Skip to content
SPECIFICTION
Get listed

KeyTalk CKMS

keytalk.com

From €5/mo Free trial WebWindowsmacOSLinuxiOSAndroid
Visit keytalk.com
Spec score 8.8 #2 of 26 in Public Key Infrastructure Software

What it is

KeyTalk CKMS automates PKI implementation and the enrollment, distribution and management of digital certificates. It keeps certificates and keys in a central repository and supports automated or semi-automated deployment and renewal, alongside reporting, notifications and alerts. Smart Security Scan finds certificates and keys on a network so valid findings can be imported. The product includes a private certificate authority that can operate beneath an existing root or as a standalone root. Integrations and protocols include DigiCert, DigiCert QuoVadis, GlobalSign, Microsoft CA, Intune, MobileIron, load balancers, HSMs, Citrix, SCEP and ACME. Access controls include AD and Entra ID authorization, multifactor authentication and role-based controls. CKMS can run as a virtual machine on customer infrastructure, in private cloud environments such as AWS, Azure and Google Cloud, or as KeyTalk-managed PKI service. General CKMS pricing is on request, and a free trial is available. Separate S/MIME plans cost €5 a month for on-premise service and €6.50 a month for hosted SaaS, billed per user per month.

Spec sheet

What it does
KeyTalk CKMS automates enrollment, distribution, renewal and management of digital certificates and keys.Read 15 Oct 2026 · keytalk.com
Deployment
CKMS is delivered as a virtual machine for customer infrastructure, private cloud environments including AWS, Azure, and Google Cloud, or KeyTalk-managed PKI as a service.Read 30 Sep 2026 · keytalk.com
API
The product exposes client and administrator REST APIs using JSON over TLS and publishes an OpenAPI specification.Read 15 Oct 2026 · keytalk.com
Integrations
Documented integrations include Microsoft Intune, MobileIron, VMware Workspace ONE, JAMF, RADIUS, LDAP, MySQL and HSMs.Read 15 Oct 2026 · keytalk.com
Support
KeyTalk says it offers customers 24/7 support.Read 30 Sep 2026 · keytalk.com
Headquarters
Amersfoort, NetherlandsRead 28 Sep 2026 · keytalk.com
Access controls
The platform supports AD and Entra ID authorization, multifactor authentication, and role-based access control using security groups.Read 30 Sep 2026 · keytalk.com
Appliance system
The 8.1.4 virtual appliance is Ubuntu 24.04 Pro based and distributed as an 18.1 GB OVF/VMDK package.Read 15 Oct 2026 · keytalk.com
Automated deployment
Certificates can be deployed and renewed automatically or through notification and authorization workflows on servers, network devices and user devices.Read 15 Oct 2026 · keytalk.com
Certificate authorities
The system supports multiple public and private CAs, including Microsoft AD CS, GlobalSign and DigiCert QuoVadis.Read 15 Oct 2026 · keytalk.com
Certificate discovery
Smart Security Scan discovers certificates and keys on networks so valid findings can be imported into CKMS.Read 15 Oct 2026 · keytalk.com
Certificate lifecycle
CKMS provides a central repository for certificates and keys, automated or semi-automated deployment and renewal, and reporting, notifications, and alerts.Read 30 Sep 2026 · keytalk.com
Company and location
KeyTalk describes itself as a European IT security company, founded in 2004 and 100% Dutch, with headquarters in the Netherlands.Read 30 Sep 2026 · keytalk.com
Company founding
KeyTalk was founded in 2004.Read 15 Oct 2026 · gartner.com
Company headquarters
The company headquarters is in Amersfoort, Netherlands.Read 15 Oct 2026 · gartner.com
Company ownership
LinkedIn describes KeyTalk as privately held and 100% European-owned.Read 15 Oct 2026 · linkedin.com
Company size
LinkedIn lists KeyTalk at 11–50 employees.Read 15 Oct 2026 · linkedin.com
Deployment models
The CKMS server is offered as an on-premises or cloud virtual appliance, hybrid installation or hosted managed service.Read 15 Oct 2026 · keytalk.com
Device authentication
It supports certificate-based device authentication for VPN and 802.1X Wi-Fi access.Read 15 Oct 2026 · keytalk.com
Documentation and support
The support area provides manuals, release notes, downloadable agents, firmware and OpenAPI documentation; production or trial licences require contacting a partner or KeyTalk.Read 15 Oct 2026 · keytalk.com
Encryption key storage
KeyTalk says asymmetric key pairs can be stored in its AES256-encrypted management database or a linked hardware security module.Read 30 Sep 2026 · keytalk.com
High availability
High-availability clustering requires a load balancer and MySQL database shared by multiple CKMS front ends.Read 15 Oct 2026 · keytalk.com
Identity and access
AD and Azure AD integration supports multifactor authentication and role-based access controls.Read 15 Oct 2026 · keytalk.com
Licence
KeyTalk is a commercial licensed product; CKMS, agents and S/MIME issuance require licensing through KeyTalk or partners.Read 15 Oct 2026 · keytalk.com
Limit: complexity and cost
The Gartner page records complaints about certificate-management complexity, insufficient overview/dashboard, provider integration difficulty and expense.Read 15 Oct 2026 · gartner.com
Linux support
Linux agent 7.9.0 supports Ubuntu 24.04 with TPM key attestation and updates Ubuntu 22.04 TPM support.Read 15 Oct 2026 · keytalk.com
Mac support
Mac agent 7.9.0 supports Apple macOS devices and current public-trusted S/MIME issuance requirements.Read 15 Oct 2026 · keytalk.com
Notable customer deployment
KeyTalk reports a TK Elevator deployment automating certificate installation and 25-day renewal for more than 30,000 workstations.Read 15 Oct 2026 · keytalk.com
Praise: security and integration
The Gartner reviewer praised strong security, automation, compliance, scalability and integration, including IAM integration.Read 15 Oct 2026 · gartner.com
Private CA
CKMS includes a private CA that can operate under an existing root CA or as a standalone root CA.Read 30 Sep 2026 · keytalk.com
Product purpose
KeyTalk CKMS automates PKI implementation and the enrollment, distribution, and management of digital certificates.Read 30 Sep 2026 · keytalk.com
Protocols
CKMS supports REST, ACME and SCEP for certificate automation and deployment.Read 15 Oct 2026 · keytalk.com
Rating on Apple App Store
No rating is displayed because the app has not received enough ratings or reviews.Read 15 Oct 2026 · apps.apple.com
Rating on Gartner Peer Insights
4.0 out of 5 from 1 reviewRead 15 Oct 2026 · gartner.com
Reporting
CKMS provides reporting, notifications and alerts for certificate operations.Read 15 Oct 2026 · keytalk.com
Revocation
KeyTalk supports CRL and OCSP status checking and can assign certificate lifetimes as short as one second when the CA permits it.Read 15 Oct 2026 · keytalk.com
S/MIME
CKMS issues and deploys S/MIME certificates and can configure Outlook email encryption and signing.Read 15 Oct 2026 · keytalk.com
S/MIME offering
The S/MIME service supports on-premise installation or KeyTalk-hosted SaaS and includes a certificate from GlobalSign or DigiCert; hosted service also includes an HSM.Read 30 Sep 2026 · keytalk.com
Security storage
Private keys can be stored in an AES-256-encrypted management database or linked HSM, with automatic key and certificate regeneration after expiry.Read 15 Oct 2026 · keytalk.com
Self-hosting
Customers can install the OVF/VMDK appliance on VMware ESXi or launch the CKMS AMI from AWS.Read 15 Oct 2026 · keytalk.com
Short-lived certificates
KeyTalk says it can assign a certificate lifespan as short as one second when supported by the target certificate authority.Read 30 Sep 2026 · keytalk.com
Target customers
KeyTalk describes CKMS as having multi-tenant features for managed service providers and businesses serving customers.Read 30 Sep 2026 · keytalk.com
TLS/SSL lifecycle
The platform automates TLS/SSL certificate lifecycle management and replacement.Read 15 Oct 2026 · keytalk.com
Windows support
Enterprise agent 8.1.4 supports Windows 10, Windows 11 and Windows Server 2016–2025, including custom-script server applications.Read 15 Oct 2026 · keytalk.com

