Which certificate storage backend should I use — local filesystem, Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, or Infisical?

[fabriziosalmi]

CertMate offers five storage backends. The default is the local filesystem. The other four put certificates into a managed secret store. When is each the right choice, and what are the tradeoffs I should care about before committing?

[fabriziosalmi]

Five backends, three decision axes: operational simplicity, multi-host accessibility, and integration with downstream consumers. The defaults are deliberate: most CertMate deployments are happy on local filesystem. Switch only when one of the axes pulls you off it.

Local Filesystem (default). Certificates live under data/certs/<domain>/ (Q8). Zero new dependencies. The container is the source of truth. The same volume mount that protects your settings (Q2) protects your certs.

• Pick when: single-host deployments, single-consumer (CertMate is also the cert distributor via deploy hooks), or when you want the simplest possible recovery story ("restore the data directory and you are back").
• Skip when: you need other hosts to fetch certs in real time without going through CertMate's API, you have a hard compliance requirement to keep secrets in a managed KMS-backed store, or you are running CertMate stateless and want all state external.

Azure Key Vault. Certs go into a configured Key Vault. Two modes: secret mode (the PEM is stored as a Key Vault Secret) and certificate-object mode (added in PR #118 — the cert is stored as a managed Key Vault Certificate, which is what AKS Key Vault Reference and several Azure-native consumers expect).

• Pick when: you are on Azure, your downstream consumers are AKS pods / App Service / Application Gateway that already authenticate to a Key Vault via Managed Identity, you want Azure to handle KMS-encryption-at-rest and audit logging.
• Cost note: Key Vault is metered per operation. CertMate's renewal traffic is low (single-digit ops per cert per year) so the bill is rounding error, but the cost line exists.

AWS Secrets Manager. PEM bundles stored as SecretString JSON. CertMate uses one secret per domain.

• Pick when: you are on AWS, your downstream consumers are EKS pods / Lambda / ECS tasks authenticating via IAM Roles for Service Accounts, you want Secrets Manager's KMS encryption-at-rest and built-in audit trail.
• Watch out for: Secrets Manager bills per-secret per month plus per API call. For 5 certs and weekly renewals it is cents; for 500 certs it is single-digit dollars.

HashiCorp Vault. KV-v2 secret engine, one secret per domain under your chosen path. Token-based auth out of the box, AppRole if you give CertMate a static role.

• Pick when: you already run Vault, your existing automation reads certs from Vault paths, you want Vault's leasing / token rotation story.
• Watch out for: sealed-Vault windows. CertMate fails fast if Vault is sealed during a renewal. Pair the deployment with a Vault unseal monitor.

Infisical. Secret-management SaaS. Similar story to Vault but managed.

• Pick when: you already use Infisical for application secrets and want a single place for both API keys and TLS material.
• Watch out for: vendor lock-in to a third-party SaaS; export your secrets on a schedule.

Switching between backends. Backends are configured in Settings → Storage Backend. Switching is not a migration — CertMate will start writing new certs to the new backend, but existing certs already on the old backend stay where they are. Issue and consume happen on the new backend; renewals of certs created under the old backend may need to be re-issued explicitly. For a one-time migration, the safest path is: list certs, force-renew each one under the new backend, verify, then clean up the old backend.

Fallback. If a configured cloud backend is unreachable at startup (network, credentials), CertMate logs the error and falls back to local filesystem rather than refusing to start (modules/core/storage_backends.py:986). This is intentional: the renewal job is more valuable than the storage choice, and you can see in the logs that you are running in fallback mode.