sslbrain vs Keyfactor Command
Short answer
Keyfactor Command comes self-hosted, in the customer's Kubernetes cluster, hosted by Keyfactor (CLAaaS and PKIaaS) and as Command SaaS Lite.1,2,3,4 Self-hosted, on Kubernetes, as CLAaaS and as PKIaaS, Universal Orchestrator with extensions delivers certificates to destinations over API, SSH or WinRM, or locally as an agent, and Command has its own ACME and SCEP server. Command SaaS Lite automates with ACME; whether extensions can install on destinations with SaaS Lite is not stated.5,6,7,8,9,10 Command SaaS Lite has a public yearly price. The other editions require a sales conversation.11,1,12,4,13
sslbrain runs as an appliance in your own network. The catalogue has 72 integrations. On Windows and Linux servers, a service agent installs the certificate. To network equipment and cloud services, the appliance pushes over API or SSH. Where there is no integration, you use a custom agent or ACME.
How to read the table
- Every answer about another vendor carries a small number. It leads to the source at the foot of the page, with the date the source was last checked.
- "Not stated" means it does not appear in the sources we reviewed. It does not mean no.
- Prices are in the vendor's own currency, not converted. Where only the yearly or the monthly price is stated, the other is calculated and marked.
- The sslbrain column has no source numbers. It comes from our own prices and our integration catalogue and links to those pages.
Every edition of Keyfactor Command and sslbrain
The table scrolls sideways.
| Question | sslbrain | On-premises | Kubernetes | CLAaaS | PKIaaS | SaaS Lite |
|---|---|---|---|---|---|---|
| Price | ||||||
| Price per year and per month | Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint. | $56,000 per year11 $4,666.67 per month (calculated)
| ||||
| Automation | ||||||
| How the certificate gets there | Both agents/push and ACME Full answera service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH. | Full answerThe Command SaaS portal deploys Keyfactor ACME instances for the customer's ACME clients; Universal Orchestrator is described in the Command SaaS documentation for discovery, MSCA inventory and log collection ("such as"); whether orchestrator extensions can install at destinations with Command SaaS is not stated | ||||
| Direct agents and connectors | 72 integrations in the catalogue | Not stated | ||||
| Without a direct agent | Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME | |||||
| Named systems | ||||||
| FortiGate | Yes Full answerFortinet FortiGate: push from the appliance over the API, port 443 | Not stated | ||||
| F5 BIG-IP | Yes Full answerF5 BIG-IP: push from the appliance over the API, port 443 | Not stated | ||||
| NetScaler | Yes Full answerCitrix NetScaler / ADC: push from the appliance over the API, port 443 | Yes23 Full answerUniversal Orchestrator extension for Citrix ADC; binding to virtual servers, ODKG | Yes23 Full answerUniversal Orchestrator extension for Citrix ADC; binding to virtual servers, ODKG | Yes23 Full answerUniversal Orchestrator extension for Citrix ADC; binding to virtual servers, ODKG | Yes23 Full answerUniversal Orchestrator extension for Citrix ADC; binding to virtual servers, ODKG | Not stated |
| SonicWall | Yes Full answerSonicWall SonicOS: push from the appliance over the API, port 443 | Not stated | Not stated | Not stated | Not stated | Not stated |
| Palo Alto | Yes Full answerPalo Alto Networks PAN-OS: push from the appliance over the API, port 443 | Yes24 Full answerUniversal Orchestrator extension for a firewall or Panorama | Yes24 Full answerUniversal Orchestrator extension for a firewall or Panorama | Yes24 Full answerUniversal Orchestrator extension for a firewall or Panorama | Yes24 Full answerUniversal Orchestrator extension for a firewall or Panorama | Not stated |
| Check Point | Yes Full answerCheck Point HTTPS Inspection: push from the appliance over the API, port 443 | Not stated | Not stated | Not stated | Not stated | Not stated |
| Kemp LoadMaster | Yes Full answerKemp LoadMaster: push from the appliance over the API, port 443 | Yes25 Full answerUniversal Orchestrator extension for Kemp Load Balancer: inventory, add and remove | Yes25 Full answerUniversal Orchestrator extension for Kemp Load Balancer: inventory, add and remove | Yes25 Full answerUniversal Orchestrator extension for Kemp Load Balancer: inventory, add and remove | Yes25 Full answerUniversal Orchestrator extension for Kemp Load Balancer: inventory, add and remove | Not stated |
| Cisco | Yes Full answerCisco Secure Firewall (FDM): push from the appliance over the API, port 443 | Yes26 Full answerCisco ASA via a Universal Orchestrator extension: identity certificates and Remote Access VPN bindings; Cisco FTD and ISE not stated | Yes26 Full answerCisco ASA via a Universal Orchestrator extension: identity certificates and Remote Access VPN bindings; Cisco FTD and ISE not stated | Yes26 Full answerCisco ASA via a Universal Orchestrator extension: identity certificates and Remote Access VPN bindings; Cisco FTD and ISE not stated | Yes26 Full answerCisco ASA via a Universal Orchestrator extension: identity certificates and Remote Access VPN bindings; Cisco FTD and ISE not stated | Not stated |
| IIS | Yes Full answerMicrosoft IIS: service agent on the server | Yes27 Full answeriis-orchestrator, store type WinIIS: remotely via WinRM or locally as an agent on Windows | Yes27 Full answeriis-orchestrator, store type WinIIS: remotely via WinRM or locally as an agent on Windows | Yes27 Full answeriis-orchestrator, store type WinIIS: remotely via WinRM or locally as an agent on Windows | Yes27 Full answeriis-orchestrator, store type WinIIS: remotely via WinRM or locally as an agent on Windows | Not stated |
| Exchange | Yes Full answerMicrosoft Exchange: service agent on the server | Not stated | Not stated | Not stated | Not stated | Not stated |
| nginx and Apache | Yes Full answerNginx: service agent on the server; Apache HTTP Server: service agent on the server | Not stated | ||||
| Tomcat (JKS) | Yes Full answerApache Tomcat: service agent on the server | Not stated | ||||
| Azure Key Vault | Yes Full answerAzure Key Vault: push from the appliance over the API, port 443 | Yes28 Full answerUniversal Orchestrator extension for Azure Key Vault: inventory, add, remove and discovery | Yes28 Full answerUniversal Orchestrator extension for Azure Key Vault: inventory, add, remove and discovery | Yes28 Full answerUniversal Orchestrator extension for Azure Key Vault: inventory, add, remove and discovery | Yes28 Full answerUniversal Orchestrator extension for Azure Key Vault: inventory, add, remove and discovery | Not stated |
