KeyTalk CKMS
KeyTalk CKMS automates PKI implementation and the enrollment, distribution, and management of digital certificates.
What KeyTalk CKMS is
KeyTalk CKMS automates PKI implementation and the enrollment, distribution, and management of digital certificates. It keeps certificates and keys in a central repository and supports automated or semi-automated deployment and renewal, with reporting, notifications, and alerts. Smart Security Scan discovers certificates and keys on a network so valid results can be imported. CKMS includes a private certificate authority that can run beneath an existing root CA or as a standalone root. Listed integrations and protocols include DigiCert, GlobalSign, Microsoft CA, Intune, SCEP, and ACME. Access controls include AD and Entra ID authorization, multifactor authentication, and role-based controls using security groups. Deployment options include a virtual machine on customer infrastructure, private cloud environments such as AWS, Azure, and Google Cloud, or KeyTalk-managed PKI as a service. Pricing is on request and a free trial is available. Separate S/MIME plans cost €5 a month for on-premise service and €6.50 a month for hosted SaaS, billed per user per month.
Good
- Central repository for certificates and keys.
- Supports automated or semi-automated renewal.
- Includes a private certificate authority.
- Offers customer-infrastructure, private-cloud, and managed deployment.
Watch out
- CKMS pricing is available on request.
- S/MIME plans are billed per user per month.
- Certificate lifespan as short as one second depends on CA support.
Who it suits
It suits businesses and managed service providers that need to manage certificates across their own infrastructure or customer environments. The S/MIME options may suit organizations seeking either on-premise or hosted service.
Verdict
KeyTalk CKMS centralizes certificate lifecycle work and supports multiple deployment models and integrations. CKMS pricing is on request, while listed S/MIME services have per-user monthly prices.
Plans and prices
From KeyTalk CKMS's own pricing page, checked 30 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| S/MIME on-premise | €5 a month | Up to 250 participants · multiple devices · per user per month; just over € 5; up to 250 participants; multiple devices; staggered discount for larger organisations |
| S/MIME hosted SaaS | €6.50 a month | Up to 250 participants · per user per month; just over €6.50; up to 250 participants; staggered discount for larger organisations |
| CKMS 10,000–24,999 seats | — | 10,000–24,999 licences · per year; VAT excluded |
| CKMS 1,000–2,499 seats | — | 1,000–2,499 licences · per year; VAT excluded |
| CKMS 25,000–49,999 seats | — | 25,000–49,999 licences · per year; VAT excluded |
| CKMS 2,500–9,999 seats | — | 2,500–9,999 licences · per year; VAT excluded |
| CKMS 0–49 seats | — | 0–49 licences · base plus seat licences · per year; VAT excluded |
| CKMS 50,000–74,999 seats | — | 50,000–74,999 licences · per year; VAT excluded |
| CKMS 50–249 seats | — | 50–249 licences · per year; VAT excluded |
| CKMS 75,000–99,999 seats | — | 75,000–99,999 licences · per year; VAT excluded |
| CKMS 250–999 seats | — | 250–999 licences · per year; VAT excluded |
| CKMS 100,000+ seats | Priced on request | 100,000+ licences · on request |
The facts
Each one read from KeyTalk CKMS's own pages, with the date it was checked.
What it does
- Access controls
- The platform supports AD and Entra ID authorization, multifactor authentication, and role-based access control using security groups.checked 30 Sep 2026
- API
- The product exposes client and administrator REST APIs using JSON over TLS and publishes an OpenAPI specification.checked 15 Oct 2026
- Automated deployment
- Certificates can be deployed and renewed automatically or through notification and authorization workflows on servers, network devices and user devices.checked 15 Oct 2026
- Certificate authorities
- The system supports multiple public and private CAs, including Microsoft AD CS, GlobalSign and DigiCert QuoVadis.checked 15 Oct 2026
- Certificate discovery
- Smart Security Scan discovers certificates and keys on networks so valid findings can be imported into CKMS.checked 15 Oct 2026
- Certificate lifecycle
- CKMS provides a central repository for certificates and keys, automated or semi-automated deployment and renewal, and reporting, notifications, and alerts.checked 30 Sep 2026
- Deployment
- CKMS is delivered as a virtual machine for customer infrastructure, private cloud environments including AWS, Azure, and Google Cloud, or KeyTalk-managed PKI as a service.checked 30 Sep 2026
- Deployment models
- The CKMS server is offered as an on-premises or cloud virtual appliance, hybrid installation or hosted managed service.checked 15 Oct 2026
- Documentation and support
- The support area provides manuals, release notes, downloadable agents, firmware and OpenAPI documentation; production or trial licences require contacting a partner or KeyTalk.checked 15 Oct 2026
- Encryption key storage
- KeyTalk says asymmetric key pairs can be stored in its AES256-encrypted management database or a linked hardware security module.checked 30 Sep 2026
- High availability
- High-availability clustering requires a load balancer and MySQL database shared by multiple CKMS front ends.checked 15 Oct 2026
- Identity and access
- AD and Azure AD integration supports multifactor authentication and role-based access controls.checked 15 Oct 2026
- Integrations
- Documented integrations include Microsoft Intune, MobileIron, VMware Workspace ONE, JAMF, RADIUS, LDAP, MySQL and HSMs.checked 15 Oct 2026
- Licence
- KeyTalk is a commercial licensed product; CKMS, agents and S/MIME issuance require licensing through KeyTalk or partners.checked 15 Oct 2026
Where it runs
- Appliance system
- The 8.1.4 virtual appliance is Ubuntu 24.04 Pro based and distributed as an 18.1 GB OVF/VMDK package.checked 15 Oct 2026
- Device authentication
- It supports certificate-based device authentication for VPN and 802.1X Wi-Fi access.checked 15 Oct 2026
- Linux support
- Linux agent 7.9.0 supports Ubuntu 24.04 with TPM key attestation and updates Ubuntu 22.04 TPM support.checked 15 Oct 2026
The company
- Company and location
- KeyTalk describes itself as a European IT security company, founded in 2004 and 100% Dutch, with headquarters in the Netherlands.checked 30 Sep 2026
- Company founding
- KeyTalk was founded in 2004.checked 15 Oct 2026
- Company headquarters
- The company headquarters is in Amersfoort, Netherlands.checked 15 Oct 2026
- Company ownership
- LinkedIn describes KeyTalk as privately held and 100% European-owned.checked 15 Oct 2026
- Company size
- LinkedIn lists KeyTalk at 11–50 employees.checked 15 Oct 2026
- Headquarters
- Amersfoort, Netherlandschecked 28 Sep 2026
Money
- Limit: complexity and cost
- The Gartner page records complaints about certificate-management complexity, insufficient overview/dashboard, provider integration difficulty and expense.checked 15 Oct 2026
Alternatives to KeyTalk CKMS
- 1
EJBCA
Free planOpen sourceWebAPILinuxmacOS8.2From £62,065 a year - 2
Let's Encrypt
Free planOpen sourceWebAPILinuxmacOS7.6Free plan - 3
OpenCA PKI
Free planOpen sourceWebLinuxmacOSSelf-hosted7.4Free plan - 4
step-ca
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan - 5
EZCA
AndroidiOSWebAPI7.0From $200 a month - 6
Google Cloud Secret Manager
Free planWeb6.5From $0.02 a month