sslbrain vs Keyfactor Command

Short answer

Keyfactor Command comes self-hosted, in the customer's Kubernetes cluster, hosted by Keyfactor (CLAaaS and PKIaaS) and as Command SaaS Lite.^1,2,3,4 Self-hosted, on Kubernetes, as CLAaaS and as PKIaaS, Universal Orchestrator with extensions delivers certificates to destinations over API, SSH or WinRM, or locally as an agent, and Command has its own ACME and SCEP server. Command SaaS Lite automates with ACME; whether extensions can install on destinations with SaaS Lite is not stated.^5,6,7,8,9,10 Command SaaS Lite has a public yearly price. The other editions require a sales conversation.^11,1,12,4,13

sslbrain runs as an appliance in your own network. The catalogue has 65 integrations. On Windows and Linux servers, a service agent installs the certificate. To network equipment and cloud services, the appliance pushes over API or SSH. Where there is no integration, you use a custom agent or ACME.

How to read the table

Every answer about another vendor carries a small number. It leads to the source at the foot of the page, with the date the source was last checked.
"Not stated" means it does not appear in the sources we reviewed. It does not mean no.
Prices are in the vendor's own currency, not converted. Where only the yearly or the monthly price is stated, the other is calculated and marked.
The sslbrain column has no source numbers. It comes from our own prices and our integration catalogue and links to those pages.

Every edition of Keyfactor Command and sslbrain

The table scrolls sideways.

