMEv2 server
Tomcat (JKS): Yes²⁵

Full answer

Common KeyStore machine with keystore type JKS or PKCS#12
Azure Key Vault: Yes²⁶

Full answer

Microsoft Azure Key Vault machine or cloud keystore; requires an active VSatellite
AWS Certificate Manager: Yes²⁷

Full answer

AWS ACM as a cloud keystore; requires an active VSatellite

Push without an agent

Push with no software on the destination: 24 destinations

Show the list

A10 Thunder ADC²¹
Akamai CDN (cloud provider via VSatellite; only for existing Akamai enrollments)^28,29
Amazon Secrets Manager²¹
AWS Certificate Manager (ACM), cloud keystore via VSatellite^27,29
Citrix ADC (NetScaler)²¹
Cloudflare²¹
Common KeyStore: PEM, JKS or PKCS#12 on Linux via SSH or Windows via WinRM^25,13
F5 BIG-IP LTM²¹
F5 Distributed Cloud²¹
Fortinet FortiGate²¹
Google Cloud Certificate Manager (cloud keystore)^30,29
Google Cloud Classic Load Balancer²¹
IBM DataPower Gateway²¹
Imperva WAF²¹
Kemp Virtual LoadMaster²¹
Microsoft Azure API Management⁵
Microsoft Azure Application Gateway²¹
Microsoft Azure Key Vault²¹
Microsoft IIS (WinRM from VSatellite)²³
Microsoft SQL Server (WinRM from VSatellite; the PowerShell module dbatools must be installed on the SQL server)^21,6
Windows certificate store (CAPI) via WinRM (Microsoft Windows (PowerShell) machine); the customer’s PowerShell function binds the certificate after installation^5,31
Palo Alto Networks Panorama²¹
Radware Alteon ADC²¹
VMware NSX Advanced Load Balancer (AVI)²¹

What the list covers: The machine types with a provisioning guide in the vendor’s docs (docs.venafi.cloud and docs.paloaltonetworks.com have the same 21 types) plus cloud keystores and the cloud provider Akamai. Azure Application Registration is discovery only and is not counted. The vendor’s docs are the complete catalogue of built-in machine types; partner connectors in CyberArk Marketplace are not counted⁵

Private keys

Where the private key is kept: On-prem at the customer³⁵
The destination⁴

Network

Servers with an agent or ACME: No agent on the servers^15,37

Full answer

VSatellite (Linux server at the customer) connects only outbound to the SaaS region’s API on 443 (e.g. api.eu.venafi.cloud:443) and dl/registry.venafi.cloud:443, no inbound internet connection. ACME clients connect to the ACMEv2 server in the SaaS service; port not stated
Equipment without an agent: VSatellite in the customer’s network connects to the equipment: HTTPS 443 by default to ADCs/firewalls (e.g. F5, Citrix, Kemp, FortiGate), WinRM 5985/5986 and Kerberos 88 to Windows, SSH to Linux (port specified per machine).^39,23,21

Full answer

Azure API Management, Cloudflare and Imperva WAF are reached directly from the SaaS service without VSatellite; AWS ACM and Azure Key Vault require an active VSatellite

Windows and Linux

Windows: Agentless from VSatellite via WinRM (TCP 5985/5986, Kerberos 88): IIS, SQL Server, Windows (PowerShell) or Common KeyStore machine²³
Linux: Agentless from VSatellite via SSH (Common KeyStore: PEM, JKS, PKCS#12; optional restart of systemd service), or the customer’s ACME client against the ACMEv2 server^40,13

Branch offices

Remote sites and branch offices: VSatellites are installed in the private networks to be reached (multiple can be grouped for high availability)^41,15

Full answer

each VSatellite requires only an outbound connection. VPN requirements are not stated

Vendor and EU

Vendor: Palo Alto Networks, Inc. (USA)²
Hosting and the EU: The region is selected at activation and cannot be changed^10,44

Full answer

the vendor has NAT gateways in USA, Europe, UK, Australia, Canada and Singapore

Self-Hosted

Price

Price per year and per month: Not public, requires a sales conversation³

Automation

How the certificate gets there: Both agents/push and ACME^8,9

Full answer

agentless installation from the Trust Protection Foundation server or via Server Agent on the server, plus an ACME server (certbot, win-acme, acme.sh) and EST
Direct agents and connectors: 21¹⁴

Full answer

20 agentless installation targets plus Server Agent
Without a direct agent: The Java Keystore driver for Tomcat and others, the Adaptable Application driver (the customer's PowerShell script), third-party drivers via CyberArk Marketplace, Server Agent, ACME clients or EST¹⁴