| AWS Certificate Manager | Yes Full answerAWS Certificate Manager: push from the appliance over the API, port 443 | Yes29 Full answerUniversal Orchestrator extension AWS-ACM-v3 with IAM, AssumeRole or OIDC | Yes29 Full answerUniversal Orchestrator extension AWS-ACM-v3 with IAM, AssumeRole or OIDC | Yes29 Full answerUniversal Orchestrator extension AWS-ACM-v3 with IAM, AssumeRole or OIDC | Yes29 Full answerUniversal Orchestrator extension AWS-ACM-v3 with IAM, AssumeRole or OIDC | Not stated |
| Push without an agent | ||||||
| Push with no software on the destination | 50 destinations Show the list
| 42 destinations Show the list
What the list covers: Found in Keyfactor’s GitHub organisation (60 repos with "orchestrator" in the name) and cross-checked against the integration catalogue (45 Universal Orchestrator entries). Included: extensions that place a TLS certificate on the destination (Add, replacement or ODKG); one row per destination according to the counting unit in _kontrol/FORMAT.md (WinCert, WinIIS, WinSQL and WinADFS separately; Palo Alto firewall and Panorama separately; secrets stores with Add are counted). Excluded: inventory-only (Cloudflare Edge, Fastly, Fortanix, Signum), HashiCorp Vault PKI-store (no Add), HSM (PKCS11), SAML/identity (Okta, Azure App Registration) and older duplicates. The catalogue is public, but lacks three extensions available on GitHub (Adobe AEM, NetApp ONTAP, Mobotix)5,15 | 42 destinations Show the list
What the list covers: Found in Keyfactor’s GitHub organisation (60 repos with "orchestrator" in the name) and cross-checked against the integration catalogue (45 Universal Orchestrator entries). Included: extensions that place a TLS certificate on the destination (Add, replacement or ODKG); one row per destination according to the counting unit in _kontrol/FORMAT.md (WinCert, WinIIS, WinSQL and WinADFS separately; Palo Alto firewall and Panorama separately; secrets stores with Add are counted). Excluded: inventory-only (Cloudflare Edge, Fastly, Fortanix, Signum), HashiCorp Vault PKI-store (no Add), HSM (PKCS11), SAML/identity (Okta, Azure App Registration) and older duplicates. The catalogue is public, but lacks three extensions available on GitHub (Adobe AEM, NetApp ONTAP, Mobotix)5,15 | 42 destinations Show the list
What the list covers: Found in Keyfactor’s GitHub organisation (60 repos with "orchestrator" in the name) and cross-checked against the integration catalogue (45 Universal Orchestrator entries). Included: extensions that place a TLS certificate on the destination (Add, replacement or ODKG); one row per destination according to the counting unit in _kontrol/FORMAT.md (WinCert, WinIIS, WinSQL and WinADFS separately; Palo Alto firewall and Panorama separately; secrets stores with Add are counted). Excluded: inventory-only (Cloudflare Edge, Fastly, Fortanix, Signum), HashiCorp Vault PKI-store (no Add), HSM (PKCS11), SAML/identity (Okta, Azure App Registration) and older duplicates. The catalogue is public, but lacks three extensions available on GitHub (Adobe AEM, NetApp ONTAP, Mobotix)5,15 | 42 destinations Show the list
What the list covers: Found in Keyfactor’s GitHub organisation (60 repos with "orchestrator" in the name) and cross-checked against the integration catalogue (45 Universal Orchestrator entries). Included: extensions that place a TLS certificate on the destination (Add, replacement or ODKG); one row per destination according to the counting unit in _kontrol/FORMAT.md (WinCert, WinIIS, WinSQL and WinADFS separately; Palo Alto firewall and Panorama separately; secrets stores with Add are counted). Excluded: inventory-only (Cloudflare Edge, Fastly, Fortanix, Signum), HashiCorp Vault PKI-store (no Add), HSM (PKCS11), SAML/identity (Okta, Azure App Registration) and older duplicates. The catalogue is public, but lacks three extensions available on GitHub (Adobe AEM, NetApp ONTAP, Mobotix)5,15 | Not stated |
| Private keys | ||||||
| Where the private key is kept | On-prem appliance | |||||
| Network | ||||||
| Servers with an agent or ACME | The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports | Universal Orchestrator (also as a local agent) initiates the connection to Command’s Orchestrator API itself and retrieves jobs: HTTP/HTTPS TCP 80/443 or configured ports5,22,58 Full answercan go via a forward proxy. With hosted/PKIaaS, the connection goes from the customer’s network to Keyfactor’s infrastructure; an inbound internet connection to the orchestrator is not mentioned. ACME clients connect to the Keyfactor ACME server; ports for ACME and challenges are not stated | Universal Orchestrator (also as a local agent) initiates the connection to Command’s Orchestrator API itself and retrieves jobs: HTTP/HTTPS TCP 80/443 or configured ports5,22,58 Full answercan go via a forward proxy. With hosted/PKIaaS, the connection goes from the customer’s network to Keyfactor’s infrastructure; an inbound internet connection to the orchestrator is not mentioned. ACME clients connect to the Keyfactor ACME server; ports for ACME and challenges are not stated | Universal Orchestrator (also as a local agent) initiates the connection to Command’s Orchestrator API itself and retrieves jobs: HTTP/HTTPS TCP 80/443 or configured ports5,22,58 Full answercan go via a forward proxy. With hosted/PKIaaS, the connection goes from the customer’s network to Keyfactor’s infrastructure; an inbound internet connection to the orchestrator is not mentioned. ACME clients connect to the Keyfactor ACME server; ports for ACME and challenges are not stated | Universal Orchestrator (also as a local agent) initiates the connection to Command’s Orchestrator API itself and retrieves jobs: HTTP/HTTPS TCP 80/443 or configured ports5,22,58 Full answercan go via a forward proxy. With hosted/PKIaaS, the connection goes from the customer’s network to Keyfactor’s infrastructure; an inbound internet connection to the orchestrator is not mentioned. ACME clients connect to the Keyfactor ACME server; ports for ACME and challenges are not stated | |