Question	sslbrain	On-premises	Kubernetes	CLAaaS	PKIaaS	SaaS Lite
Price
Price per year and per month	Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint. See the prices	Not public, requires a sales conversation^1,12	Not public, requires a sales conversation^1,12	Not public, requires a sales conversation^1,12	Not public, requires a sales conversation^4,13	$56,000 per year¹¹ $4,666.67 per month (calculated) Unit: Entry Level plan with 2500 actioned certificates Minimum: 1-year subscription (1, 2 or 3 years)
Automation
How the certificate gets there	Both agents/push and ACME Full answer a service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH.	Both agents/push and ACME^5,6,7,8 Full answer Universal Orchestrator with extensions delivers certificates to destinations remotely (push via API, SSH or WinRM) or locally as an agent; also a Keyfactor ACME server for ACME clients and a Keyfactor SCEP server	Both agents/push and ACME^5,6,7,8 Full answer Universal Orchestrator with extensions delivers certificates to destinations remotely (push via API, SSH or WinRM) or locally as an agent; also a Keyfactor ACME server for ACME clients and a Keyfactor SCEP server	Both agents/push and ACME^5,6,7,8 Full answer Universal Orchestrator with extensions delivers certificates to destinations remotely (push via API, SSH or WinRM) or locally as an agent; also a Keyfactor ACME server for ACME clients and a Keyfactor SCEP server	Both agents/push and ACME^5,6,7,8 Full answer Universal Orchestrator with extensions delivers certificates to destinations remotely (push via API, SSH or WinRM) or locally as an agent; also a Keyfactor ACME server for ACME clients and a Keyfactor SCEP server	ACME/SCEP only^9,10 Full answer The Command SaaS portal deploys Keyfactor ACME instances for the customer's ACME clients; Universal Orchestrator is described in the Command SaaS documentation for discovery, MSCA inventory and log collection ("such as"); whether orchestrator extensions can install at destinations with Command SaaS is not stated
Direct agents and connectors	65 integrations in the catalogue See the integrations	42^14,15 Full answer Universal Orchestrator extensions from Keyfactor's GitHub organisation that place TLS certificates on a destination, including three secrets stores; the catalogue has 45 Universal Orchestrator entries including inventory and identity targets	42^14,15 Full answer Universal Orchestrator extensions from Keyfactor's GitHub organisation that place TLS certificates on a destination, including three secrets stores; the catalogue has 45 Universal Orchestrator entries including inventory and identity targets	42^14,15 Full answer Universal Orchestrator extensions from Keyfactor's GitHub organisation that place TLS certificates on a destination, including three secrets stores; the catalogue has 45 Universal Orchestrator entries including inventory and identity targets	42^14,15 Full answer Universal Orchestrator extensions from Keyfactor's GitHub organisation that place TLS certificates on a destination, including three secrets stores; the catalogue has 45 Universal Orchestrator entries including inventory and identity targets	Not stated
Without a direct agent	Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME	Custom extension for Universal Orchestrator (AnyAgent framework, Orchestrator NuGet package, Integration SDK), developed by the customer or Keyfactor^14,5,16,1 Full answer ACME/SCEP; PFX enrollment for download or certificate store; REST API	Custom extension for Universal Orchestrator (AnyAgent framework, Orchestrator NuGet package, Integration SDK), developed by the customer or Keyfactor^14,5,16,1 Full answer ACME/SCEP; PFX enrollment for download or certificate store; REST API	Custom extension for Universal Orchestrator (AnyAgent framework, Orchestrator NuGet package, Integration SDK), developed by the customer or Keyfactor^14,5,16,1 Full answer ACME/SCEP; PFX enrollment for download or certificate store; REST API	Custom extension for Universal Orchestrator (AnyAgent framework, Orchestrator NuGet package, Integration SDK), developed by the customer or Keyfactor^14,5,16,1 Full answer ACME/SCEP; PFX enrollment for download or certificate store; REST API	ACME client with an EAB key connecting to Command ACME, or enrolment from the public CA in the portal (the subsequent installation method is not stated)^17,18
Named systems
FortiGate	Yes Full answer Fortinet FortiGate: push from the appliance over the API, port 443	Yes^19,20 Full answer Universal Orchestrator extension via the FortiGate REST API with an API token; also via FortiManager	Yes^19,20 Full answer Universal Orchestrator extension via the FortiGate REST API with an API token; also via FortiManager	Yes^19,20 Full answer Universal Orchestrator extension via the FortiGate REST API with an API token; also via FortiManager	Yes^19,20 Full answer Universal Orchestrator extension via the FortiGate REST API with an API token; also via FortiManager	Not stated
F5 BIG-IP	Yes Full answer F5 BIG-IP: push from the appliance over the API, port 443	Yes^21,22 Full answer Universal Orchestrator extension via BIG-IP REST; also BIG-IQ and F5 Distributed Cloud WAF	Yes^21,22 Full answer Universal Orchestrator extension via BIG-IP REST; also BIG-IQ and F5 Distributed Cloud WAF	Yes^21,22 Full answer Universal Orchestrator extension via BIG-IP REST; also BIG-IQ and F5 Distributed Cloud WAF	Yes^21,22 Full answer Universal Orchestrator extension via BIG-IP REST; also BIG-IQ and F5 Distributed Cloud WAF	Not stated
NetScaler	Yes Full answer Citrix NetScaler / ADC: push from the appliance over the API, port 443	Yes²³ Full answer Universal Orchestrator extension for Citrix ADC; binding to virtual servers, ODKG	Yes²³ Full answer Universal Orchestrator extension for Citrix ADC; binding to virtual servers, ODKG	Yes²³ Full answer Universal Orchestrator extension for Citrix ADC; binding to virtual servers, ODKG	Yes²³ Full answer Universal Orchestrator extension for Citrix ADC; binding to virtual servers, ODKG	Not stated
SonicWall	Yes Full answer SonicWall SonicOS: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Not stated	Not stated
Palo Alto	Yes Full answer Palo Alto Networks PAN-OS: push from the appliance over the API, port 443	Yes²⁴ Full answer Universal Orchestrator extension for a firewall or Panorama	Yes²⁴ Full answer Universal Orchestrator extension for a firewall or Panorama	Yes²⁴ Full answer Universal Orchestrator extension for a firewall or Panorama	Yes²⁴ Full answer Universal Orchestrator extension for a firewall or Panorama	Not stated
Check Point	Yes Full answer Check Point HTTPS Inspection: push from the appliance over the API, port 443	Not stated	Not stated	Not stated	Not stated	Not stated
Kemp LoadMaster	Yes Full answer Kemp LoadMaster: push from the appliance over the API, port 443	Yes²⁵ Full answer Universal Orchestrator extension for Kemp Load Balancer: inventory, add and remove	Yes²⁵ Full answer Universal Orchestrator extension for Kemp Load Balancer: inventory, add and remove	Yes²⁵ Full answer Universal Orchestrator extension for Kemp Load Balancer: inventory, add and remove	Yes²⁵ Full answer Universal Orchestrator extension for Kemp Load Balancer: inventory, add and remove	Not stated
Cisco	Yes Full answer Cisco Secure Firewall (FDM): push from the appliance over the API, port 443	Yes²⁶ Full answer Cisco ASA via a Universal Orchestrator extension: identity certificates and Remote Access VPN bindings; Cisco FTD and ISE not stated	Yes²⁶ Full answer Cisco ASA via a Universal Orchestrator extension: identity certificates and Remote Access VPN bindings; Cisco FTD and ISE not stated	Yes²⁶ Full answer Cisco ASA via a Universal Orchestrator extension: identity certificates and Remote Access VPN bindings; Cisco FTD and ISE not stated	Yes²⁶ Full answer Cisco ASA via a Universal Orchestrator extension: identity certificates and Remote Access VPN bindings; Cisco FTD and ISE not stated	Not stated
IIS	Yes Full answer Microsoft IIS: service agent on the server	Yes²⁷ Full answer iis-orchestrator, store type WinIIS: remotely via WinRM or locally as an agent on Windows	Yes²⁷ Full answer iis-orchestrator, store type WinIIS: remotely via WinRM or locally as an agent on Windows	Yes²⁷ Full answer iis-orchestrator, store type WinIIS: remotely via WinRM or locally as an agent on Windows	Yes²⁷ Full answer iis-orchestrator, store type WinIIS: remotely via WinRM or locally as an agent on Windows	Not stated
Exchange	Yes Full answer Microsoft Exchange: service agent on the server	Not stated	Not stated	Not stated	Not stated	Not stated
nginx and Apache	Yes Full answer Nginx: service agent on the server; Apache HTTP Server: service agent on the server	Yes^6,7 Full answer RemoteFile, store type RFPEM via SSH or locally, with an optional restart of Apache HTTPD or NGINX after the job; also ACME clients connecting to Keyfactor ACME	Yes^6,7 Full answer RemoteFile, store type RFPEM via SSH or locally, with an optional restart of Apache HTTPD or NGINX after the job; also ACME clients connecting to Keyfactor ACME	Yes^6,7 Full answer RemoteFile, store type RFPEM via SSH or locally, with an optional restart of Apache HTTPD or NGINX after the job; also ACME clients connecting to Keyfactor ACME	Yes^6,7 Full answer RemoteFile, store type RFPEM via SSH or locally, with an optional restart of Apache HTTPD or NGINX after the job; also ACME clients connecting to Keyfactor ACME	Not stated
Tomcat (JKS)	Yes Full answer Apache Tomcat: service agent on the server	Yes^6,14 Full answer RemoteFile, store type RFJKS for Java keystores via SSH/WinRM or locally, with an optional restart of Apache Tomcat after the job	Yes^6,14 Full answer RemoteFile, store type RFJKS for Java keystores via SSH/WinRM or locally, with an optional restart of Apache Tomcat after the job	Yes^6,14 Full answer RemoteFile, store type RFJKS for Java keystores via SSH/WinRM or locally, with an optional restart of Apache Tomcat after the job	Yes^6,14 Full answer RemoteFile, store type RFJKS for Java keystores via SSH/WinRM or locally, with an optional restart of Apache Tomcat after the job	Not stated
Azure Key Vault	Yes Full answer Azure Key Vault: push from the appliance over the API, port 443	Yes²⁸ Full answer Universal Orchestrator extension for Azure Key Vault: inventory, add, remove and discovery	Yes²⁸ Full answer Universal Orchestrator extension for Azure Key Vault: inventory, add, remove and discovery	Yes²⁸ Full answer Universal Orchestrator extension for Azure Key Vault: inventory, add, remove and discovery	Yes²⁸ Full answer Universal Orchestrator extension for Azure Key Vault: inventory, add, remove and discovery	Not stated
AWS Certificate Manager	Yes Full answer AWS Certificate Manager: push from the appliance over the API, port 443	Yes²⁹ Full answer Universal Orchestrator extension AWS-ACM-v3 with IAM, AssumeRole or OIDC	Yes²⁹ Full answer Universal Orchestrator extension AWS-ACM-v3 with IAM, AssumeRole or OIDC	Yes²⁹ Full answer Universal Orchestrator extension AWS-ACM-v3 with IAM, AssumeRole or OIDC	Yes²⁹ Full answer Universal Orchestrator extension AWS-ACM-v3 with IAM, AssumeRole or OIDC	Not stated
Push without an agent
Push with no software on the destination	46 destinations Show the list Akamai CPS (push from the appliance over the API, port 443) AWS Certificate Manager (push from the appliance over the API, port 443) AWS CloudFront (push from the appliance over the API, port 443) AWS ELB & API Gateway (push from the appliance over the API, port 443) Azure App Service (push from the appliance over the API, port 443) Azure Application Gateway (push from the appliance over the API, port 443) Azure Front Door (push from the appliance over the API, port 443) Azure Key Vault (push from the appliance over the API, port 443) Barracuda CloudGen Firewall (push from the appliance over the API, port 8443) Barracuda Web Application Firewall (push from the appliance over the API, port 8443) Bunny.net CDN (push from the appliance over the API, port 443) Check Point HTTPS Inspection (push from the appliance over the API, port 443) Cisco ASA / ASAv (push from the appliance over SSH, port 22) Cisco ISE (push from the appliance over the API, port 443) Cisco Secure Firewall (FDM) (push from the appliance over the API, port 443) Cisco Secure Firewall (FMC) (push from the appliance over the API, port 443) Citrix NetScaler / ADC (push from the appliance over the API, port 443) Cloudflare (push from the appliance over the API, port 443) Dell iDRAC (push from the appliance over the API, port 443) F5 BIG-IP (push from the appliance over the API, port 443) Fortinet FortiADC (push from the appliance over the API, port 443) Fortinet FortiGate (push from the appliance over the API, port 443) Fortinet FortiMail (push from the appliance over SSH, port 22) Fortinet FortiManager (push from the appliance over the API, port 443) Fortinet FortiNAC (push from the appliance over the API, port 8443) Google Cloud Certificate Manager (push from the appliance over the API, port 443) HPE iLO (push from the appliance over the API, port 443) Infoblox NIOS Grid Manager (push from the appliance over the API, port 443) Juniper SRX / vSRX (push from the appliance over SSH, port 22) Kemp LoadMaster (push from the appliance over the API, port 443) Kubernetes (push from the appliance over the API, port 6443) NetApp ONTAP (push from the appliance over the API, port 443) OPNsense (push from the appliance over the API, port 443) Palo Alto Networks PAN-OS (push from the appliance over the API, port 443) pfSense (push from the appliance over SSH, port 22) Proxmox Backup Server (push from the appliance over the API, port 8007) Proxmox Mail Gateway (push from the appliance over the API, port 8006) Proxmox VE (push from the appliance over the API, port 8006) SonicWall SonicOS (push from the appliance over the API, port 443) Sophos Firewall (push from the appliance over the API, port 4444) Synology DSM (push from the appliance over the API, port 5001) TrueNAS SCALE / CORE (push from the appliance over the API, port 443) Ubiquiti UniFi (push from the appliance over SSH, port 22) VMware ESXi (push from the appliance over SSH, port 22) VMware vCenter (push from the appliance over the API, port 443) WatchGuard Firebox (Local: SSH 4118 · Cloud: HTTPS 443) See the integrations	42 destinations Show the list A10 Networks vThunder (SSL certificates via API; management certificate via SCP)³⁰ Adobe Experience Manager as a Cloud Service (Cloud Manager API)³¹ Akamai Certificate Provisioning System (CPS; key created in Akamai)³² Radware Alteon Load Balancer (REST API, binding to virtual services)³³ Aruba ClearPass Policy Manager (re-enrollment)³⁴ AWS Certificate Manager (ACM)²⁹ AXIS IP cameras (ODKG on the camera)³⁵ Azure Application Gateway (certificates and HTTPS/TLS listener bindings)³⁶ Azure Key Vault²⁸ Barracuda WAF-as-a-Service³⁷ Bosch IP cameras (re-enrollment)³⁸ Cisco ASA (identity certificates, trustpoints and Remote Access VPN bindings)²⁶ Citrix ADC / NetScaler (binding to virtual servers; ODKG)²³ Dell iDRAC³⁹ F5 BIG-IP (version 14 and later)²¹ F5 BIG-IQ (can deploy onwards to associated BIG-IP)⁴⁰ F5 Distributed Cloud / Multi-Cloud App Connect (WAF)⁴¹ Fortinet FortiGate (API with an API token)¹⁹ Fortinet FortiManager (FortiGate devices managed by FortiManager)²⁰ Fortinet FortiWeb⁴² Google Cloud Apigee⁴³ Google Cloud Certificate Manager⁴⁴ Google Cloud Load Balancer⁴⁵ HPE iLO (HTTPS certificate via ODKG)⁴⁶ IBM DataPower (REST Management Interface)⁴⁷ Imperva (cloud WAF)⁴⁸ Kubernetes TLS and Opaque secrets⁴⁹ AWS Secrets Manager (Add and Remove from the orchestrator)⁵⁰ Google Cloud Secret Manager (Add and Remove from the orchestrator)⁵¹ HashiCorp Vault Key-Value secrets engine (PEM, JKS, PKCS12 and PFX; Add and Remove)⁵² Kemp Load Balancer²⁵ Mobotix IP cameras (x7 and x8; the key is created on the orchestrator)⁵³ NetApp ONTAP (cluster and SVM, ONTAP REST API)⁵⁴ Palo Alto Networks firewall²⁴ Palo Alto Networks Panorama²⁴ File-based certificate stores on Linux and Windows servers (RemoteFile: JKS, PEM, PKCS12, DER, IBM KDB, Oracle Wallet) via SSH or WinRM⁶ VMware NSX Advanced Load Balancer (Avi)⁵⁵ VMware vCenter⁵⁶ Windows certificate store, Local Machine (WinCert via WinRM; the default mode loads scripts at session start, optional JEA mode requires Keyfactor modules on the target)²⁷ Microsoft IIS, bound certificates (WinIIS via WinRM; creates and removes IIS bindings)²⁷ Microsoft SQL Server, certificates bound to SQL instances (WinSQL via WinRM; bind and unbind)²⁷ Microsoft AD FS, Service-Communications certificate on primary and secondary nodes (WinADFS via WinRM)²⁷ What the list covers: Found in Keyfactor’s GitHub organisation (60 repos with "orchestrator" in the name) and cross-checked against the integration catalogue (45 Universal Orchestrator entries). Included: extensions that place a TLS certificate on the destination (Add, replacement or ODKG); one row per destination according to the counting unit in _kontrol/FORMAT.md (WinCert, WinIIS, WinSQL and WinADFS separately; Palo Alto firewall and Panorama separately; secrets stores with Add are counted). Excluded: inventory-only (Cloudflare Edge, Fastly, Fortanix, Signum), HashiCorp Vault PKI-store (no Add), HSM (PKCS11), SAML/identity (Okta, Azure App Registration) and older duplicates. The catalogue is public, but lacks three extensions available on GitHub (Adobe AEM, NetApp ONTAP, Mobotix)^5,15	42 destinations Show the list A10 Networks vThunder (SSL certificates via API; management certificate via SCP)³⁰ Adobe Experience Manager as a Cloud Service (Cloud Manager API)³¹ Akamai Certificate Provisioning System (CPS; key created in Akamai)³² Radware Alteon Load Balancer (REST API, binding to virtual services)³³ Aruba ClearPass Policy Manager (re-enrollment)³⁴ AWS Certificate Manager (ACM)²⁹ AXIS IP cameras (ODKG on the camera)³⁵ Azure Application Gateway (certificates and HTTPS/TLS listener bindings)³⁶ Azure Key Vault²⁸ Barracuda WAF-as-a-Service³⁷ Bosch IP cameras (re-enrollment)³⁸ Cisco ASA (identity certificates, trustpoints and Remote Access VPN bindings)²⁶ Citrix ADC / NetScaler (binding to virtual servers; ODKG)²³ Dell iDRAC³⁹ F5 BIG-IP (version 14 and later)²¹ F5 BIG-IQ (can deploy onwards to associated BIG-IP)⁴⁰ F5 Distributed Cloud / Multi-Cloud App Connect (WAF)⁴¹ Fortinet FortiGate (API with an API token)¹⁹ Fortinet FortiManager (FortiGate devices managed by FortiManager)²⁰ Fortinet FortiWeb⁴² Google