Tessera vs Teleport
Teleport is a certificate-authority-based access platform for SSH, Kubernetes, databases, Windows and web apps, with a self-hostable Community edition and a hosted Cloud offering.
The honest difference is deployment shape. Teleport issues short-lived certificates and wants agents in the path: teleport-kube-agent runs inside the target cluster, and the agentless SSH mode copies its binary onto the host and rewrites sshd_config to trust its CA. Tessera is a proxy — the controller holds the credential and injects it on the wire, and your hosts and clusters stay exactly as they are.
Side by side
| Tessera | Teleport | |
|---|---|---|
| Kill write access mid-session — no reconnect flip a live session RW → RO in one tap — on SSH, Kubernetes and SQL alike | yes | no |
| Nothing installed — and nothing reconfigured — on your targets your servers, clusters and databases stay exactly as they are | yes | no |
| Fully self-hosted control plane no vendor cloud anywhere in the access path | yes | yes |
| One read-only switch across SSH · Kubernetes · SQL same policy, every protocol — not a per-protocol reimplementation | yes | partial |
| Credentials injected on the controller — never on the user's machine SSH · Kubernetes · SQL | yes | yes |
| Session recording + live watch & force-close | yes | yes |
| Just-in-time access · RBAC · SSO · SCIM | yes | yes |
| Audit export to your SIEM | yes | yes |
Every cell checked against Teleport's own documentation, 14 August 2026. Products change; if you find something out of date here, tell us and we will correct it.
Where Teleport is stronger
- RDP. Teleport injects the credential for Windows desktops; Tessera hands it to the local desktop app, because NLA needs it before the session exists. On this protocol they are ahead of us and our own documentation says so.
- Breadth. Web applications, cloud consoles and Windows are first-class targets for Teleport; Tessera brokers SSH, Kubernetes, databases and RDP and nothing else.
- Open source and no licence. Their Community edition needs no entitlement at all, which makes an air-gapped install simpler for them than for us — ours needs an offline licence file, even though it is verified locally with no phone-home.
- Certificate model. Short-lived certificates are a genuinely different security posture from a broker holding long-lived credentials, and for some threat models it is the better one.
Choose Teleport if…
You want short-lived certificates rather than a credential broker, you need web apps or cloud consoles in the same tool, or RDP credential injection is a requirement.
Choose Tessera if…
You cannot put agents in your clusters or rewrite sshd_config on production hosts, you want one read-only switch that behaves the same on SSH, Kubernetes and SQL, or you need to take write access away from a session that is already open.
Comparing something else? Tessera vs StrongDM · Tessera vs Boundary