EZCA

EZCA is a managed cloud PKI service for organizations that need certificate authorities without running the underlying PKI infrastructure. It is best suited to Azure-centered teams with certificates spanning users, devices, applications, and IoT. Its per-CA pricing buys managed infrastructure, but throughput and support vary substantially by tier.

Overview

EZCA manages certificates for users, devices, applications, Wi-Fi, VPN, web services, and IoT. Teams can connect an on-premises CA or bring an existing AD CS CA into the cloud setup, making it a plausible route for extending an established PKI rather than replacing it outright. ACME, EST, and SCEP cover enrollment, and APIs support application and workflow integrations.

The maker says there is no certificate-count limit, but capacity is constrained by the rate of certificate creation or OCSP responses per CA. That makes throughput—not the nominal number of certificates—the important sizing question for busy environments.

Key features

Integrations and certificate workflows

EZCA integrates with Azure, Entra ID, Intune, Azure Key Vault, and Azure applications. Intune and Jamf support device certificates, while Azure IoT Hub and Azure IoT Central support certificate-based device authentication. The combination is useful for organizations already invested in Microsoft's cloud and endpoint tools; teams outside that ecosystem may find less reason to choose EZCA over a PKI service aligned to their existing stack.

Security, auditing, and revocation

EZCA uses HSM-backed CAs: Basic uses FIPS 140-3 Level 2 HSMs, while Premium uses Level 3. CA changes, certificate requests, and approvals are logged and can be exported to a preferred SIEM. CRLs and OCSP support revocation checking. These capabilities cover key operational controls, though the HSM level and service throughput depend on the selected plan.

Pricing

EZCA is paid, with a 30-day trial and no free plan. Basic costs $200 a month, billed at $200 per CA per month. It includes Level 2 HSM-backed CAs, one certificate creation or OCSP response per CA per second, support within one business day, and 99.9% availability. This is the entry point for teams with modest per-CA demand that can work with business-day support.

Premium costs $500 a month, billed at $500 per CA per month. It raises capacity to 10 certificates created or OCSP responses per CA per second, upgrades to Level 3 HSMs, provides 24/7 support within 24 hours and 99.95% availability, and adds public CA certificate management. The higher rate is justified for teams needing that headroom, HSM level, or public certificate management; it is a material increase for every managed CA.

Private Infrastructure costs $6,000 a month, billed at $6,000 per location per month. It includes Premium, increases throughput to 160 certificates or OCSP responses per CA per second, provides fully isolated infrastructure, and offers 24/7 support within one hour. It targets organizations that need isolation, high capacity, and faster support, rather than teams simply seeking a managed cloud CA.

Self-Hosted Licensing costs $3,000 a month, billed at $3,000 per location per month with unlimited CAs. It includes everything in Private Infrastructure plus self-healing infrastructure using Azure PaaS services. The unlimited-CA term may suit deployments with many authorities, but the location-based fee still makes scale and deployment footprint central to the cost decision.

Platforms

EZCA supports Android, iOS, Linux, macOS, and Windows, alongside API, web, and self-hosted platform options. Its hybrid deployment model and integrations make it relevant to organizations spanning managed infrastructure and cloud services.

Who it's for

EZCA fits organizations that want to manage CAs without operating PKI infrastructure, especially those using Azure, Entra ID, Intune, or Azure IoT services. Its links to existing on-premises and AD CS CAs also make it worth considering for organizations moving established certificate workflows toward a cloud setup. It is less compelling for teams that prefer to operate open-source PKI themselves or whose per-CA throughput needs make the recurring fees unattractive.

Pros and cons

Managed CA infrastructure: avoids self-operation of the underlying PKI, while supporting existing on-premises and AD CS CA paths.

Broad enrollment and Microsoft integrations: ACME, EST, SCEP, APIs, Azure services, Intune, and Jamf address varied certificate workflows.

No certificate-count cap: avoids a total issuance ceiling, though per-CA processing rates remain plan-limited.

Plan costs scale by CA or location: Basic and Premium charge per CA, while the infrastructure tiers charge per location; either basis can weigh heavily on larger deployments.

Meaningful tier gaps: Basic's one-per-second rate and business-day support may not suit demand or response requirements that warrant Premium or Private Infrastructure.

Alternatives

Compare public key infrastructure software if you want to weigh EZCA against other PKI options.

EJBCA is a free alternative with a Community Edition aimed at learning, testing, and prototyping rather than production.

KeyTalk CKMS is another paid option, with an S/MIME on-premise plan at €5 a month per user for up to 250 participants.

SecureW2 Cloud NAC is a paid alternative with pricing requested through a quote form.

step-ca offers a free open-source option with a single configured intermediate CA and authority-wide issuance policies.

OpenCA PKI is free, open-source PKI management software.

OpenXPKI has a free, fully functional Community Edition with Debian packages and mailing-list support.

XiPKI is a free alternative under the Apache License 2.0.

Entrust Certificate Manager is a paid option with pricing by quote.

Verdict

Choose EZCA if you need managed certificate authorities, particularly in an Azure-centered environment or as a cloud path for an existing CA. Its protocol coverage, integrations, audit trail, and revocation support make it a broad operational fit. Look elsewhere if you need a free PKI, want to run the infrastructure yourself, or cannot justify per-CA or per-location charges for the throughput and support your deployment requires.