Cloud Apigee⁴³ Google Cloud Certificate Manager⁴⁴ Google Cloud Load Balancer⁴⁵ HPE iLO (HTTPS certificate via ODKG)⁴⁶ IBM DataPower (REST Management Interface)⁴⁷ Imperva (cloud WAF)⁴⁸ Kubernetes TLS and Opaque secrets⁴⁹ AWS Secrets Manager (Add and Remove from the orchestrator)⁵⁰ Google Cloud Secret Manager (Add and Remove from the orchestrator)⁵¹ HashiCorp Vault Key-Value secrets engine (PEM, JKS, PKCS12 and PFX; Add and Remove)⁵² Kemp Load Balancer²⁵ Mobotix IP cameras (x7 and x8; the key is created on the orchestrator)⁵³ NetApp ONTAP (cluster and SVM, ONTAP REST API)⁵⁴ Palo Alto Networks firewall²⁴ Palo Alto Networks Panorama²⁴ File-based certificate stores on Linux and Windows servers (RemoteFile: JKS, PEM, PKCS12, DER, IBM KDB, Oracle Wallet) via SSH or WinRM⁶ VMware NSX Advanced Load Balancer (Avi)⁵⁵ VMware vCenter⁵⁶ Windows certificate store, Local Machine (WinCert via WinRM; the default mode loads scripts at session start, optional JEA mode requires Keyfactor modules on the target)²⁷ Microsoft IIS, bound certificates (WinIIS via WinRM; creates and removes IIS bindings)²⁷ Microsoft SQL Server, certificates bound to SQL instances (WinSQL via WinRM; bind and unbind)²⁷ Microsoft AD FS, Service-Communications certificate on primary and secondary nodes (WinADFS via WinRM)²⁷ What the list covers: Found in Keyfactor’s GitHub organisation (60 repos with "orchestrator" in the name) and cross-checked against the integration catalogue (45 Universal Orchestrator entries). Included: extensions that place a TLS certificate on the destination (Add, replacement or ODKG); one row per destination according to the counting unit in _kontrol/FORMAT.md (WinCert, WinIIS, WinSQL and WinADFS separately; Palo Alto firewall and Panorama separately; secrets stores with Add are counted). Excluded: inventory-only (Cloudflare Edge, Fastly, Fortanix, Signum), HashiCorp Vault PKI-store (no Add), HSM (PKCS11), SAML/identity (Okta, Azure App Registration) and older duplicates. The catalogue is public, but lacks three extensions available on GitHub (Adobe AEM, NetApp ONTAP, Mobotix)^5,15	42 destinations Show the list A10 Networks vThunder (SSL certificates via API; management certificate via SCP)³⁰ Adobe Experience Manager as a Cloud Service (Cloud Manager API)³¹ Akamai Certificate Provisioning System (CPS; key created in Akamai)³² Radware Alteon Load Balancer (REST API, binding to virtual services)³³ Aruba ClearPass Policy Manager (re-enrollment)³⁴ AWS Certificate Manager (ACM)²⁹ AXIS IP cameras (ODKG on the camera)³⁵ Azure Application Gateway (certificates and HTTPS/TLS listener bindings)³⁶ Azure Key Vault²⁸ Barracuda WAF-as-a-Service³⁷ Bosch IP cameras (re-enrollment)³⁸ Cisco ASA (identity certificates, trustpoints and Remote Access VPN bindings)²⁶ Citrix ADC / NetScaler (binding to virtual servers; ODKG)²³ Dell iDRAC³⁹ F5 BIG-IP (version 14 and later)²¹ F5 BIG-IQ (can deploy onwards to associated BIG-IP)⁴⁰ F5 Distributed Cloud / Multi-Cloud App Connect (WAF)⁴¹ Fortinet FortiGate (API with an API token)¹⁹ Fortinet FortiManager (FortiGate devices managed by FortiManager)²⁰ Fortinet FortiWeb⁴² Google Cloud Apigee⁴³ Google Cloud Certificate Manager⁴⁴ Google Cloud Load Balancer⁴⁵ HPE iLO (HTTPS certificate via ODKG)⁴⁶ IBM DataPower (REST Management Interface)⁴⁷ Imperva (cloud WAF)⁴⁸ Kubernetes TLS and Opaque secrets⁴⁹ AWS Secrets Manager (Add and Remove from the orchestrator)⁵⁰ Google Cloud Secret Manager (Add and Remove from the orchestrator)⁵¹ HashiCorp Vault Key-Value secrets engine (PEM, JKS, PKCS12 and PFX; Add and Remove)⁵² Kemp Load Balancer²⁵ Mobotix IP cameras (x7 and x8; the key is created on the orchestrator)⁵³ NetApp ONTAP (cluster and SVM, ONTAP REST API)⁵⁴ Palo Alto Networks firewall²⁴ Palo Alto Networks Panorama²⁴ File-based certificate stores on Linux and Windows servers (RemoteFile: JKS, PEM, PKCS12, DER, IBM KDB, Oracle Wallet) via SSH or WinRM⁶ VMware NSX Advanced Load Balancer (Avi)⁵⁵ VMware vCenter⁵⁶ Windows certificate store, Local Machine (WinCert via WinRM; the default mode loads scripts at session start, optional JEA mode requires Keyfactor modules on the target)²⁷ Microsoft IIS, bound certificates (WinIIS via WinRM; creates and removes IIS bindings)²⁷ Microsoft SQL Server, certificates bound to SQL instances (WinSQL via WinRM; bind and unbind)²⁷ Microsoft AD FS, Service-Communications certificate on primary and secondary nodes (WinADFS via WinRM)²⁷ What the list covers: Found in Keyfactor’s GitHub organisation (60 repos with "orchestrator" in the name) and cross-checked against the integration catalogue (45 Universal Orchestrator entries). Included: extensions that place a TLS certificate on the destination (Add, replacement or ODKG); one row per destination according to the counting unit in _kontrol/FORMAT.md (WinCert, WinIIS, WinSQL and WinADFS separately; Palo Alto firewall and Panorama separately; secrets stores with Add are counted). Excluded: inventory-only (Cloudflare Edge, Fastly, Fortanix, Signum), HashiCorp Vault PKI-store (no Add), HSM (PKCS11), SAML/identity (Okta, Azure App Registration) and older duplicates. The catalogue is public, but lacks three extensions available on GitHub (Adobe AEM, NetApp ONTAP, Mobotix)^5,15	42 destinations Show the list A10 Networks vThunder (SSL certificates via API; management certificate via SCP)³⁰ Adobe Experience Manager as a Cloud Service (Cloud Manager API)³¹ Akamai Certificate Provisioning System (CPS; key created in Akamai)³² Radware Alteon Load Balancer (REST API, binding to virtual services)³³ Aruba ClearPass Policy Manager (re-enrollment)³⁴ AWS Certificate Manager (ACM)²⁹ AXIS IP cameras (ODKG on the camera)³⁵ Azure Application Gateway (certificates and HTTPS/TLS listener bindings)³⁶ Azure Key Vault²⁸ Barracuda WAF-as-a-Service³⁷ Bosch IP cameras (re-enrollment)³⁸ Cisco ASA (identity certificates, trustpoints and Remote Access VPN bindings)²⁶ Citrix ADC / NetScaler (binding to virtual servers; ODKG)²³ Dell iDRAC³⁹ F5 BIG-IP (version 14 and later)²¹ F5 BIG-IQ (can deploy onwards to associated BIG-IP)⁴⁰ F5 Distributed Cloud / Multi-Cloud App Connect (WAF)⁴¹ Fortinet FortiGate (API with an API token)¹⁹ Fortinet FortiManager (FortiGate devices managed by FortiManager)²⁰ Fortinet FortiWeb⁴² Google Cloud Apigee⁴³ Google Cloud Certificate Manager⁴⁴ Google Cloud Load Balancer⁴⁵ HPE iLO (HTTPS certificate via ODKG)⁴⁶ IBM DataPower (REST Management Interface)⁴⁷ Imperva (cloud WAF)⁴⁸ Kubernetes TLS and Opaque secrets⁴⁹ AWS Secrets Manager (Add and Remove from the orchestrator)⁵⁰ Google Cloud Secret Manager (Add and Remove from the orchestrator)⁵¹ HashiCorp Vault Key-Value secrets engine (PEM, JKS, PKCS12 and PFX; Add and Remove)⁵² Kemp Load Balancer²⁵ Mobotix IP cameras (x7 and x8; the key is created on the orchestrator)⁵³ NetApp ONTAP (cluster and SVM, ONTAP REST API)⁵⁴ Palo Alto Networks firewall²⁴ Palo Alto Networks Panorama²⁴ File-based certificate stores on Linux and Windows servers (RemoteFile: JKS, PEM, PKCS12, DER, IBM KDB, Oracle Wallet) via SSH or WinRM⁶ VMware NSX Advanced Load Balancer (Avi)⁵⁵ VMware vCenter⁵⁶ Windows certificate store, Local Machine (WinCert via WinRM; the default mode loads scripts at session start, optional JEA mode requires Keyfactor modules on the target)²⁷ Microsoft IIS, bound certificates (WinIIS via WinRM; creates and removes IIS bindings)²⁷ Microsoft SQL Server, certificates bound to SQL instances (WinSQL via WinRM; bind and unbind)²⁷ Microsoft AD FS, Service-Communications certificate on primary and secondary nodes (WinADFS via WinRM)²⁷ What the list covers: Found in Keyfactor’s GitHub organisation (60 repos with "orchestrator" in the name) and cross-checked against the integration catalogue (45 Universal Orchestrator entries). Included: extensions that place a TLS certificate on the destination (Add, replacement or ODKG); one row per destination according to the counting unit in _kontrol/FORMAT.md (WinCert, WinIIS, WinSQL and WinADFS separately; Palo Alto firewall and Panorama separately; secrets stores with Add are counted). Excluded: inventory-only (Cloudflare Edge, Fastly, Fortanix, Signum), HashiCorp Vault PKI-store (no Add), HSM (PKCS11), SAML/identity (Okta, Azure App Registration) and older duplicates. The catalogue is public, but lacks three extensions available on GitHub (Adobe AEM, NetApp ONTAP, Mobotix)^5,15	Not stated
Private keys
Where the private key is kept	On-prem appliance See the architecture	On-prem at the customer^1,57,6 The destination^35,32,23	On-prem at the customer^1,57,6 The destination^35,32,23	The vendor's cloud^1,16 On-prem at the customer^6,53 The destination^35,32,23	The vendor's cloud^1,16 On-prem at the customer^6,53 The destination^35,32,23	The destination^9,17
Network
Servers with an agent or ACME	The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports	Universal Orchestrator (also as a local agent) initiates the connection to Command’s Orchestrator API itself and retrieves jobs: HTTP/HTTPS TCP 80/443 or configured ports^5,22,58 Full answer can go via a forward proxy. With hosted/PKIaaS, the connection goes from the customer’s network to Keyfactor’s infrastructure; an inbound internet connection to the orchestrator is not mentioned. ACME clients connect to the Keyfactor ACME server; ports for ACME and challenges are not stated	Universal Orchestrator (also as a local agent) initiates the connection to Command’s Orchestrator API itself and retrieves jobs: HTTP/HTTPS TCP 80/443 or configured ports^5,22,58 Full answer can go via a forward proxy. With hosted/PKIaaS, the connection goes from the customer’s network to Keyfactor’s infrastructure; an inbound internet connection to the orchestrator is not mentioned. ACME clients connect to the Keyfactor ACME server; ports for ACME and challenges are not stated	Universal Orchestrator (also as a local agent) initiates the connection to Command’s Orchestrator API itself and retrieves jobs: HTTP/HTTPS TCP 80/443 or configured ports^5,22,58 Full answer can go via a forward proxy. With hosted/PKIaaS, the connection goes from the customer’s network to Keyfactor’s infrastructure; an inbound internet connection to the orchestrator is not mentioned. ACME clients connect to the Keyfactor ACME server; ports for ACME and challenges are not stated	Universal Orchestrator (also as a local agent) initiates the connection to Command’s Orchestrator API itself and retrieves jobs: HTTP/HTTPS TCP 80/443 or configured ports^5,22,58 Full answer can go via a forward proxy. With hosted/PKIaaS, the connection goes from the customer’s network to Keyfactor’s infrastructure; an inbound internet connection to the orchestrator is not mentioned. ACME clients connect to the Keyfactor ACME server; ports for ACME and challenges are not stated	Universal Orchestrator and users must have their public IP allowlisted in the SaaS portal to reach Command SaaS^59,60,9 Full answer the orchestrator connects outbound to Command SaaS. ACME clients connect to a Keyfactor ACME instance deployed from the portal; ports are not stated
Equipment without an agent	The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet	From Universal Orchestrator in the customer’s network to the destination: WinRM TCP 5985 (HTTP) or 5986 (HTTPS) to Windows targets, SSH (default TCP 22) to Linux targets via RemoteFile, HTTP/HTTPS TCP 80/443 to F5 and NetScaler, IBM DataPower typically port 5554^61,6,22,47,5 Full answer ports to cloud APIs are not stated. The orchestrator retrieves jobs itself, so Command does not open connections into the orchestrator	From Universal Orchestrator in the customer’s network to the destination: WinRM TCP 5985 (HTTP) or 5986 (HTTPS) to Windows targets, SSH (default TCP 22) to Linux targets via RemoteFile, HTTP/HTTPS TCP 80/443 to F5 and NetScaler, IBM DataPower typically port 5554^61,6,22,47,5 Full answer ports to cloud APIs are not stated. The orchestrator retrieves jobs itself, so Command does not open connections into the orchestrator	From Universal Orchestrator in the customer’s network to the destination: WinRM TCP 5985 (HTTP) or 5986 (HTTPS) to Windows targets, SSH (default TCP 22) to Linux targets via RemoteFile, HTTP/HTTPS TCP 80/443 to F5 and NetScaler, IBM DataPower typically port 5554^61,6,22,47,5 Full answer ports to cloud APIs are not stated. The orchestrator retrieves jobs itself, so Command does not open connections into the orchestrator	From Universal Orchestrator in the customer’s network to the destination: WinRM TCP 5985 (HTTP) or 5986 (HTTPS) to Windows targets, SSH (default TCP 22) to Linux targets via RemoteFile, HTTP/HTTPS TCP 80/443 to F5 and NetScaler, IBM DataPower typically port 5554^61,6,22,47,5 Full answer ports to cloud APIs are not stated. The orchestrator retrieves jobs itself, so Command does not open connections into the orchestrator	Not stated
Windows and Linux
Windows	Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports	iis-orchestrator: Local Machine certificate store, IIS bindings, SQL Server and AD FS remote via WinRM (TCP 5985/5986) from a Windows orchestrator or SSH from a Linux orchestrator, or locally as an agent^27,61 Full answer RemoteFile handles JKS/PKCS12/PEM files on Windows via WinRM	iis-orchestrator: Local Machine certificate store, IIS bindings, SQL Server and AD FS remote via WinRM (TCP 5985/5986) from a Windows orchestrator or SSH from a Linux orchestrator, or locally as an agent^27,61 Full answer RemoteFile handles JKS/PKCS12/PEM files on Windows via WinRM	iis-orchestrator: Local Machine certificate store, IIS bindings, SQL Server and AD FS remote via WinRM (TCP 5985/5986) from a Windows orchestrator or SSH from a Linux orchestrator, or locally as an agent^27,61 Full answer RemoteFile handles JKS/PKCS12/PEM files on Windows via WinRM	iis-orchestrator: Local Machine certificate store, IIS bindings, SQL Server and AD FS remote via WinRM (TCP 5985/5986) from a Windows orchestrator or SSH from a Linux orchestrator, or locally as an agent^27,61 Full answer RemoteFile handles JKS/PKCS12/PEM files on Windows via WinRM	Not stated
Linux	Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports	RemoteFile from an orchestrator via SSH (default TCP 22) with SCP/SFTP, or locally as an agent directly in the file system^6,7 Full answer optional restart of Apache HTTPD, NGINX, HAProxy or Envoy after the job. Also ACME clients such as Certbot against Keyfactor ACME	RemoteFile from an orchestrator via SSH (default TCP 22) with SCP/SFTP, or locally as an agent directly in the file system^6,7 Full answer optional restart of Apache HTTPD, NGINX, HAProxy or Envoy after the job. Also ACME clients such as Certbot against Keyfactor ACME	RemoteFile from an orchestrator via SSH (default TCP 22) with SCP/SFTP, or locally as an agent directly in the file system^6,7 Full answer optional restart of Apache HTTPD, NGINX, HAProxy or Envoy after the job. Also ACME clients such as Certbot against Keyfactor ACME	RemoteFile from an orchestrator via SSH (default TCP 22) with SCP/SFTP, or locally as an agent directly in the file system^6,7 Full answer optional restart of Apache HTTPD, NGINX, HAProxy or Envoy after the job. Also ACME clients such as Certbot against Keyfactor ACME	Not stated
Branch offices
Remote sites and branch offices	One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports	Universal Orchestrator is installed in the network with the destinations and retrieves jobs from Command itself, also via a forward proxy^10,5,58 Full answer multiple orchestrators can be installed, and SSL scanning can be distributed across orchestrator pools. Requirements for sites without a direct connection (e.g. VPN) are not stated	Universal Orchestrator is installed in the network with the destinations and retrieves jobs from Command itself, also via a forward proxy^10,5,58 Full answer multiple orchestrators can be installed, and SSL scanning can be distributed across orchestrator pools. Requirements for sites without a direct connection (e.g. VPN) are not stated	Universal Orchestrator is installed in the network with the destinations and retrieves jobs from Command itself, also via a forward proxy^10,5,58 Full answer multiple orchestrators can be installed, and SSL scanning can be distributed across orchestrator pools. Requirements for sites without a direct connection (e.g. VPN) are not stated	Universal Orchestrator is installed in the network with the destinations and retrieves jobs from Command itself, also via a forward proxy^10,5,58 Full answer multiple orchestrators can be installed, and SSL scanning can be distributed across orchestrator pools. Requirements for sites without a direct connection (e.g. VPN) are not stated	Universal Orchestrator is installed on the customer's network and must have its public IP allowlisted in the SaaS portal^10,60 Full answer requirements for sites without a direct connection are not stated
Vendor and EU
Vendor	FairSSL A/S, Denmark	Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA⁶² Full answer press releases from 2026 are datelined Atlanta, GA and Stockholm	Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA⁶² Full answer press releases from 2026 are datelined Atlanta, GA and Stockholm	Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA⁶² Full answer press releases from 2026 are datelined Atlanta, GA and Stockholm	Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA⁶² Full answer press releases from 2026 are datelined Atlanta, GA and Stockholm	Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA⁶² Full answer press releases from 2026 are datelined Atlanta, GA and Stockholm
Hosting and the EU	EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud) See the infrastructure	The customer’s own data centre or cloud^1,2 Full answer Command runs on Windows Server/IIS with the customer’s Microsoft SQL Server	The customer’s own Kubernetes cluster (containers installed with Helm Charts)^1,2	Hosted by Keyfactor^1,3 Full answer Keyfactor's subprocessor list (22-02-2023) mentions Microsoft Corporation as the hosting provider. The data centre country and EU region are not stated	Keyfactor-operated, dedicated single-tenant cloud environment^4,3 Full answer Keyfactor's subprocessor list (22-02-2023) mentions Microsoft Corporation as the hosting provider. The data centre country and EU region are not stated	Hosted by Keyfactor^1,3 Full answer Keyfactor's subprocessor list (22-02-2023) mentions Microsoft Corporation as the hosting provider. The data centre country and EU region are not stated