| Equipment without an agent | The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet | From Universal Orchestrator in the customer’s network to the destination: WinRM TCP 5985 (HTTP) or 5986 (HTTPS) to Windows targets, SSH (default TCP 22) to Linux targets via RemoteFile, HTTP/HTTPS TCP 80/443 to F5 and NetScaler, IBM DataPower typically port 555461,6,22,47,5 Full answerports to cloud APIs are not stated. The orchestrator retrieves jobs itself, so Command does not open connections into the orchestrator | From Universal Orchestrator in the customer’s network to the destination: WinRM TCP 5985 (HTTP) or 5986 (HTTPS) to Windows targets, SSH (default TCP 22) to Linux targets via RemoteFile, HTTP/HTTPS TCP 80/443 to F5 and NetScaler, IBM DataPower typically port 555461,6,22,47,5 Full answerports to cloud APIs are not stated. The orchestrator retrieves jobs itself, so Command does not open connections into the orchestrator | From Universal Orchestrator in the customer’s network to the destination: WinRM TCP 5985 (HTTP) or 5986 (HTTPS) to Windows targets, SSH (default TCP 22) to Linux targets via RemoteFile, HTTP/HTTPS TCP 80/443 to F5 and NetScaler, IBM DataPower typically port 555461,6,22,47,5 Full answerports to cloud APIs are not stated. The orchestrator retrieves jobs itself, so Command does not open connections into the orchestrator | From Universal Orchestrator in the customer’s network to the destination: WinRM TCP 5985 (HTTP) or 5986 (HTTPS) to Windows targets, SSH (default TCP 22) to Linux targets via RemoteFile, HTTP/HTTPS TCP 80/443 to F5 and NetScaler, IBM DataPower typically port 555461,6,22,47,5 Full answerports to cloud APIs are not stated. The orchestrator retrieves jobs itself, so Command does not open connections into the orchestrator | Not stated |
| Windows and Linux | ||||||
| Windows | Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports | Not stated | ||||
| Linux | Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports | Not stated | ||||
| Branch offices | ||||||
| Remote sites and branch offices | One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports | Universal Orchestrator is installed in the network with the destinations and retrieves jobs from Command itself, also via a forward proxy10,5,58 Full answermultiple orchestrators can be installed, and SSL scanning can be distributed across orchestrator pools. Requirements for sites without a direct connection (e.g. VPN) are not stated | Universal Orchestrator is installed in the network with the destinations and retrieves jobs from Command itself, also via a forward proxy10,5,58 Full answermultiple orchestrators can be installed, and SSL scanning can be distributed across orchestrator pools. Requirements for sites without a direct connection (e.g. VPN) are not stated | Universal Orchestrator is installed in the network with the destinations and retrieves jobs from Command itself, also via a forward proxy10,5,58 Full answermultiple orchestrators can be installed, and SSL scanning can be distributed across orchestrator pools. Requirements for sites without a direct connection (e.g. VPN) are not stated | Universal Orchestrator is installed in the network with the destinations and retrieves jobs from Command itself, also via a forward proxy10,5,58 Full answermultiple orchestrators can be installed, and SSL scanning can be distributed across orchestrator pools. Requirements for sites without a direct connection (e.g. VPN) are not stated | |
| Vendor and EU | ||||||
| Vendor | FairSSL A/S, Denmark | Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA62 Full answerpress releases from 2026 are datelined Atlanta, GA and Stockholm | Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA62 Full answerpress releases from 2026 are datelined Atlanta, GA and Stockholm | Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA62 Full answerpress releases from 2026 are datelined Atlanta, GA and Stockholm | Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA62 Full answerpress releases from 2026 are datelined Atlanta, GA and Stockholm | Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA62 Full answerpress releases from 2026 are datelined Atlanta, GA and Stockholm |
| Hosting and the EU | EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud) | |||||
sslbrain
Price
- Price per year and per month
- See the prices
Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint.
Automation
- How the certificate gets there
Both agents/push and ACME
Full answer
a service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH.
- Direct agents and connectors
- See the integrations
72 integrations in the catalogue
- Without a direct agent
Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME
Named systems
- FortiGate
Yes
Full answer
Fortinet FortiGate: push from the appliance over the API, port 443
- F5 BIG-IP
Yes
Full answer
F5 BIG-IP: push from the appliance over the API, port 443
- NetScaler
Yes
Full answer
Citrix NetScaler / ADC: push from the appliance over the API, port 443
- SonicWall
Yes
Full answer
SonicWall SonicOS: push from the appliance over the API, port 443
- Palo Alto
Yes
Full answer
Palo Alto Networks PAN-OS: push from the appliance over the API, port 443
- Check Point
Yes
Full answer
Check Point HTTPS Inspection: push from the appliance over the API, port 443
- Kemp LoadMaster
Yes
Full answer
Kemp LoadMaster: push from the appliance over the API, port 443
- Cisco
Yes
Full answer
Cisco Secure Firewall (FDM): push from the appliance over the API, port 443
- IIS
Yes
Full answer
Microsoft IIS: service agent on the server
- Exchange
Yes
Full answer
Microsoft Exchange: service agent on the server
- nginx and Apache
Yes
Full answer
Nginx: service agent on the server; Apache HTTP Server: service agent on the server
- Tomcat (JKS)
Yes
Full answer
Apache Tomcat: service agent on the server
- Azure Key Vault
Yes
Full answer
Azure Key Vault: push from the appliance over the API, port 443
- AWS Certificate Manager
Yes
Full answer
AWS Certificate Manager: push from the appliance over the API, port 443
Push without an agent
- Push with no software on the destination
- See the integrations
50 destinations
Show the list
- Akamai CPS (push from the appliance over the API, port 443)
- Aruba/HPE ClearPass (push from the appliance over the API, port 443)
- AWS Certificate Manager (push from the appliance over the API, port 443)
- AWS CloudFront (push from the appliance over the API, port 443)
- AWS ELB & API Gateway (push from the appliance over the API, port 443)
- Azure App Service (push from the appliance over the API, port 443)
- Azure Application Gateway (push from the appliance over the API, port 443)
- Azure Front Door (push from the appliance over the API, port 443)
- Azure Key Vault (push from the appliance over the API, port 443)
- Barracuda CloudGen Firewall (push from the appliance over the API, port 8443)
- Barracuda Web Application Firewall (push from the appliance over the API, port 8443)
- Bunny.net CDN (push from the appliance over the API, port 443)
- Check Point HTTPS Inspection (push from the appliance over the API, port 443)
- Cisco ASA / ASAv (push from the appliance over SSH, port 22)
