EZCA
EZCA is a cloud PKI service for operating certificate authorities without managing the PKI infrastructure yourself.
What EZCA is
EZCA is a cloud PKI service for operating certificate authorities without managing the PKI infrastructure yourself. It issues certificates through ACME, EST, and SCEP, and offers APIs for applications and workflows. Certificate use cases include users, devices, applications, Wi-Fi, VPN, web services, and IoT, including device authentication for Azure IoT Hub and Azure IoT Central. Integrations include Azure, Entra ID, Intune, Azure Key Vault, and Azure applications; Intune and Jamf are supported for device certificates. EZCA can connect to an existing on-premises CA or bring an AD CS CA into a cloud setup. The maker says its CAs use HSMs: Basic uses FIPS 140-3 Level 2 and Premium Level 3. CA changes, requests, and approvals are logged for export to a preferred SIEM, and revocation checking uses CRLs and OCSP. There is no free plan, but a 30-day trial is listed.
Good
- Issues certificates through ACME, EST, and SCEP
- Integrates with Azure, Entra ID, and Intune
- Supports CRL and OCSP revocation checking
- No certificate count limit is listed
Watch out
- No free plan is available
- Basic is $200 / CA / month
- Pricing is based on managed certificate authorities
Who it suits
EZCA suits organizations managing certificates for users, devices, applications, or IoT, especially those using the listed Azure and MDM integrations. It may also fit teams connecting an existing CA to a cloud setup.
Verdict
EZCA centralizes certificate authority operations and supports several certificate protocols and use cases. Its paid tiers vary by CA capacity, support, availability, and deployment model.
Plans and prices
From EZCA's own pricing page, checked 29 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Basic | $200 a month | FIPS 140-3 Level 2 HSM backed CAs · 1 certificate created or OCSP response per CA per second · Support within one business day · 99.9% availability · $200 / CA / month |
| Premium | $500 a month | FIPS 140-3 Level 3 HSM backed CAs · 10 certificates created or OCSP responses per CA per second · 24/7 support within 24 hours · 99.95% availability · Public CA certificate management · $500 / CA / month |
| Self-Hosted Licensing | $3,000 a month | Everything in Private Infrastructure · Self-healing infrastructure with Azure PaaS services · $3,000 (with unlimited CAs) / location / month |
| Private Infrastructure | $6,000 a month | Everything in Premium · 160 certificates created or OCSP responses per CA per second · 24/7 support within 1 hour · Fully isolated infrastructure · $6,000 / location / month |
The facts
Each one read from EZCA's own pages, with the date it was checked.
What it does
- Audit and SIEM
- CA changes, certificate requests, and approvals are logged and can be exported to a preferred SIEM.checked 29 Sep 2026
- Availability
- The pricing page lists 99.9% availability for Basic and 99.95% for Premium.checked 29 Sep 2026
- Certificate limits
- The maker says there is no certificate count limit; pricing is based on the number of certificate authorities managed.checked 29 Sep 2026
- Certificate use cases
- The platform manages certificates for users, devices, applications, Wi-Fi, VPN, web services, and IoT.checked 29 Sep 2026
- Existing PKI
- EZCA can chain to an existing on-premises CA or bring an existing AD CS CA into the cloud setup.checked 29 Sep 2026
- IoT
- EZCA supports certificate-based device authentication for Azure IoT Hub and Azure IoT Central.checked 29 Sep 2026
- MDM integrations
- The product supports Intune and Jamf for device certificates.checked 29 Sep 2026
- Microsoft integration
- EZCA integrates with Azure, Entra ID, Intune, Azure Key Vault, and Azure applications.checked 29 Sep 2026
- Protocols
- It issues certificates through ACME, EST, and SCEP, and provides APIs for applications and workflows.checked 29 Sep 2026
- Revocation
- EZCA supports certificate revocation checking through CRLs and OCSP.checked 29 Sep 2026
- Security
- The maker says EZCA uses HSM-backed CAs, with Basic backed by FIPS 140-3 Level 2 HSMs and Premium by Level 3 HSMs.checked 29 Sep 2026
- Support
- Basic includes support within one business day, Premium includes 24/7 support within 24 hours, and Private Infrastructure includes 24/7 support within one hour.checked 29 Sep 2026
- What it does
- EZCA is a cloud PKI service for running and scaling certificate authorities without operating the PKI infrastructure yourself.checked 29 Sep 2026
The company
- Company
- Keytos says it was founded by Marcos and Igal Flegmann, brothers with experience building PKI and identity tools at Microsoft.checked 29 Sep 2026
- Founded
- 2021checked 28 Sep 2026
- Headquarters
- Boston, Massachusetts, United Stateschecked 28 Sep 2026
Alternatives to EZCA
- 1
EJBCA
Free planOpen sourceWebAPILinuxmacOS8.2From £62,065 a year - 2
KeyTalk CKMS
AndroidiOSWebAPI7.7From €5 a month - 3
Let's Encrypt
Free planOpen sourceWebAPILinuxmacOS7.6Free plan - 4
OpenCA PKI
Free planOpen sourceWebLinuxmacOSSelf-hosted7.4Free plan - 5
step-ca
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan - 6
Google Cloud Secret Manager
Free planWeb6.5From $0.02 a month