sslbrain

Price

Price per year and per month: Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint.

See the prices

Automation

How the certificate gets there: Both agents/push and ACME

Full answer

a service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH.
Direct agents and connectors: 65 integrations in the catalogue

See the integrations
Without a direct agent: Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME

Named systems

FortiGate: Yes

Full answer

Fortinet FortiGate: push from the appliance over the API, port 443
F5 BIG-IP: Yes

Full answer

F5 BIG-IP: push from the appliance over the API, port 443
NetScaler: Yes

Full answer

Citrix NetScaler / ADC: push from the appliance over the API, port 443
SonicWall: Yes

Full answer

SonicWall SonicOS: push from the appliance over the API, port 443
Palo Alto: Yes

Full answer

Palo Alto Networks PAN-OS: push from the appliance over the API, port 443
Check Point: Yes

Full answer

Check Point HTTPS Inspection: push from the appliance over the API, port 443
Kemp LoadMaster: Yes

Full answer

Kemp LoadMaster: push from the appliance over the API, port 443
Cisco: Yes

Full answer

Cisco Secure Firewall (FDM): push from the appliance over the API, port 443
IIS: Yes

Full answer

Microsoft IIS: service agent on the server
Exchange: Yes

Full answer

Microsoft Exchange: service agent on the server
nginx and Apache: Yes

Full answer

Nginx: service agent on the server; Apache HTTP Server: service agent on the server
Tomcat (JKS): Yes

Full answer

Apache Tomcat: service agent on the server
Azure Key Vault: Yes

Full answer

Azure Key Vault: push from the appliance over the API, port 443
AWS Certificate Manager: Yes

Full answer

AWS Certificate Manager: push from the appliance over the API, port 443

Push without an agent

Push with no software on the destination: 46 destinations

Show the list

Akamai CPS (push from the appliance over the API, port 443)
AWS Certificate Manager (push from the appliance over the API, port 443)
AWS CloudFront (push from the appliance over the API, port 443)
AWS ELB & API Gateway (push from the appliance over the API, port 443)
Azure App Service (push from the appliance over the API, port 443)
Azure Application Gateway (push from the appliance over the API, port 443)
Azure Front Door (push from the appliance over the API, port 443)
Azure Key Vault (push from the appliance over the API, port 443)
Barracuda CloudGen Firewall (push from the appliance over the API, port 8443)
Barracuda Web Application Firewall (push from the appliance over the API, port 8443)
Bunny.net CDN (push from the appliance over the API, port 443)
Check Point HTTPS Inspection (push from the appliance over the API, port 443)
Cisco ASA / ASAv (push from the appliance over SSH, port 22)
Cisco ISE (push from the appliance over the API, port 443)
Cisco Secure Firewall (FDM) (push from the appliance over the API, port 443)
Cisco Secure Firewall (FMC) (push from the appliance over the API, port 443)
Citrix NetScaler / ADC (push from the appliance over the API, port 443)
Cloudflare (push from the appliance over the API, port 443)
Dell iDRAC (push from the appliance over the API, port 443)
F5 BIG-IP (push from the appliance over the API, port 443)
Fortinet FortiADC (push from the appliance over the API, port 443)
Fortinet FortiGate (push from the appliance over the API, port 443)
Fortinet FortiMail (push from the appliance over SSH, port 22)
Fortinet FortiManager (push from the appliance over the API, port 443)
Fortinet FortiNAC (push from the appliance over the API, port 8443)
Google Cloud Certificate Manager (push from the appliance over the API, port 443)
HPE iLO (push from the appliance over the API, port 443)
Infoblox NIOS Grid Manager (push from the appliance over the API, port 443)
Juniper SRX / vSRX (push from the appliance over SSH, port 22)
Kemp LoadMaster (push from the appliance over the API, port 443)
Kubernetes (push from the appliance over the API, port 6443)
NetApp ONTAP (push from the appliance over the API, port 443)
OPNsense (push from the appliance over the API, port 443)
Palo Alto Networks PAN-OS (push from the appliance over the API, port 443)
pfSense (push from the appliance over SSH, port 22)
Proxmox Backup Server (push from the appliance over the API, port 8007)
Proxmox Mail Gateway (push from the appliance over the API, port 8006)
Proxmox VE (push from the appliance over the API, port 8006)
SonicWall SonicOS (push from the appliance over the API, port 443)
Sophos Firewall (push from the appliance over the API, port 4444)
Synology DSM (push from the appliance over the API, port 5001)
TrueNAS SCALE / CORE (push from the appliance over the API, port 443)
Ubiquiti UniFi (push from the appliance over SSH, port 22)
VMware ESXi (push from the appliance over SSH, port 22)
VMware vCenter (push from the appliance over the API, port 443)
WatchGuard Firebox (Local: SSH 4118 · Cloud: HTTPS 443)