- Cisco ISE (push from the appliance over the API, port 443)
- Cisco Secure Firewall (FDM) (push from the appliance over the API, port 443)
- Cisco Secure Firewall (FMC) (push from the appliance over the API, port 443)
- Citrix NetScaler / ADC (push from the appliance over the API, port 443)
- Cloudflare (push from the appliance over the API, port 443)
- Dell iDRAC (push from the appliance over the API, port 443)
- F5 BIG-IP (push from the appliance over the API, port 443)
- Fortinet FortiADC (push from the appliance over the API, port 443)
- Fortinet FortiGate (push from the appliance over the API, port 443)
- Fortinet FortiMail (push from the appliance over SSH, port 22)
- Fortinet FortiManager (push from the appliance over the API, port 443)
- Fortinet FortiNAC (push from the appliance over the API, port 8443)
- Fortinet FortiWeb WAF (push from the appliance over the API, port 443)
- Google Cloud Certificate Manager (push from the appliance over the API, port 443)
- HPE iLO (push from the appliance over the API, port 443)
- Infoblox NIOS Grid Manager (push from the appliance over the API, port 443)
- Ivanti Connect Secure (push from the appliance over the API, port 443)
- Juniper SRX / vSRX (push from the appliance over SSH, port 22)
- Kemp LoadMaster (push from the appliance over the API, port 443)
- Kubernetes (push from the appliance over the API, port 6443)
- NetApp ONTAP (push from the appliance over the API, port 443)
- OPNsense (push from the appliance over the API, port 443)
- Palo Alto Networks PAN-OS (push from the appliance over the API, port 443)
- pfSense (push from the appliance over SSH, port 22)
- Proxmox Backup Server (push from the appliance over the API, port 8007)
- Proxmox Mail Gateway (push from the appliance over the API, port 8006)
- Proxmox VE (push from the appliance over the API, port 8006)
- SonicWall SonicOS (push from the appliance over the API, port 443)
- Sophos Firewall (push from the appliance over the API, port 4444)
- Synology DSM (push from the appliance over the API, port 5001)
- TrueNAS SCALE / CORE (push from the appliance over the API, port 443)
- Ubiquiti UniFi (push from the appliance over SSH, port 22)
- VMware Avi / NSX ALB (push from the appliance over the API, port 443)
- VMware ESXi (push from the appliance over SSH, port 22)
- VMware vCenter (push from the appliance over the API, port 443)
- WatchGuard Firebox (Local: SSH 4118 · Cloud: HTTPS 443)
Private keys
- Where the private key is kept
- See the architecture
On-prem appliance
Network
- Servers with an agent or ACME
The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports
- Equipment without an agent
The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet
Windows and Linux
- Windows
Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports
- Linux
Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports
Branch offices
- Remote sites and branch offices
One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports
Vendor and EU
- Vendor
FairSSL A/S, Denmark
- Hosting and the EU
- See the infrastructure
EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud)
On-premises
Price
Automation
- How the certificate gets there
- Direct agents and connectors
Named systems
- FortiGate
- F5 BIG-IP
- NetScaler
Yes23
Full answer
Universal Orchestrator extension for Citrix ADC; binding to virtual servers, ODKG
- SonicWall
Not stated
- Palo Alto
Yes24
Full answer
Universal Orchestrator extension for a firewall or Panorama
- Check Point
Not stated
- Kemp LoadMaster
Yes25
Full answer
Universal Orchestrator extension for Kemp Load Balancer: inventory, add and remove
- Cisco
Yes26
Full answer
Cisco ASA via a Universal Orchestrator extension: identity certificates and Remote Access VPN bindings; Cisco FTD and ISE not stated
- IIS
Yes27
Full answer
iis-orchestrator, store type WinIIS: remotely via WinRM or locally as an agent on Windows
- Exchange
Not stated
- nginx and Apache
- Tomcat (JKS)
- Azure Key Vault
Yes28
Full answer
Universal Orchestrator extension for Azure Key Vault: inventory, add, remove and discovery
- AWS Certificate Manager
Yes29
Full answer
Universal Orchestrator extension AWS-ACM-v3 with IAM, AssumeRole or OIDC
Push without an agent
- Push with no software on the destination
42 destinations
Show the list
- A10 Networks vThunder (SSL certificates via API; management certificate via SCP)30
- Adobe Experience Manager as a Cloud Service (Cloud Manager API)31
- Akamai Certificate Provisioning System (CPS; key created in Akamai)32
- Radware Alteon Load Balancer (REST API, binding to virtual services)33
- Aruba ClearPass Policy Manager (re-enrollment)34
- AWS Certificate Manager (ACM)29
- AXIS IP cameras (ODKG on the camera)35
- Azure Application Gateway (certificates and HTTPS/TLS listener bindings)36
- Azure Key Vault28
- Barracuda WAF-as-a-Service37
- Bosch IP cameras (re-enrollment)38
- Cisco ASA (identity certificates, trustpoints and Remote Access VPN bindings)26
- Citrix ADC / NetScaler (binding to virtual servers; ODKG)23
- Dell iDRAC39
- F5 BIG-IP (version 14 and later)21
- F5 BIG-IQ (can deploy onwards to associated BIG-IP)40
- F5 Distributed Cloud / Multi-Cloud App Connect (WAF)41
- Fortinet FortiGate (API with an API token)19
- Fortinet FortiManager (FortiGate devices managed by FortiManager)20
- Fortinet FortiWeb42
- Google Cloud Apigee43
- Google Cloud Certificate Manager44
- Google Cloud Load Balancer45
- HPE iLO (HTTPS certificate via ODKG)46
- IBM DataPower (REST Management Interface)47
- Imperva (cloud WAF)48
- Kubernetes TLS and Opaque secrets49
- AWS Secrets Manager (Add and Remove from the orchestrator)50
- Google Cloud Secret Manager (Add and Remove from the orchestrator)51
- HashiCorp Vault Key-Value secrets engine (PEM, JKS, PKCS12 and PFX; Add and Remove)52
- Kemp Load Balancer25
- Mobotix IP cameras (x7 and x8; the key is created on the orchestrator)53
- NetApp ONTAP (cluster and SVM, ONTAP REST API)54
- Palo Alto Networks firewall24
- Palo Alto Networks Panorama24
- File-based certificate stores on Linux and Windows servers (RemoteFile: JKS, PEM, PKCS12, DER, IBM KDB, Oracle Wallet) via SSH or WinRM6
- VMware NSX Advanced Load Balancer (Avi)55
- VMware vCenter56
- Windows certificate store, Local Machine (WinCert via WinRM; the default mode loads scripts at session start, optional JEA mode requires Keyfactor modules on the target)27
- Microsoft IIS, bound certificates (WinIIS via WinRM; creates and removes IIS bindings)27
- Microsoft SQL Server, certificates bound to SQL instances (WinSQL via WinRM; bind and unbind)27
- Microsoft AD FS, Service-Communications certificate on primary and secondary nodes (WinADFS via WinRM)27
