API / Venafi Interview questions
What is the difference between Certificate Manager SaaS and Self-Hosted regarding CA private key custody?
Private key custody — specifically, whose infrastructure ever holds a CA's private signing key — is one of the sharpest architectural differences between the two editions, and it matters most for organizations running their own internal CA rather than only using public CAs.
| SaaS | Self-Hosted (TPP) |
| Typically integrates with external public/private CAs; doesn't host an internal CA's root key itself | Can integrate with, or sit adjacent to, an on-prem CA whose private key stays entirely within the customer's own infrastructure/HSM |
| Certificate metadata and requests flow through CyberArk's multi-tenant service | Certificate metadata can stay entirely within the customer's network if desired |
| Simpler for organizations relying purely on public CAs | Preferred where regulatory or contractual terms require the CA private key to never leave customer-controlled infrastructure |
Neither model is "more secure" in the abstract — a well-run SaaS deployment using reputable public CAs can be entirely appropriate, while a poorly operated Self-Hosted CA with weak HSM practices could be worse. The real driver is whether a specific regulatory, contractual, or risk-tolerance requirement mandates that private key material physically never leave the customer's own environment.
Which factor most directly pushes an organization toward Self-Hosted for CA private key custody reasons?
Is one deployment model universally "more secure" than the other?
More Related questions...