See the integrations

Private keys

Where the private key is kept: On-prem appliance

See the architecture

Network

Servers with an agent or ACME: The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports
Equipment without an agent: The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet

Windows and Linux

Windows: Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports
Linux: Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports

Branch offices

Remote sites and branch offices: One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports

Vendor and EU

Vendor: FairSSL A/S, Denmark
Hosting and the EU: EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud)

See the infrastructure

On-premises

Price

Price per year and per month: Not public, requires a sales conversation^1,12

Automation

How the certificate gets there: Both agents/push and ACME^5,6,7,8

Full answer

Universal Orchestrator with extensions delivers certificates to destinations remotely (push via API, SSH or WinRM) or locally as an agent; also a Keyfactor ACME server for ACME clients and a Keyfactor SCEP server
Direct agents and connectors: 42^14,15

Full answer

Universal Orchestrator extensions from Keyfactor's GitHub organisation that place TLS certificates on a destination, including three secrets stores; the catalogue has 45 Universal Orchestrator entries including inventory and identity targets
Without a direct agent: Custom extension for Universal Orchestrator (AnyAgent framework, Orchestrator NuGet package, Integration SDK), developed by the customer or Keyfactor^14,5,16,1

Full answer

ACME/SCEP; PFX enrollment for download or certificate store; REST API

Named systems

FortiGate: Yes^19,20

Full answer

Universal Orchestrator extension via the FortiGate REST API with an API token; also via FortiManager
F5 BIG-IP: Yes^21,22

Full answer

Universal Orchestrator extension via BIG-IP REST; also BIG-IQ and F5 Distributed Cloud WAF
NetScaler: Yes²³

Full answer

Universal Orchestrator extension for Citrix ADC; binding to virtual servers, ODKG
SonicWall: Not stated
Palo Alto: Yes²⁴

Full answer

Universal Orchestrator extension for a firewall or Panorama
Check Point: Not stated
Kemp LoadMaster: Yes²⁵

Full answer

Universal Orchestrator extension for Kemp Load Balancer: inventory, add and remove
Cisco: Yes²⁶

Full answer

Cisco ASA via a Universal Orchestrator extension: identity certificates and Remote Access VPN bindings; Cisco FTD and ISE not stated
IIS: Yes²⁷

Full answer

iis-orchestrator, store type WinIIS: remotely via WinRM or locally as an agent on Windows
Exchange: Not stated
nginx and Apache: Yes^6,7

Full answer

RemoteFile, store type RFPEM via SSH or locally, with an optional restart of Apache HTTPD or NGINX after the job; also ACME clients connecting to Keyfactor ACME
Tomcat (JKS): Yes^6,14

Full answer

RemoteFile, store type RFJKS for Java keystores via SSH/WinRM or locally, with an optional restart of Apache Tomcat after the job
Azure Key Vault: Yes²⁸

Full answer

Universal Orchestrator extension for Azure Key Vault: inventory, add, remove and discovery
AWS Certificate Manager: Yes²⁹

Full answer

Universal Orchestrator extension AWS-ACM-v3 with IAM, AssumeRole or OIDC

Push without an agent

Push with no software on the destination: 42 destinations

Show the list

A10 Networks vThunder (SSL certificates via API; management certificate via SCP)³⁰
Adobe Experience Manager as a Cloud Service (Cloud Manager API)³¹
Akamai Certificate Provisioning System (CPS; key created in Akamai)³²
Radware Alteon Load Balancer (REST API, binding to virtual services)³³
Aruba ClearPass Policy Manager (re-enrollment)³⁴
AWS Certificate Manager (ACM)²⁹
AXIS IP cameras (ODKG on the camera)³⁵
Azure Application Gateway (certificates and HTTPS/TLS listener bindings)³⁶
Azure Key Vault²⁸
Barracuda WAF-as-a-Service³⁷
Bosch IP cameras (re-enrollment)³⁸
Cisco ASA (identity certificates, trustpoints and Remote Access VPN bindings)²⁶
Citrix ADC / NetScaler (binding to virtual servers; ODKG)²³
Dell iDRAC³⁹
F5 BIG-IP (version 14 and later)²¹
F5 BIG-IQ (can deploy onwards to associated BIG-IP)⁴⁰
F5 Distributed Cloud / Multi-Cloud App Connect (WAF)⁴¹
Fortinet FortiGate (API with an API token)¹⁹
Fortinet FortiManager (FortiGate devices managed by FortiManager)²⁰
Fortinet FortiWeb⁴²
Google Cloud Apigee⁴³
Google Cloud Certificate Manager⁴⁴
Google Cloud Load Balancer⁴⁵
HPE iLO (HTTPS certificate via ODKG)⁴⁶
IBM DataPower (REST Management Interface)⁴⁷
Imperva (cloud WAF)⁴⁸
Kubernetes TLS and Opaque secrets⁴⁹
AWS Secrets Manager (Add and Remove from the orchestrator)⁵⁰
Google Cloud Secret Manager (Add and Remove from the orchestrator)⁵¹
HashiCorp Vault Key-Value secrets engine (PEM, JKS, PKCS12 and PFX; Add and Remove)⁵²
Kemp Load Balancer²⁵
Mobotix IP cameras (x7 and x8; the key is created on the orchestrator)⁵³
NetApp ONTAP (cluster and SVM, ONTAP REST API)⁵⁴
Palo Alto Networks firewall²⁴
Palo Alto Networks Panorama²⁴
File-based certificate stores on Linux and Windows servers (RemoteFile: JKS, PEM, PKCS12, DER, IBM KDB, Oracle Wallet) via SSH or WinRM⁶
VMware NSX Advanced Load Balancer (Avi)⁵⁵
VMware vCenter⁵⁶
Windows certificate store, Local Machine (WinCert via WinRM; the default mode loads scripts at session start, optional JEA mode requires Keyfactor modules on the target)²⁷
Microsoft IIS, bound certificates (WinIIS via WinRM; creates and removes IIS bindings)²⁷
Microsoft SQL Server, certificates bound to SQL instances (WinSQL via WinRM; bind and unbind)²⁷
Microsoft AD FS, Service-Communications certificate on primary and secondary nodes (WinADFS via WinRM)²⁷

What the list covers: Found in Keyfactor’s GitHub organisation (60 repos with "orchestrator" in the name) and cross-checked against the integration catalogue (45 Universal Orchestrator entries). Included: extensions that place a TLS certificate on the destination (Add, replacement or ODKG); one row per destination according to the counting unit in _kontrol/FORMAT.md (WinCert, WinIIS, WinSQL and WinADFS separately; Palo Alto firewall and Panorama separately; secrets stores with Add are counted). Excluded: inventory-only (Cloudflare Edge, Fastly, Fortanix, Signum), HashiCorp Vault PKI-store (no Add), HSM (PKCS11), SAML/identity (Okta, Azure App Registration) and older duplicates. The catalogue is public, but lacks three extensions available on GitHub (Adobe AEM, NetApp ONTAP, Mobotix)^5,15

Private keys

Where the private key is kept: On-prem at the customer^1,57,6
The destination^35,32,23

Network

Servers with an agent or ACME: Universal Orchestrator (also as a local agent) initiates the connection to Command’s Orchestrator API itself and retrieves jobs: HTTP/HTTPS TCP 80/443 or configured ports^5,22,58

Full answer

can go via a forward proxy. With hosted/PKIaaS, the connection goes from the customer’s network to Keyfactor’s infrastructure; an inbound internet connection to the orchestrator is not mentioned. ACME clients connect to the Keyfactor ACME server; ports for ACME and challenges are not stated
Equipment without an agent: From Universal Orchestrator in the customer’s network to the destination: WinRM TCP 5985 (HTTP) or 5986 (HTTPS) to Windows targets, SSH (default TCP 22) to Linux targets via RemoteFile, HTTP/HTTPS TCP 80/443 to F5 and NetScaler, IBM DataPower typically port 5554^61,6,22,47,5

Full answer

ports to cloud APIs are not stated. The orchestrator retrieves jobs itself, so Command does not open connections into the orchestrator

Windows and Linux

Windows: iis-orchestrator: Local Machine certificate store, IIS bindings, SQL Server and AD FS remote via WinRM (TCP 5985/5986) from a Windows orchestrator or SSH from a Linux orchestrator, or locally as an agent^27,61

Full answer

RemoteFile handles JKS/PKCS12/PEM files on Windows via WinRM
Linux: RemoteFile from an orchestrator via SSH (default TCP 22) with SCP/SFTP, or locally as an agent directly in the file system^6,7

Full answer

optional restart of Apache HTTPD, NGINX, HAProxy or Envoy after the job. Also ACME clients such as Certbot against Keyfactor ACME

Branch offices

Remote sites and branch offices: Universal Orchestrator is installed in the network with the destinations and retrieves jobs from Command itself, also via a forward proxy^10,5,58

Full answer

multiple orchestrators can be installed, and SSL scanning can be distributed across orchestrator pools. Requirements for sites without a direct connection (e.g. VPN) are not stated

Vendor and EU

Vendor: Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA⁶²

Full answer

press releases from 2026 are datelined Atlanta, GA and Stockholm
Hosting and the EU: The customer’s own data centre or cloud^1,2