What the list covers: Found in Keyfactor’s GitHub organisation (60 repos with "orchestrator" in the name) and cross-checked against the integration catalogue (45 Universal Orchestrator entries). Included: extensions that place a TLS certificate on the destination (Add, replacement or ODKG); one row per destination according to the counting unit in _kontrol/FORMAT.md (WinCert, WinIIS, WinSQL and WinADFS separately; Palo Alto firewall and Panorama separately; secrets stores with Add are counted). Excluded: inventory-only (Cloudflare Edge, Fastly, Fortanix, Signum), HashiCorp Vault PKI-store (no Add), HSM (PKCS11), SAML/identity (Okta, Azure App Registration) and older duplicates. The catalogue is public, but lacks three extensions available on GitHub (Adobe AEM, NetApp ONTAP, Mobotix)5,15
Private keys
Network
- Servers with an agent or ACME
Universal Orchestrator (also as a local agent) initiates the connection to Command’s Orchestrator API itself and retrieves jobs: HTTP/HTTPS TCP 80/443 or configured ports5,22,58
Full answer
can go via a forward proxy. With hosted/PKIaaS, the connection goes from the customer’s network to Keyfactor’s infrastructure; an inbound internet connection to the orchestrator is not mentioned. ACME clients connect to the Keyfactor ACME server; ports for ACME and challenges are not stated
- Equipment without an agent
From Universal Orchestrator in the customer’s network to the destination: WinRM TCP 5985 (HTTP) or 5986 (HTTPS) to Windows targets, SSH (default TCP 22) to Linux targets via RemoteFile, HTTP/HTTPS TCP 80/443 to F5 and NetScaler, IBM DataPower typically port 555461,6,22,47,5
Full answer
ports to cloud APIs are not stated. The orchestrator retrieves jobs itself, so Command does not open connections into the orchestrator
Windows and Linux
- Windows
Branch offices
- Remote sites and branch offices
Universal Orchestrator is installed in the network with the destinations and retrieves jobs from Command itself, also via a forward proxy10,5,58
Full answer
multiple orchestrators can be installed, and SSL scanning can be distributed across orchestrator pools. Requirements for sites without a direct connection (e.g. VPN) are not stated
Vendor and EU
- Vendor
Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA62
Full answer
press releases from 2026 are datelined Atlanta, GA and Stockholm
Kubernetes
Price
Automation
- How the certificate gets there
- Direct agents and connectors
Named systems
- FortiGate
- F5 BIG-IP
- NetScaler
Yes23
Full answer
Universal Orchestrator extension for Citrix ADC; binding to virtual servers, ODKG
- SonicWall
Not stated
- Palo Alto
Yes24
Full answer
Universal Orchestrator extension for a firewall or Panorama
- Check Point
Not stated
- Kemp LoadMaster
Yes25
Full answer
Universal Orchestrator extension for Kemp Load Balancer: inventory, add and remove
- Cisco
Yes26
Full answer
Cisco ASA via a Universal Orchestrator extension: identity certificates and Remote Access VPN bindings; Cisco FTD and ISE not stated
- IIS
Yes27
Full answer
iis-orchestrator, store type WinIIS: remotely via WinRM or locally as an agent on Windows
- Exchange
Not stated
- nginx and Apache
- Tomcat (JKS)
- Azure Key Vault
Yes28
Full answer
Universal Orchestrator extension for Azure Key Vault: inventory, add, remove and discovery
- AWS Certificate Manager
Yes29
Full answer
Universal Orchestrator extension AWS-ACM-v3 with IAM, AssumeRole or OIDC
Push without an agent
- Push with no software on the destination
42 destinations
Show the list
- A10 Networks vThunder (SSL certificates via API; management certificate via SCP)30
- Adobe Experience Manager as a Cloud Service (Cloud Manager API)31
- Akamai Certificate Provisioning System (CPS; key created in Akamai)32
- Radware Alteon Load Balancer (REST API, binding to virtual services)33
- Aruba ClearPass Policy Manager (re-enrollment)34
- AWS Certificate Manager (ACM)29
- AXIS IP cameras (ODKG on the camera)35
- Azure Application Gateway (certificates and HTTPS/TLS listener bindings)36
- Azure Key Vault28
- Barracuda WAF-as-a-Service37
- Bosch IP cameras (re-enrollment)38
- Cisco ASA (identity certificates, trustpoints and Remote Access VPN bindings)26
- Citrix ADC / NetScaler (binding to virtual servers; ODKG)23
- Dell iDRAC39
- F5 BIG-IP (version 14 and later)21
- F5 BIG-IQ (can deploy onwards to associated BIG-IP)40
- F5 Distributed Cloud / Multi-Cloud App Connect (WAF)41
- Fortinet FortiGate (API with an API token)19
- Fortinet FortiManager (FortiGate devices managed by FortiManager)20
- Fortinet FortiWeb42
- Google Cloud Apigee43
- Google Cloud Certificate Manager44
- Google Cloud Load Balancer45
- HPE iLO (HTTPS certificate via ODKG)46
- IBM DataPower (REST Management Interface)47
- Imperva (cloud WAF)48
- Kubernetes TLS and Opaque secrets49
- AWS Secrets Manager (Add and Remove from the orchestrator)50
- Google Cloud Secret Manager (Add and Remove from the orchestrator)51
- HashiCorp Vault Key-Value secrets engine (PEM, JKS, PKCS12 and PFX; Add and Remove)52
- Kemp Load Balancer25
- Mobotix IP cameras (x7 and x8; the key is created on the orchestrator)53
- NetApp ONTAP (cluster and SVM, ONTAP REST API)54
- Palo Alto Networks firewall24
- Palo Alto Networks Panorama24
- File-based certificate stores on Linux and Windows servers (RemoteFile: JKS, PEM, PKCS12, DER, IBM KDB, Oracle Wallet) via SSH or WinRM6
- VMware NSX Advanced Load Balancer (Avi)55
- VMware vCenter56
- Windows certificate store, Local Machine (WinCert via WinRM; the default mode loads scripts at session start, optional JEA mode requires Keyfactor modules on the target)27
- Microsoft IIS, bound certificates (WinIIS via WinRM; creates and removes IIS bindings)27
- Microsoft SQL Server, certificates bound to SQL instances (WinSQL via WinRM; bind and unbind)27
- Microsoft AD FS, Service-Communications certificate on primary and secondary nodes (WinADFS via WinRM)27
What the list covers: Found in Keyfactor’s GitHub organisation (60 repos with "orchestrator" in the name) and cross-checked against the integration catalogue (45 Universal Orchestrator entries). Included: extensions that place a TLS certificate on the destination (Add, replacement or ODKG); one row per destination according to the counting unit in _kontrol/FORMAT.md (WinCert, WinIIS, WinSQL and WinADFS separately; Palo Alto firewall and Panorama separately; secrets stores with Add are counted). Excluded: inventory-only (Cloudflare Edge, Fastly, Fortanix, Signum), HashiCorp Vault PKI-store (no Add), HSM (PKCS11), SAML/identity (Okta, Azure App Registration) and older duplicates. The catalogue is public, but lacks three extensions available on GitHub (Adobe AEM, NetApp ONTAP, Mobotix)5,15