Named systems

FortiGate: Not stated
F5 BIG-IP: Yes¹⁸

Full answer

F5 LTM Advanced driver, iControl over HTTPS 443
NetScaler: Yes²⁰

Full answer

NetScaler driver, Nitro API over 443/tcp
SonicWall: Not stated
Palo Alto: Yes¹⁴

Full answer

Palo Alto Networks NGFW driver, XML API
Check Point: Not stated
Kemp LoadMaster: Not stated
Cisco: Not stated
IIS: Yes²⁴

Full answer

CAPI driver via WinRM, IIS driver via DCOM, or Server Agent
Exchange: Not stated
nginx and Apache: Yes^14,8,9

Full answer

Apache/PEM driver, agentless or with Server Agent; also the customer's ACME client such as certbot or acme.sh
Tomcat (JKS): Yes¹⁴

Full answer

Java Keystore driver via SSH or Server Agent
Azure Key Vault: Yes¹⁴

Full answer

Azure Key Vault driver, API
AWS Certificate Manager: Not stated

Push without an agent

Push with no software on the destination: 20 destinations

Show the list

AWS Elastic Load Balancing (ALB and Classic ELB; the vendor’s AWS driver, REST API)^14,32,33
Amazon CloudFront (the vendor’s AWS driver, REST API)^14,32,33
AWS IAM server certificates (the vendor’s AWS driver, REST API)^14,32,33
Apache HTTP Server (Apache-driver, SSH CLI)^14,33
Azure Key Vault (API via SDK)^14,33
Citrix NetScaler VPX and MPX (with HSM) (REST/Nitro API over HTTPS or SSH CLI)^14,33,20
F5 BIG-IP LTM (iControl over HTTPS; API via SDK or REST)^14,33,18
Google Cloud Load Balancer (external proxies only)¹⁴
HashiCorp Vault PKI¹⁴
IBM Sterling Connect:Direct¹⁴
IBM WebSphere DataPower (REST/XML-API or SSH CLI; FTP for transferring certificate files)^14,33,34
Imperva MX (SSH CLI)^14,33
File-based keystores on servers: PEM, Java Keystore (JKS and JCEKS), PKCS#12 and IBM GSK (SSH CLI)^14,33
Windows certificate store (CAPI driver via WinRM)^24,33
Microsoft IIS (the CAPI driver binds to IIS 7.0 and later via WinRM; IIS driver via DCOM)^24,14,33
Apache Tomcat (via the Java Keystore driver, SSH CLI)^14,33
Oracle iPlanet (NSS-keystore, SSH CLI)^14,33
Palo Alto Networks Next Generation Firewall (XML-RPC API)^14,33
Riverbed SteelHead WAN Optimizer (SSH CLI)^14,33
Tealeaf PCA (Passive Capture Appliance) (SSH CLI)^14,33

What the list covers: The vendor’s two lists of native installation drivers in version 26.1 ("Supported Appliances" and "Supported Keystores and Applications for Provisioning"), with duplicates merged. Adaptable Application (the customer’s script) and third-party Marketplace drivers are not counted; the vendor itself states that the list is not exhaustive as to what can be automated¹⁴

Private keys

Where the private key is kept: On-prem at the customer³⁶
The destination³⁶

Network

Servers with an agent or ACME: Server Agent initiates the connection to the Trust Protection Foundation server’s URL over HTTPS (proxy possible)^38,34

Full answer

ACME clients connect to the server’s ACME URL; EST on port 50443. The server is on-prem at the customer; whether it must be reachable from the internet is not stated (port 80 is required only for SCEP and timestamping)
Equipment without an agent: The Trust Protection Foundation server initiates the connection: SSH 22, HTTPS 443 (F5 iControl, NetScaler Nitro), DCOM 135 (IIS), FTP 21 (DataPower), WinRM (CAPI)^8,34

Windows and Linux

Windows: Agentless via WinRM (CAPI driver) or DCOM 135 (IIS driver), or Server Agent on the server (Windows Server 2012-2025)⁸

Full answer

JKS/PEM/PKCS#12 on Windows without an agent requires a third-party SSH server
Linux: Agentless via SSH 22 (PEM, JKS, PKCS#12, GSK) or Server Agent (RHEL, CentOS, SUSE), or ACME client (certbot, acme.sh)⁸

Branch offices

Remote sites and branch offices: Multiple Trust Protection Foundation servers as "processing engines" per site (Management Zones), Server Agent when the server cannot reach the device, and jump server for SSH drivers^42,43

Vendor and EU

Vendor: CyberArk (Israel/USA), owned by Palo Alto Networks, Inc. (USA) since 11-02-2026.^11,12

Full answer

The EULA for Self-Hosted lists CyberArk entities in USA, UK, Israel, Canada, Singapore, Japan, India, Australia, Turkey and Venafi, Inc. (USA); no entity in the EU
Hosting and the EU: On-prem at the customer: Trust Protection Foundation servers and database (e.g. Microsoft SQL) in the customer’s own environment³⁴