Full answer

Command runs on Windows Server/IIS with the customer’s Microsoft SQL Server

Kubernetes

Price

Price per year and per month: Not public, requires a sales conversation^1,12

Automation

How the certificate gets there: Both agents/push and ACME^5,6,7,8

Full answer

Universal Orchestrator with extensions delivers certificates to destinations remotely (push via API, SSH or WinRM) or locally as an agent; also a Keyfactor ACME server for ACME clients and a Keyfactor SCEP server
Direct agents and connectors: 42^14,15

Full answer

Universal Orchestrator extensions from Keyfactor's GitHub organisation that place TLS certificates on a destination, including three secrets stores; the catalogue has 45 Universal Orchestrator entries including inventory and identity targets
Without a direct agent: Custom extension for Universal Orchestrator (AnyAgent framework, Orchestrator NuGet package, Integration SDK), developed by the customer or Keyfactor^14,5,16,1

Full answer

ACME/SCEP; PFX enrollment for download or certificate store; REST API

Named systems

FortiGate: Yes^19,20

Full answer

Universal Orchestrator extension via the FortiGate REST API with an API token; also via FortiManager
F5 BIG-IP: Yes^21,22

Full answer

Universal Orchestrator extension via BIG-IP REST; also BIG-IQ and F5 Distributed Cloud WAF
NetScaler: Yes²³

Full answer

Universal Orchestrator extension for Citrix ADC; binding to virtual servers, ODKG
SonicWall: Not stated
Palo Alto: Yes²⁴

Full answer

Universal Orchestrator extension for a firewall or Panorama
Check Point: Not stated
Kemp LoadMaster: Yes²⁵

Full answer

Universal Orchestrator extension for Kemp Load Balancer: inventory, add and remove
Cisco: Yes²⁶

Full answer

Cisco ASA via a Universal Orchestrator extension: identity certificates and Remote Access VPN bindings; Cisco FTD and ISE not stated
IIS: Yes²⁷

Full answer

iis-orchestrator, store type WinIIS: remotely via WinRM or locally as an agent on Windows
Exchange: Not stated
nginx and Apache: Yes^6,7

Full answer

RemoteFile, store type RFPEM via SSH or locally, with an optional restart of Apache HTTPD or NGINX after the job; also ACME clients connecting to Keyfactor ACME
Tomcat (JKS): Yes^6,14

Full answer

RemoteFile, store type RFJKS for Java keystores via SSH/WinRM or locally, with an optional restart of Apache Tomcat after the job
Azure Key Vault: Yes²⁸

Full answer

Universal Orchestrator extension for Azure Key Vault: inventory, add, remove and discovery
AWS Certificate Manager: Yes²⁹

Full answer

Universal Orchestrator extension AWS-ACM-v3 with IAM, AssumeRole or OIDC

Push without an agent

Push with no software on the destination: 42 destinations

Show the list

A10 Networks vThunder (SSL certificates via API; management certificate via SCP)³⁰
Adobe Experience Manager as a Cloud Service (Cloud Manager API)³¹
Akamai Certificate Provisioning System (CPS; key created in Akamai)³²
Radware Alteon Load Balancer (REST API, binding to virtual services)³³
Aruba ClearPass Policy Manager (re-enrollment)³⁴
AWS Certificate Manager (ACM)²⁹
AXIS IP cameras (ODKG on the camera)³⁵
Azure Application Gateway (certificates and HTTPS/TLS listener bindings)³⁶
Azure Key Vault²⁸
Barracuda WAF-as-a-Service³⁷
Bosch IP cameras (re-enrollment)³⁸
Cisco ASA (identity certificates, trustpoints and Remote Access VPN bindings)²⁶
Citrix ADC / NetScaler (binding to virtual servers; ODKG)²³
Dell iDRAC³⁹
F5 BIG-IP (version 14 and later)²¹
F5 BIG-IQ (can deploy onwards to associated BIG-IP)⁴⁰
F5 Distributed Cloud / Multi-Cloud App Connect (WAF)⁴¹
Fortinet FortiGate (API with an API token)¹⁹
Fortinet FortiManager (FortiGate devices managed by FortiManager)²⁰
Fortinet FortiWeb⁴²
Google Cloud Apigee⁴³
Google Cloud Certificate Manager⁴⁴
Google Cloud Load Balancer⁴⁵
HPE iLO (HTTPS certificate via ODKG)⁴⁶
IBM DataPower (REST Management Interface)⁴⁷
Imperva (cloud WAF)⁴⁸
Kubernetes TLS and Opaque secrets⁴⁹
AWS Secrets Manager (Add and Remove from the orchestrator)⁵⁰
Google Cloud Secret Manager (Add and Remove from the orchestrator)⁵¹
HashiCorp Vault Key-Value secrets engine (PEM, JKS, PKCS12 and PFX; Add and Remove)⁵²
Kemp Load Balancer²⁵
Mobotix IP cameras (x7 and x8; the key is created on the orchestrator)⁵³
NetApp ONTAP (cluster and SVM, ONTAP REST API)⁵⁴
Palo Alto Networks firewall²⁴
Palo Alto Networks Panorama²⁴
File-based certificate stores on Linux and Windows servers (RemoteFile: JKS, PEM, PKCS12, DER, IBM KDB, Oracle Wallet) via SSH or WinRM⁶
VMware NSX Advanced Load Balancer (Avi)⁵⁵
VMware vCenter⁵⁶
Windows certificate store, Local Machine (WinCert via WinRM; the default mode loads scripts at session start, optional JEA mode requires Keyfactor modules on the target)²⁷
Microsoft IIS, bound certificates (WinIIS via WinRM; creates and removes IIS bindings)²⁷
Microsoft SQL Server, certificates bound to SQL instances (WinSQL via WinRM; bind and unbind)²⁷
Microsoft AD FS, Service-Communications certificate on primary and secondary nodes (WinADFS via WinRM)²⁷

What the list covers: Found in Keyfactor’s GitHub organisation (60 repos with "orchestrator" in the name) and cross-checked against the integration catalogue (45 Universal Orchestrator entries). Included: extensions that place a TLS certificate on the destination (Add, replacement or ODKG); one row per destination according to the counting unit in _kontrol/FORMAT.md (WinCert, WinIIS, WinSQL and WinADFS separately; Palo Alto firewall and Panorama separately; secrets stores with Add are counted). Excluded: inventory-only (Cloudflare Edge, Fastly, Fortanix, Signum), HashiCorp Vault PKI-store (no Add), HSM (PKCS11), SAML/identity (Okta, Azure App Registration) and older duplicates. The catalogue is public, but lacks three extensions available on GitHub (Adobe AEM, NetApp ONTAP, Mobotix)^5,15

Private keys

Where the private key is kept: On-prem at the customer^1,57,6
The destination^35,32,23

Network

Servers with an agent or ACME: Universal Orchestrator (also as a local agent) initiates the connection to Command’s Orchestrator API itself and retrieves jobs: HTTP/HTTPS TCP 80/443 or configured ports^5,22,58

Full answer

can go via a forward proxy. With hosted/PKIaaS, the connection goes from the customer’s network to Keyfactor’s infrastructure; an inbound internet connection to the orchestrator is not mentioned. ACME clients connect to the Keyfactor ACME server; ports for ACME and challenges are not stated
Equipment without an agent: From Universal Orchestrator in the customer’s network to the destination: WinRM TCP 5985 (HTTP) or 5986 (HTTPS) to Windows targets, SSH (default TCP 22) to Linux targets via RemoteFile, HTTP/HTTPS TCP 80/443 to F5 and NetScaler, IBM DataPower typically port 5554^61,6,22,47,5

Full answer

ports to cloud APIs are not stated. The orchestrator retrieves jobs itself, so Command does not open connections into the orchestrator

Windows and Linux

Windows: iis-orchestrator: Local Machine certificate store, IIS bindings, SQL Server and AD FS remote via WinRM (TCP 5985/5986) from a Windows orchestrator or SSH from a Linux orchestrator, or locally as an agent^27,61

Full answer

RemoteFile handles JKS/PKCS12/PEM files on Windows via WinRM
Linux: RemoteFile from an orchestrator via SSH (default TCP 22) with SCP/SFTP, or locally as an agent directly in the file system^6,7

Full answer

optional restart of Apache HTTPD, NGINX, HAProxy or Envoy after the job. Also ACME clients such as Certbot against Keyfactor ACME

Branch offices

Remote sites and branch offices: Universal Orchestrator is installed in the network with the destinations and retrieves jobs from Command itself, also via a forward proxy^10,5,58

Full answer

multiple orchestrators can be installed, and SSL scanning can be distributed across orchestrator pools. Requirements for sites without a direct connection (e.g. VPN) are not stated

Vendor and EU

Vendor: Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA⁶²

Full answer

press releases from 2026 are datelined Atlanta, GA and Stockholm
Hosting and the EU: The customer’s own Kubernetes cluster (containers installed with Helm Charts)^1,2

CLAaaS

Price

Price per year and per month: Not public, requires a sales conversation^1,12

Automation

How the certificate gets there: Both agents/push and ACME^5,6,7,8

Full answer

Universal Orchestrator with extensions delivers certificates to destinations remotely (push via API, SSH or WinRM) or locally as an agent; also a Keyfactor ACME server for ACME clients and a Keyfactor SCEP server
Direct agents and connectors: 42^14,15

Full answer

Universal Orchestrator extensions from Keyfactor's GitHub organisation that place TLS certificates on a destination, including three secrets stores; the catalogue has 45 Universal Orchestrator entries including inventory and identity targets
Without a direct agent: Custom extension for Universal Orchestrator (AnyAgent framework, Orchestrator NuGet package, Integration SDK), developed by the customer or Keyfactor^14,5,16,1

Full answer

ACME/SCEP; PFX enrollment for download or certificate store; REST API

Named systems

FortiGate: Yes^19,20

Full answer

Universal Orchestrator extension via the FortiGate REST API with an API token; also via FortiManager
F5 BIG-IP: Yes^21,22

Full answer

Universal Orchestrator extension via BIG-IP REST; also BIG-IQ and F5 Distributed Cloud WAF
NetScaler: Yes²³

Full answer

Universal Orchestrator extension for Citrix ADC; binding to virtual servers, ODKG
SonicWall: Not stated
Palo Alto: Yes²⁴

Full answer

Universal Orchestrator extension for a firewall or Panorama
Check Point: Not stated
Kemp LoadMaster: Yes²⁵

Full answer

Universal Orchestrator extension for Kemp Load Balancer: inventory, add and remove
Cisco: Yes²⁶

Full answer

Cisco ASA via a Universal Orchestrator extension: identity certificates and Remote Access VPN bindings; Cisco FTD and ISE not stated
IIS: Yes²⁷

Full answer

iis-orchestrator, store type WinIIS: remotely via WinRM or locally as an agent on Windows
Exchange: Not stated
nginx and Apache: Yes^6,7

Full answer

RemoteFile, store type RFPEM via SSH or locally, with an optional restart of Apache HTTPD or NGINX after the job; also ACME clients connecting to Keyfactor ACME
Tomcat (JKS): Yes^6,14