Private keys
Network
- Servers with an agent or ACME
Universal Orchestrator (also as a local agent) initiates the connection to Command’s Orchestrator API itself and retrieves jobs: HTTP/HTTPS TCP 80/443 or configured ports5,22,58
Full answer
can go via a forward proxy. With hosted/PKIaaS, the connection goes from the customer’s network to Keyfactor’s infrastructure; an inbound internet connection to the orchestrator is not mentioned. ACME clients connect to the Keyfactor ACME server; ports for ACME and challenges are not stated
- Equipment without an agent
From Universal Orchestrator in the customer’s network to the destination: WinRM TCP 5985 (HTTP) or 5986 (HTTPS) to Windows targets, SSH (default TCP 22) to Linux targets via RemoteFile, HTTP/HTTPS TCP 80/443 to F5 and NetScaler, IBM DataPower typically port 555461,6,22,47,5
Full answer
ports to cloud APIs are not stated. The orchestrator retrieves jobs itself, so Command does not open connections into the orchestrator
Windows and Linux
- Windows
Branch offices
- Remote sites and branch offices
Universal Orchestrator is installed in the network with the destinations and retrieves jobs from Command itself, also via a forward proxy10,5,58
Full answer
multiple orchestrators can be installed, and SSL scanning can be distributed across orchestrator pools. Requirements for sites without a direct connection (e.g. VPN) are not stated
Vendor and EU
- Vendor
Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA62
Full answer
press releases from 2026 are datelined Atlanta, GA and Stockholm
CLAaaS
Price
Automation
- How the certificate gets there
- Direct agents and connectors
Named systems
- FortiGate
- F5 BIG-IP
- NetScaler
Yes23
Full answer
Universal Orchestrator extension for Citrix ADC; binding to virtual servers, ODKG
- SonicWall
Not stated
- Palo Alto
Yes24
Full answer
Universal Orchestrator extension for a firewall or Panorama
- Check Point
Not stated
- Kemp LoadMaster
Yes25
Full answer
Universal Orchestrator extension for Kemp Load Balancer: inventory, add and remove
- Cisco
Yes26
Full answer
Cisco ASA via a Universal Orchestrator extension: identity certificates and Remote Access VPN bindings; Cisco FTD and ISE not stated
- IIS
Yes27
Full answer
iis-orchestrator, store type WinIIS: remotely via WinRM or locally as an agent on Windows
- Exchange
Not stated
- nginx and Apache
- Tomcat (JKS)
- Azure Key Vault
Yes28
Full answer
Universal Orchestrator extension for Azure Key Vault: inventory, add, remove and discovery
- AWS Certificate Manager
Yes29
Full answer
Universal Orchestrator extension AWS-ACM-v3 with IAM, AssumeRole or OIDC
Push without an agent
- Push with no software on the destination
42 destinations
Show the list
- A10 Networks vThunder (SSL certificates via API; management certificate via SCP)30
- Adobe Experience Manager as a Cloud Service (Cloud Manager API)31
- Akamai Certificate Provisioning System (CPS; key created in Akamai)32
- Radware Alteon Load Balancer (REST API, binding to virtual services)33
- Aruba ClearPass Policy Manager (re-enrollment)34
- AWS Certificate Manager (ACM)29
- AXIS IP cameras (ODKG on the camera)35
- Azure Application Gateway (certificates and HTTPS/TLS listener bindings)36
- Azure Key Vault28
- Barracuda WAF-as-a-Service37
- Bosch IP cameras (re-enrollment)38
- Cisco ASA (identity certificates, trustpoints and Remote Access VPN bindings)26
- Citrix ADC / NetScaler (binding to virtual servers; ODKG)23
- Dell iDRAC39
- F5 BIG-IP (version 14 and later)21
- F5 BIG-IQ (can deploy onwards to associated BIG-IP)40
- F5 Distributed Cloud / Multi-Cloud App Connect (WAF)41
- Fortinet FortiGate (API with an API token)19
- Fortinet FortiManager (FortiGate devices managed by FortiManager)20
- Fortinet FortiWeb42
- Google Cloud Apigee43
- Google Cloud Certificate Manager44
- Google Cloud Load Balancer45
- HPE iLO (HTTPS certificate via ODKG)46
- IBM DataPower (REST Management Interface)47
- Imperva (cloud WAF)48
- Kubernetes TLS and Opaque secrets49
- AWS Secrets Manager (Add and Remove from the orchestrator)50
- Google Cloud Secret Manager (Add and Remove from the orchestrator)51
- HashiCorp Vault Key-Value secrets engine (PEM, JKS, PKCS12 and PFX; Add and Remove)52
- Kemp Load Balancer25
- Mobotix IP cameras (x7 and x8; the key is created on the orchestrator)53
- NetApp ONTAP (cluster and SVM, ONTAP REST API)54
- Palo Alto Networks firewall24
- Palo Alto Networks Panorama24
- File-based certificate stores on Linux and Windows servers (RemoteFile: JKS, PEM, PKCS12, DER, IBM KDB, Oracle Wallet) via SSH or WinRM6
- VMware NSX Advanced Load Balancer (Avi)55
- VMware vCenter56
- Windows certificate store, Local Machine (WinCert via WinRM; the default mode loads scripts at session start, optional JEA mode requires Keyfactor modules on the target)27
- Microsoft IIS, bound certificates (WinIIS via WinRM; creates and removes IIS bindings)27
- Microsoft SQL Server, certificates bound to SQL instances (WinSQL via WinRM; bind and unbind)27
- Microsoft AD FS, Service-Communications certificate on primary and secondary nodes (WinADFS via WinRM)27
What the list covers: Found in Keyfactor’s GitHub organisation (60 repos with "orchestrator" in the name) and cross-checked against the integration catalogue (45 Universal Orchestrator entries). Included: extensions that place a TLS certificate on the destination (Add, replacement or ODKG); one row per destination according to the counting unit in _kontrol/FORMAT.md (WinCert, WinIIS, WinSQL and WinADFS separately; Palo Alto firewall and Panorama separately; secrets stores with Add are counted). Excluded: inventory-only (Cloudflare Edge, Fastly, Fortanix, Signum), HashiCorp Vault PKI-store (no Add), HSM (PKCS11), SAML/identity (Okta, Azure App Registration) and older duplicates. The catalogue is public, but lacks three extensions available on GitHub (Adobe AEM, NetApp ONTAP, Mobotix)5,15
Private keys
Network
- Servers with an agent or ACME
Universal Orchestrator (also as a local agent) initiates the connection to Command’s Orchestrator API itself and retrieves jobs: HTTP/HTTPS TCP 80/443 or configured ports5,22,58
Full answer
can go via a forward proxy. With hosted/PKIaaS, the connection goes from the customer’s network to Keyfactor’s infrastructure; an inbound internet connection to the orchestrator is not mentioned. ACME clients connect to the Keyfactor ACME server; ports for ACME and challenges are not stated
- Equipment without an agent
From Universal Orchestrator in the customer’s network to the destination: WinRM TCP 5985 (HTTP) or 5986 (HTTPS) to Windows targets, SSH (default TCP 22) to Linux targets via RemoteFile, HTTP/HTTPS TCP 80/443 to F5 and NetScaler, IBM DataPower typically port 555461,6,22,47,5