When CyberArk (Venafi) fits better

You want SaaS where you choose Europe as the region.³⁷
You want to build your own connectors with the vendor's connector framework (the Enterprise package or Next-Gen Trust Security).^5,4,15

Sources

1. Certificate Manager - SaaS packages and add-ons (docs.venafi.cloud), checked 11-10-2026
2. Next-Gen Trust Security (docs.paloaltonetworks.com), checked 11-10-2026
3. What's new in 26.1, Self-Hosted (docs.venafi.com), checked 11-10-2026
4. ACMEv2 servers overview (docs.venafi.cloud), checked 11-10-2026
5. Create a New Machine (docs.paloaltonetworks.com), checked 11-10-2026
6. Create a Microsoft SQL Server Machine (docs.paloaltonetworks.com), checked 11-10-2026
7. ACME Server overview (docs.paloaltonetworks.com), checked 11-10-2026
8. About certificate installation methods: agentless versus agent 26.1 (docs.venafi.com), checked 11-10-2026
9. ACME integration with Certificate Manager - Self-Hosted 26.1 (docs.venafi.com), checked 11-10-2026
10. Activate Next-Generation Trust Security (docs.paloaltonetworks.com), checked 11-10-2026
11. Palo Alto Networks Completes Acquisition of CyberArk (paloaltonetworks.com), checked 11-10-2026
12. End User License Agreement, Self-Hosted (docs.venafi.com), checked 11-10-2026
13. Common KeyStore machine (docs.venafi.cloud), checked 11-10-2026
14. System requirements for Trust Protection Foundation components 26.1 (docs.venafi.com), checked 11-10-2026
15. vmware-avi-connector README (github.com), checked 11-10-2026
16. Fortinet FortiGate machine (docs.venafi.cloud), checked 11-10-2026
17. Create an F5 BIG-IP LTM Machine (docs.paloaltonetworks.com), checked 11-10-2026
18. F5 prerequisites 26.1 (docs.venafi.com), checked 11-10-2026
19. Create a Citrix ADC Machine (docs.paloaltonetworks.com), checked 11-10-2026
20. NetScaler prerequisites 26.1 (docs.venafi.com), checked 11-10-2026
21. Creating a machine (docs.venafi.cloud), checked 11-10-2026
22. Kemp LoadMaster machine (docs.venafi.cloud), checked 11-10-2026
23. Microsoft IIS machine (docs.venafi.cloud), checked 11-10-2026
24. CAPI driver configuration 26.1 (docs.venafi.com), checked 11-10-2026
25. Provision to Common KeyStore (docs.venafi.cloud), checked 11-10-2026
26. Microsoft Azure Key Vault machine (docs.venafi.cloud), checked 11-10-2026
27. AWS Certificate Manager (docs.venafi.cloud), checked 11-10-2026
28. Akamai integration (docs.venafi.cloud), checked 11-10-2026
29. Cloud Providers Overview, Next-Gen Trust Security (docs.paloaltonetworks.com), checked 11-10-2026
30. Provision certificates to cloud keystores (docs.venafi.cloud), checked 11-10-2026
31. Microsoft Windows (PowerShell) machine (docs.venafi.cloud), checked 11-10-2026
32. Amazon Web Services (AWS) overview 26.1 (docs.venafi.com), checked 11-10-2026
33. Supported integrations: devices, applications, services and features 26.1 (docs.venafi.com), checked 11-10-2026
34. Network connectivity requirements 26.1 (docs.venafi.com), checked 11-10-2026
35. What is Automated Secure Keypair (docs.venafi.cloud), checked 11-10-2026
36. Supported methods of key generation 26.1 (docs.venafi.com), checked 11-10-2026
37. Regional support and networking connections, VSatellite (docs.venafi.cloud), checked 11-10-2026
38. Server Agent registration and installation overview 26.1 (docs.venafi.com), checked 11-10-2026
39. F5 BIG-IP LTM machine (docs.venafi.cloud), checked 11-10-2026
40. Create a Common KeyStore Machine (docs.paloaltonetworks.com), checked 11-10-2026
41. Overview: Venafi VSatellites (docs.paloaltonetworks.com), checked 11-10-2026
42. Management Zones 26.1 (docs.venafi.com), checked 11-10-2026
43. Certificate installation (provisioning) driver support 26.1 (docs.venafi.com), checked 11-10-2026
44. Allowlist Public NAT Gateways (docs.paloaltonetworks.com), checked 11-10-2026

If you see an error about another vendor, write to us. We correct it and update the check date. Write to us

Try sslbrain

Start free. No credit card required.

Download sslbrain See the prices