Full answer

RemoteFile, store type RFJKS for Java keystores via SSH/WinRM or locally, with an optional restart of Apache Tomcat after the job
Azure Key Vault: Yes²⁸

Full answer

Universal Orchestrator extension for Azure Key Vault: inventory, add, remove and discovery
AWS Certificate Manager: Yes²⁹

Full answer

Universal Orchestrator extension AWS-ACM-v3 with IAM, AssumeRole or OIDC

Push without an agent

Push with no software on the destination: 42 destinations

Show the list

A10 Networks vThunder (SSL certificates via API; management certificate via SCP)³⁰
Adobe Experience Manager as a Cloud Service (Cloud Manager API)³¹
Akamai Certificate Provisioning System (CPS; key created in Akamai)³²
Radware Alteon Load Balancer (REST API, binding to virtual services)³³
Aruba ClearPass Policy Manager (re-enrollment)³⁴
AWS Certificate Manager (ACM)²⁹
AXIS IP cameras (ODKG on the camera)³⁵
Azure Application Gateway (certificates and HTTPS/TLS listener bindings)³⁶
Azure Key Vault²⁸
Barracuda WAF-as-a-Service³⁷
Bosch IP cameras (re-enrollment)³⁸
Cisco ASA (identity certificates, trustpoints and Remote Access VPN bindings)²⁶
Citrix ADC / NetScaler (binding to virtual servers; ODKG)²³
Dell iDRAC³⁹
F5 BIG-IP (version 14 and later)²¹
F5 BIG-IQ (can deploy onwards to associated BIG-IP)⁴⁰
F5 Distributed Cloud / Multi-Cloud App Connect (WAF)⁴¹
Fortinet FortiGate (API with an API token)¹⁹
Fortinet FortiManager (FortiGate devices managed by FortiManager)²⁰
Fortinet FortiWeb⁴²
Google Cloud Apigee⁴³
Google Cloud Certificate Manager⁴⁴
Google Cloud Load Balancer⁴⁵
HPE iLO (HTTPS certificate via ODKG)⁴⁶
IBM DataPower (REST Management Interface)⁴⁷
Imperva (cloud WAF)⁴⁸
Kubernetes TLS and Opaque secrets⁴⁹
AWS Secrets Manager (Add and Remove from the orchestrator)⁵⁰
Google Cloud Secret Manager (Add and Remove from the orchestrator)⁵¹
HashiCorp Vault Key-Value secrets engine (PEM, JKS, PKCS12 and PFX; Add and Remove)⁵²
Kemp Load Balancer²⁵
Mobotix IP cameras (x7 and x8; the key is created on the orchestrator)⁵³
NetApp ONTAP (cluster and SVM, ONTAP REST API)⁵⁴
Palo Alto Networks firewall²⁴
Palo Alto Networks Panorama²⁴
File-based certificate stores on Linux and Windows servers (RemoteFile: JKS, PEM, PKCS12, DER, IBM KDB, Oracle Wallet) via SSH or WinRM⁶
VMware NSX Advanced Load Balancer (Avi)⁵⁵
VMware vCenter⁵⁶
Windows certificate store, Local Machine (WinCert via WinRM; the default mode loads scripts at session start, optional JEA mode requires Keyfactor modules on the target)²⁷
Microsoft IIS, bound certificates (WinIIS via WinRM; creates and removes IIS bindings)²⁷
Microsoft SQL Server, certificates bound to SQL instances (WinSQL via WinRM; bind and unbind)²⁷
Microsoft AD FS, Service-Communications certificate on primary and secondary nodes (WinADFS via WinRM)²⁷

What the list covers: Found in Keyfactor’s GitHub organisation (60 repos with "orchestrator" in the name) and cross-checked against the integration catalogue (45 Universal Orchestrator entries). Included: extensions that place a TLS certificate on the destination (Add, replacement or ODKG); one row per destination according to the counting unit in _kontrol/FORMAT.md (WinCert, WinIIS, WinSQL and WinADFS separately; Palo Alto firewall and Panorama separately; secrets stores with Add are counted). Excluded: inventory-only (Cloudflare Edge, Fastly, Fortanix, Signum), HashiCorp Vault PKI-store (no Add), HSM (PKCS11), SAML/identity (Okta, Azure App Registration) and older duplicates. The catalogue is public, but lacks three extensions available on GitHub (Adobe AEM, NetApp ONTAP, Mobotix)^5,15

Private keys

Where the private key is kept: The vendor's cloud^1,16
On-prem at the customer^6,53
The destination^35,32,23

Network

Servers with an agent or ACME: Universal Orchestrator (also as a local agent) initiates the connection to Command’s Orchestrator API itself and retrieves jobs: HTTP/HTTPS TCP 80/443 or configured ports^5,22,58

Full answer

can go via a forward proxy. With hosted/PKIaaS, the connection goes from the customer’s network to Keyfactor’s infrastructure; an inbound internet connection to the orchestrator is not mentioned. ACME clients connect to the Keyfactor ACME server; ports for ACME and challenges are not stated
Equipment without an agent: From Universal Orchestrator in the customer’s network to the destination: WinRM TCP 5985 (HTTP) or 5986 (HTTPS) to Windows targets, SSH (default TCP 22) to Linux targets via RemoteFile, HTTP/HTTPS TCP 80/443 to F5 and NetScaler, IBM DataPower typically port 5554^61,6,22,47,5

Full answer

ports to cloud APIs are not stated. The orchestrator retrieves jobs itself, so Command does not open connections into the orchestrator

Windows and Linux

Windows: iis-orchestrator: Local Machine certificate store, IIS bindings, SQL Server and AD FS remote via WinRM (TCP 5985/5986) from a Windows orchestrator or SSH from a Linux orchestrator, or locally as an agent^27,61

Full answer

RemoteFile handles JKS/PKCS12/PEM files on Windows via WinRM
Linux: RemoteFile from an orchestrator via SSH (default TCP 22) with SCP/SFTP, or locally as an agent directly in the file system^6,7

Full answer

optional restart of Apache HTTPD, NGINX, HAProxy or Envoy after the job. Also ACME clients such as Certbot against Keyfactor ACME

Branch offices

Remote sites and branch offices: Universal Orchestrator is installed in the network with the destinations and retrieves jobs from Command itself, also via a forward proxy^10,5,58

Full answer

multiple orchestrators can be installed, and SSL scanning can be distributed across orchestrator pools. Requirements for sites without a direct connection (e.g. VPN) are not stated

Vendor and EU

Vendor: Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA⁶²

Full answer

press releases from 2026 are datelined Atlanta, GA and Stockholm
Hosting and the EU: Hosted by Keyfactor^1,3

Full answer

Keyfactor's subprocessor list (22-02-2023) mentions Microsoft Corporation as the hosting provider. The data centre country and EU region are not stated

PKIaaS

Price

Price per year and per month: Not public, requires a sales conversation^4,13

Automation

How the certificate gets there: Both agents/push and ACME^5,6,7,8

Full answer

Universal Orchestrator with extensions delivers certificates to destinations remotely (push via API, SSH or WinRM) or locally as an agent; also a Keyfactor ACME server for ACME clients and a Keyfactor SCEP server
Direct agents and connectors: 42^14,15

Full answer

Universal Orchestrator extensions from Keyfactor's GitHub organisation that place TLS certificates on a destination, including three secrets stores; the catalogue has 45 Universal Orchestrator entries including inventory and identity targets
Without a direct agent: Custom extension for Universal Orchestrator (AnyAgent framework, Orchestrator NuGet package, Integration SDK), developed by the customer or Keyfactor^14,5,16,1

Full answer

ACME/SCEP; PFX enrollment for download or certificate store; REST API

Named systems

FortiGate: Yes^19,20

Full answer

Universal Orchestrator extension via the FortiGate REST API with an API token; also via FortiManager
F5 BIG-IP: Yes^21,22

Full answer

Universal Orchestrator extension via BIG-IP REST; also BIG-IQ and F5 Distributed Cloud WAF
NetScaler: Yes²³

Full answer

Universal Orchestrator extension for Citrix ADC; binding to virtual servers, ODKG
SonicWall: Not stated
Palo Alto: Yes²⁴

Full answer

Universal Orchestrator extension for a firewall or Panorama
Check Point: Not stated
Kemp LoadMaster: Yes²⁵

Full answer

Universal Orchestrator extension for Kemp Load Balancer: inventory, add and remove
Cisco: Yes²⁶

Full answer

Cisco ASA via a Universal Orchestrator extension: identity certificates and Remote Access VPN bindings; Cisco FTD and ISE not stated
IIS: Yes²⁷

Full answer

iis-orchestrator, store type WinIIS: remotely via WinRM or locally as an agent on Windows
Exchange: Not stated
nginx and Apache: Yes^6,7

Full answer

RemoteFile, store type RFPEM via SSH or locally, with an optional restart of Apache HTTPD or NGINX after the job; also ACME clients connecting to Keyfactor ACME
Tomcat (JKS): Yes^6,14

Full answer

RemoteFile, store type RFJKS for Java keystores via SSH/WinRM or locally, with an optional restart of Apache Tomcat after the job
Azure Key Vault: Yes²⁸

Full answer

Universal Orchestrator extension for Azure Key Vault: inventory, add, remove and discovery
AWS Certificate Manager: Yes²⁹

Full answer

Universal Orchestrator extension AWS-ACM-v3 with IAM, AssumeRole or OIDC

Push without an agent

Push with no software on the destination: 42 destinations

Show the list

A10 Networks vThunder (SSL certificates via API; management certificate via SCP)³⁰
Adobe Experience Manager as a Cloud Service (Cloud Manager API)³¹
Akamai Certificate Provisioning System (CPS; key created in Akamai)³²
Radware Alteon Load Balancer (REST API, binding to virtual services)³³
Aruba ClearPass Policy Manager (re-enrollment)³⁴
AWS Certificate Manager (ACM)²⁹
AXIS IP cameras (ODKG on the camera)³⁵
Azure Application Gateway (certificates and HTTPS/TLS listener bindings)³⁶
Azure Key Vault²⁸
Barracuda WAF-as-a-Service³⁷
Bosch IP cameras (re-enrollment)³⁸
Cisco ASA (identity certificates, trustpoints and Remote Access VPN bindings)²⁶
Citrix ADC / NetScaler (binding to virtual servers; ODKG)²³
Dell iDRAC³⁹
F5 BIG-IP (version 14 and later)²¹
F5 BIG-IQ (can deploy onwards to associated BIG-IP)⁴⁰
F5 Distributed Cloud / Multi-Cloud App Connect (WAF)⁴¹
Fortinet FortiGate (API with an API token)¹⁹
Fortinet FortiManager (FortiGate devices managed by FortiManager)²⁰
Fortinet FortiWeb⁴²
Google Cloud Apigee⁴³
Google Cloud Certificate Manager⁴⁴
Google Cloud Load Balancer⁴⁵
HPE iLO (HTTPS certificate via ODKG)⁴⁶
IBM DataPower (REST Management Interface)⁴⁷
Imperva (cloud WAF)⁴⁸
Kubernetes TLS and Opaque secrets⁴⁹
AWS Secrets Manager (Add and Remove from the orchestrator)⁵⁰
Google Cloud Secret Manager (Add and Remove from the orchestrator)⁵¹
HashiCorp Vault Key-Value secrets engine (PEM, JKS, PKCS12 and PFX; Add and Remove)⁵²
Kemp Load Balancer²⁵
Mobotix IP cameras (x7 and x8; the key is created on the orchestrator)⁵³
NetApp ONTAP (cluster and SVM, ONTAP REST API)⁵⁴
Palo Alto Networks firewall²⁴
Palo Alto Networks Panorama²⁴
File-based certificate stores on Linux and Windows servers (RemoteFile: JKS, PEM, PKCS12, DER, IBM KDB, Oracle Wallet) via SSH or WinRM⁶
VMware NSX Advanced Load Balancer (Avi)⁵⁵
VMware vCenter⁵⁶
Windows certificate store, Local Machine (WinCert via WinRM; the default mode loads scripts at session start, optional JEA mode requires Keyfactor modules on the target)²⁷
Microsoft IIS, bound certificates (WinIIS via WinRM; creates and removes IIS bindings)²⁷
Microsoft SQL Server, certificates bound to SQL instances (WinSQL via WinRM; bind and unbind)²⁷
Microsoft AD FS, Service-Communications certificate on primary and secondary nodes (WinADFS via WinRM)²⁷