Full answer
ports to cloud APIs are not stated. The orchestrator retrieves jobs itself, so Command does not open connections into the orchestrator
Windows and Linux
- Windows
Branch offices
- Remote sites and branch offices
Universal Orchestrator is installed in the network with the destinations and retrieves jobs from Command itself, also via a forward proxy10,5,58
Full answer
multiple orchestrators can be installed, and SSL scanning can be distributed across orchestrator pools. Requirements for sites without a direct connection (e.g. VPN) are not stated
Vendor and EU
- Vendor
Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA62
Full answer
press releases from 2026 are datelined Atlanta, GA and Stockholm
PKIaaS
Price
Automation
- How the certificate gets there
- Direct agents and connectors
Named systems
- FortiGate
- F5 BIG-IP
- NetScaler
Yes23
Full answer
Universal Orchestrator extension for Citrix ADC; binding to virtual servers, ODKG
- SonicWall
Not stated
- Palo Alto
Yes24
Full answer
Universal Orchestrator extension for a firewall or Panorama
- Check Point
Not stated
- Kemp LoadMaster
Yes25
Full answer
Universal Orchestrator extension for Kemp Load Balancer: inventory, add and remove
- Cisco
Yes26
Full answer
Cisco ASA via a Universal Orchestrator extension: identity certificates and Remote Access VPN bindings; Cisco FTD and ISE not stated
- IIS
Yes27
Full answer
iis-orchestrator, store type WinIIS: remotely via WinRM or locally as an agent on Windows
- Exchange
Not stated
- nginx and Apache
- Tomcat (JKS)
- Azure Key Vault
Yes28
Full answer
Universal Orchestrator extension for Azure Key Vault: inventory, add, remove and discovery
- AWS Certificate Manager
Yes29
Full answer
Universal Orchestrator extension AWS-ACM-v3 with IAM, AssumeRole or OIDC
Push without an agent
- Push with no software on the destination
42 destinations
Show the list
- A10 Networks vThunder (SSL certificates via API; management certificate via SCP)30
- Adobe Experience Manager as a Cloud Service (Cloud Manager API)31
- Akamai Certificate Provisioning System (CPS; key created in Akamai)32
- Radware Alteon Load Balancer (REST API, binding to virtual services)33
- Aruba ClearPass Policy Manager (re-enrollment)34
- AWS Certificate Manager (ACM)29
- AXIS IP cameras (ODKG on the camera)35
- Azure Application Gateway (certificates and HTTPS/TLS listener bindings)36
- Azure Key Vault28
- Barracuda WAF-as-a-Service37
- Bosch IP cameras (re-enrollment)38
- Cisco ASA (identity certificates, trustpoints and Remote Access VPN bindings)26
- Citrix ADC / NetScaler (binding to virtual servers; ODKG)23
- Dell iDRAC39
- F5 BIG-IP (version 14 and later)21
- F5 BIG-IQ (can deploy onwards to associated BIG-IP)40
- F5 Distributed Cloud / Multi-Cloud App Connect (WAF)41
- Fortinet FortiGate (API with an API token)19
- Fortinet FortiManager (FortiGate devices managed by FortiManager)20
- Fortinet FortiWeb42
- Google Cloud Apigee43
- Google Cloud Certificate Manager44
- Google Cloud Load Balancer45
- HPE iLO (HTTPS certificate via ODKG)46
- IBM DataPower (REST Management Interface)47
- Imperva (cloud WAF)48
- Kubernetes TLS and Opaque secrets49
- AWS Secrets Manager (Add and Remove from the orchestrator)50
- Google Cloud Secret Manager (Add and Remove from the orchestrator)51
- HashiCorp Vault Key-Value secrets engine (PEM, JKS, PKCS12 and PFX; Add and Remove)52
- Kemp Load Balancer25
- Mobotix IP cameras (x7 and x8; the key is created on the orchestrator)53
- NetApp ONTAP (cluster and SVM, ONTAP REST API)54
- Palo Alto Networks firewall24
- Palo Alto Networks Panorama24
- File-based certificate stores on Linux and Windows servers (RemoteFile: JKS, PEM, PKCS12, DER, IBM KDB, Oracle Wallet) via SSH or WinRM6
- VMware NSX Advanced Load Balancer (Avi)55
- VMware vCenter56
- Windows certificate store, Local Machine (WinCert via WinRM; the default mode loads scripts at session start, optional JEA mode requires Keyfactor modules on the target)27
- Microsoft IIS, bound certificates (WinIIS via WinRM; creates and removes IIS bindings)27
- Microsoft SQL Server, certificates bound to SQL instances (WinSQL via WinRM; bind and unbind)27
- Microsoft AD FS, Service-Communications certificate on primary and secondary nodes (WinADFS via WinRM)27
What the list covers: Found in Keyfactor’s GitHub organisation (60 repos with "orchestrator" in the name) and cross-checked against the integration catalogue (45 Universal Orchestrator entries). Included: extensions that place a TLS certificate on the destination (Add, replacement or ODKG); one row per destination according to the counting unit in _kontrol/FORMAT.md (WinCert, WinIIS, WinSQL and WinADFS separately; Palo Alto firewall and Panorama separately; secrets stores with Add are counted). Excluded: inventory-only (Cloudflare Edge, Fastly, Fortanix, Signum), HashiCorp Vault PKI-store (no Add), HSM (PKCS11), SAML/identity (Okta, Azure App Registration) and older duplicates. The catalogue is public, but lacks three extensions available on GitHub (Adobe AEM, NetApp ONTAP, Mobotix)5,15
Private keys
Network
- Servers with an agent or ACME
Universal Orchestrator (also as a local agent) initiates the connection to Command’s Orchestrator API itself and retrieves jobs: HTTP/HTTPS TCP 80/443 or configured ports5,22,58
Full answer
can go via a forward proxy. With hosted/PKIaaS, the connection goes from the customer’s network to Keyfactor’s infrastructure; an inbound internet connection to the orchestrator is not mentioned. ACME clients connect to the Keyfactor ACME server; ports for ACME and challenges are not stated
- Equipment without an agent
From Universal Orchestrator in the customer’s network to the destination: WinRM TCP 5985 (HTTP) or 5986 (HTTPS) to Windows targets, SSH (default TCP 22) to Linux targets via RemoteFile, HTTP/HTTPS TCP 80/443 to F5 and NetScaler, IBM DataPower typically port 555461,6,22,47,5
Full answer
ports to cloud APIs are not stated. The orchestrator retrieves jobs itself, so Command does not open connections into the orchestrator
Windows and Linux
- Windows
Branch offices
- Remote sites and branch offices
Universal Orchestrator is installed in the network with the destinations and retrieves jobs from Command itself, also via a forward proxy10,5,58
Full answer
multiple orchestrators can be installed, and SSL scanning can be distributed across orchestrator pools. Requirements for sites without a direct connection (e.g. VPN) are not stated
Vendor and EU
- Vendor
Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA62
Full answer
press releases from 2026 are datelined Atlanta, GA and Stockholm
SaaS Lite
Price
- Price per year and per month
$56,000 per year11
$4,666.67 per month (calculated)
- Unit:
- Entry Level plan with 2500 actioned certificates
- Minimum:
- 1-year subscription (1, 2 or 3 years)
Automation
- How the certificate gets there
Full answer
The Command SaaS portal deploys Keyfactor ACME instances for the customer's ACME clients; Universal Orchestrator is described in the Command SaaS documentation for discovery, MSCA inventory and log collection ("such as"); whether orchestrator extensions can install at destinations with Command SaaS is not stated
- Direct agents and connectors
Not stated
Named systems
- FortiGate
Not stated
- F5 BIG-IP
Not stated
- NetScaler
Not stated
- SonicWall
Not stated
- Palo Alto
Not stated
- Check Point
Not stated
- Kemp LoadMaster
Not stated
- Cisco
Not stated
- IIS
Not stated
- Exchange
Not stated
- nginx and Apache
Not stated
- Tomcat (JKS)
Not stated
- Azure Key Vault
Not stated
- AWS Certificate Manager
Not stated
Push without an agent
- Push with no software on the destination
Not stated
Private keys
Network
- Servers with an agent or ACME
- Equipment without an agent
Not stated
Windows and Linux
- Windows
Not stated
- Linux
Not stated
Branch offices
Vendor and EU
- Vendor
Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA62
Full answer
press releases from 2026 are datelined Atlanta, GA and Stockholm
When Keyfactor Command fits better
- You want to run the platform in your own Kubernetes cluster or on Windows Server with your own Microsoft SQL Server.1,2
- You want a PKI that the vendor runs in a dedicated single-tenant cloud environment (PKIaaS).4,3
- You want to build your own Universal Orchestrator extensions with Keyfactor's framework and SDK (self-hosted, Kubernetes, CLAaaS or PKIaaS).14,5,16,1
Sources
- 1. Keyfactor Command (keyfactor.com), checked 11-10-2026
- 2. Physical Architecture (software.keyfactor.com), checked 11-10-2026
- 3. Annex III to Standard Contractual Clauses: List of Sub Processors (keyfactor.com), checked 11-10-2026
- 4. Keyfactor PKI as a Service (keyfactor.com), checked 11-10-2026
- 5. Orchestrators (software.keyfactor.com), checked 11-10-2026
- 6. remote-file-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 7. Keyfactor ACME: Introduction (software.keyfactor.com), checked 11-10-2026
- 8. Keyfactor SCEP: Introduction (software.keyfactor.com), checked 11-10-2026
- 9. ACME Enrollment (docs.keyfactor.com), checked 11-10-2026
- 10. Universal Orchestrator (docs.keyfactor.com), checked 11-10-2026
- 11. Command SaaS: Certificate Lifecycle Automation (azuremarketplace.microsoft.com), checked 11-10-2026
- 12. Keyfactor Command (azuremarketplace.microsoft.com), checked 11-10-2026
- 13. Keyfactor Command: PKI as-a-Service (azuremarketplace.microsoft.com), checked 11-10-2026
- 14. Keyfactor Universal Orchestrator (software.keyfactor.com), checked 11-10-2026
- 15. Integrations Catalog: Universal Orchestrator (keyfactor.github.io), checked 11-10-2026
- 16. Enrollment (software.keyfactor.com), checked 11-10-2026
- 17. Configuring Claims & Fetching EAB Keys in Command SaaS (docs.keyfactor.com), checked 11-10-2026
- 18. Command SaaS: Certificate Lifecycle Automation (azuremarketplace.microsoft.com), checked 11-10-2026
- 19. fortigate-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 20. fortimanager-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 21. f5-rest-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 22. Firewall Considerations (software.keyfactor.com), checked 11-10-2026
- 23. citrix-adc-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 24. paloalto-firewall-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 25. kemp-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 26. cisco-asa-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 27. iis-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 28. azurekeyvault-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 29. aws-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 30. a10vthunder-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 31. adobe-experience-manager-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 32. akamai-cps-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 33. alteon-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 34. aruba-clearpass-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 35. axis-ipcamera-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 36. azure-appgateway-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 37. barracuda-wafasaas-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 38. bosch-ipcamera-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 39. dell-idrac-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 40. f5-bigiq-rest-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 41. f5-waf-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 42. fortinet-fortiweb-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 43. gcp-apigee-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 44. gcp-certmanager-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 45. gcp-loadbalancer-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 46. hp-ilo-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 47. ibm-datapower-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 48. imperva-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 49. k8s-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 50. aws-secretsmanager-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 51. gcp-secretmanager-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 52. hashicorp-vault-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 53. mobotix-ipcamera-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 54. netapp-ontap-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 55. vmware-nsx-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 56. vmware-vcenter-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
- 57. Enrollment (software.keyfactor.com), checked 10-10-2026
- 58. Set up the Universal Orchestrator to Use a Forwarding Proxy (software.keyfactor.com), checked 11-10-2026
- 59. Introduction and architecture (docs.keyfactor.com), checked 11-10-2026
- 60. Installation and Configuration (docs.keyfactor.com), checked 11-10-2026
- 61. Configure Windows Targets for Remote Management (software.keyfactor.com), checked 11-10-2026
- 62. Privacy Policy (keyfactor.com), checked 11-10-2026
If you see an error about another vendor, write to us. We correct it and update the check date. Write to us
Try sslbrain
Start free. No credit card required.