What the list covers: Found in Keyfactor’s GitHub organisation (60 repos with "orchestrator" in the name) and cross-checked against the integration catalogue (45 Universal Orchestrator entries). Included: extensions that place a TLS certificate on the destination (Add, replacement or ODKG); one row per destination according to the counting unit in _kontrol/FORMAT.md (WinCert, WinIIS, WinSQL and WinADFS separately; Palo Alto firewall and Panorama separately; secrets stores with Add are counted). Excluded: inventory-only (Cloudflare Edge, Fastly, Fortanix, Signum), HashiCorp Vault PKI-store (no Add), HSM (PKCS11), SAML/identity (Okta, Azure App Registration) and older duplicates. The catalogue is public, but lacks three extensions available on GitHub (Adobe AEM, NetApp ONTAP, Mobotix)^5,15

Private keys

Where the private key is kept: The vendor's cloud^1,16
On-prem at the customer^6,53
The destination^35,32,23

Network

Servers with an agent or ACME: Universal Orchestrator (also as a local agent) initiates the connection to Command’s Orchestrator API itself and retrieves jobs: HTTP/HTTPS TCP 80/443 or configured ports^5,22,58

Full answer

can go via a forward proxy. With hosted/PKIaaS, the connection goes from the customer’s network to Keyfactor’s infrastructure; an inbound internet connection to the orchestrator is not mentioned. ACME clients connect to the Keyfactor ACME server; ports for ACME and challenges are not stated
Equipment without an agent: From Universal Orchestrator in the customer’s network to the destination: WinRM TCP 5985 (HTTP) or 5986 (HTTPS) to Windows targets, SSH (default TCP 22) to Linux targets via RemoteFile, HTTP/HTTPS TCP 80/443 to F5 and NetScaler, IBM DataPower typically port 5554^61,6,22,47,5

Full answer

ports to cloud APIs are not stated. The orchestrator retrieves jobs itself, so Command does not open connections into the orchestrator

Windows and Linux

Windows: iis-orchestrator: Local Machine certificate store, IIS bindings, SQL Server and AD FS remote via WinRM (TCP 5985/5986) from a Windows orchestrator or SSH from a Linux orchestrator, or locally as an agent^27,61

Full answer

RemoteFile handles JKS/PKCS12/PEM files on Windows via WinRM
Linux: RemoteFile from an orchestrator via SSH (default TCP 22) with SCP/SFTP, or locally as an agent directly in the file system^6,7

Full answer

optional restart of Apache HTTPD, NGINX, HAProxy or Envoy after the job. Also ACME clients such as Certbot against Keyfactor ACME

Branch offices

Remote sites and branch offices: Universal Orchestrator is installed in the network with the destinations and retrieves jobs from Command itself, also via a forward proxy^10,5,58

Full answer

multiple orchestrators can be installed, and SSL scanning can be distributed across orchestrator pools. Requirements for sites without a direct connection (e.g. VPN) are not stated

Vendor and EU

Vendor: Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA⁶²

Full answer

press releases from 2026 are datelined Atlanta, GA and Stockholm
Hosting and the EU: Keyfactor-operated, dedicated single-tenant cloud environment^4,3

Full answer

Keyfactor's subprocessor list (22-02-2023) mentions Microsoft Corporation as the hosting provider. The data centre country and EU region are not stated

SaaS Lite

Price

Price per year and per month

$56,000 per year¹¹

$4,666.67 per month (calculated)

Unit:: Entry Level plan with 2500 actioned certificates
Minimum:: 1-year subscription (1, 2 or 3 years)

Automation

How the certificate gets there: ACME/SCEP only^9,10

Full answer

The Command SaaS portal deploys Keyfactor ACME instances for the customer's ACME clients; Universal Orchestrator is described in the Command SaaS documentation for discovery, MSCA inventory and log collection ("such as"); whether orchestrator extensions can install at destinations with Command SaaS is not stated
Direct agents and connectors: Not stated
Without a direct agent: ACME client with an EAB key connecting to Command ACME, or enrolment from the public CA in the portal (the subsequent installation method is not stated)^17,18

Named systems

FortiGate: Not stated
F5 BIG-IP: Not stated
NetScaler: Not stated
SonicWall: Not stated
Palo Alto: Not stated
Check Point: Not stated
Kemp LoadMaster: Not stated
Cisco: Not stated
IIS: Not stated
Exchange: Not stated
nginx and Apache: Not stated
Tomcat (JKS): Not stated
Azure Key Vault: Not stated
AWS Certificate Manager: Not stated

Push without an agent

Push with no software on the destination: Not stated

Private keys

Where the private key is kept: The destination^9,17

Network

Servers with an agent or ACME: Universal Orchestrator and users must have their public IP allowlisted in the SaaS portal to reach Command SaaS^59,60,9

Full answer

the orchestrator connects outbound to Command SaaS. ACME clients connect to a Keyfactor ACME instance deployed from the portal; ports are not stated
Equipment without an agent: Not stated

Windows and Linux

Windows: Not stated
Linux: Not stated

Branch offices

Remote sites and branch offices: Universal Orchestrator is installed on the customer's network and must have its public IP allowlisted in the SaaS portal^10,60

Full answer

requirements for sites without a direct connection are not stated

Vendor and EU

Vendor: Keyfactor, Inc., 6150 Oak Tree Boulevard, Independence, Ohio, USA⁶²

Full answer

press releases from 2026 are datelined Atlanta, GA and Stockholm
Hosting and the EU: Hosted by Keyfactor^1,3

Full answer

Keyfactor's subprocessor list (22-02-2023) mentions Microsoft Corporation as the hosting provider. The data centre country and EU region are not stated

When Keyfactor Command fits better

You want to run the platform in your own Kubernetes cluster or on Windows Server with your own Microsoft SQL Server.^1,2
You want a PKI that the vendor runs in a dedicated single-tenant cloud environment (PKIaaS).^4,3
You want to build your own Universal Orchestrator extensions with Keyfactor's framework and SDK (self-hosted, Kubernetes, CLAaaS or PKIaaS).^14,5,16,1

Sources

1. Keyfactor Command (keyfactor.com), checked 11-10-2026
2. Physical Architecture (software.keyfactor.com), checked 11-10-2026
3. Annex III to Standard Contractual Clauses: List of Sub Processors (keyfactor.com), checked 11-10-2026
4. Keyfactor PKI as a Service (keyfactor.com), checked 11-10-2026
5. Orchestrators (software.keyfactor.com), checked 11-10-2026
6. remote-file-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
7. Keyfactor ACME: Introduction (software.keyfactor.com), checked 11-10-2026
8. Keyfactor SCEP: Introduction (software.keyfactor.com), checked 11-10-2026
9. ACME Enrollment (docs.keyfactor.com), checked 11-10-2026
10. Universal Orchestrator (docs.keyfactor.com), checked 11-10-2026
11. Command SaaS: Certificate Lifecycle Automation (azuremarketplace.microsoft.com), checked 11-10-2026
12. Keyfactor Command (azuremarketplace.microsoft.com), checked 11-10-2026
13. Keyfactor Command: PKI as-a-Service (azuremarketplace.microsoft.com), checked 11-10-2026
14. Keyfactor Universal Orchestrator (software.keyfactor.com), checked 11-10-2026
15. Integrations Catalog: Universal Orchestrator (keyfactor.github.io), checked 11-10-2026
16. Enrollment (software.keyfactor.com), checked 11-10-2026
17. Configuring Claims & Fetching EAB Keys in Command SaaS (docs.keyfactor.com), checked 11-10-2026
18. Command SaaS: Certificate Lifecycle Automation (azuremarketplace.microsoft.com), checked 11-10-2026
19. fortigate-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
20. fortimanager-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
21. f5-rest-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
22. Firewall Considerations (software.keyfactor.com), checked 11-10-2026
23. citrix-adc-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
24. paloalto-firewall-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
25. kemp-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
26. cisco-asa-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
27. iis-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
28. azurekeyvault-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
29. aws-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
30. a10vthunder-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
31. adobe-experience-manager-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
32. akamai-cps-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
33. alteon-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
34. aruba-clearpass-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
35. axis-ipcamera-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
36. azure-appgateway-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
37. barracuda-wafasaas-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
38. bosch-ipcamera-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
39. dell-idrac-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
40. f5-bigiq-rest-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
41. f5-waf-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
42. fortinet-fortiweb-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
43. gcp-apigee-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
44. gcp-certmanager-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
45. gcp-loadbalancer-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
46. hp-ilo-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
47. ibm-datapower-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
48. imperva-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
49. k8s-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
50. aws-secretsmanager-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
51. gcp-secretmanager-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
52. hashicorp-vault-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
53. mobotix-ipcamera-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
54. netapp-ontap-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
55. vmware-nsx-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
56. vmware-vcenter-orchestrator README (raw.githubusercontent.com), checked 11-10-2026
57. Enrollment (software.keyfactor.com), checked 10-10-2026
58. Set up the Universal Orchestrator to Use a Forwarding Proxy (software.keyfactor.com), checked 11-10-2026
59. Introduction and architecture (docs.keyfactor.com), checked 11-10-2026
60. Installation and Configuration (docs.keyfactor.com), checked 11-10-2026
61. Configure Windows Targets for Remote Management (software.keyfactor.com), checked 11-10-2026
62. Privacy Policy (keyfactor.com), checked 11-10-2026

If you see an error about another vendor, write to us. We correct it and update the check date. Write to us

Try sslbrain

Start free. No credit card required.

Download sslbrain See the prices