Plans and prices

S/MIME on-premise €5 a month per user per month; just over € 5; up to 250 participants; multiple devices; staggered discount for larger organisations Up to 250 participants · multiple devices Read 30 Sep 2026 · keytalk.com
S/MIME hosted SaaS €6.50 a month per user per month; just over €6.50; up to 250 participants; staggered discount for larger organisations Up to 250 participants Read 30 Sep 2026 · keytalk.com
CKMS 0–49 seats Price not published per year; VAT excluded 0–49 licences · base plus seat licences Read 15 Oct 2026 · assets.applytosupply.digitalmarketplace.service.gov.uk
CKMS 100,000+ seats Priced on request on request 100,000+ licences Read 15 Oct 2026 · assets.applytosupply.digitalmarketplace.service.gov.uk
CKMS 10,000–24,999 seats Price not published per year; VAT excluded 10,000–24,999 licences Read 15 Oct 2026 · assets.applytosupply.digitalmarketplace.service.gov.uk
CKMS 1,000–2,499 seats Price not published per year; VAT excluded 1,000–2,499 licences Read 15 Oct 2026 · assets.applytosupply.digitalmarketplace.service.gov.uk
CKMS 25,000–49,999 seats Price not published per year; VAT excluded 25,000–49,999 licences Read 15 Oct 2026 · assets.applytosupply.digitalmarketplace.service.gov.uk
CKMS 2,500–9,999 seats Price not published per year; VAT excluded 2,500–9,999 licences Read 15 Oct 2026 · assets.applytosupply.digitalmarketplace.service.gov.uk
CKMS 250–999 seats Price not published per year; VAT excluded 250–999 licences Read 15 Oct 2026 · assets.applytosupply.digitalmarketplace.service.gov.uk
CKMS 50,000–74,999 seats Price not published per year; VAT excluded 50,000–74,999 licences Read 15 Oct 2026 · assets.applytosupply.digitalmarketplace.service.gov.uk
CKMS 50–249 seats Price not published per year; VAT excluded 50–249 licences Read 15 Oct 2026 · assets.applytosupply.digitalmarketplace.service.gov.uk
CKMS 75,000–99,999 seats Price not published per year; VAT excluded 75,000–99,999 licences Read 15 Oct 2026 · assets.applytosupply.digitalmarketplace.service.gov.uk

Every KeyTalk CKMS plan and price →

Strong points and limits

Strong points

  • Central repository for certificates and keys.
  • Supports automated or semi-automated renewal.
  • Private CA can use an existing or standalone root.
  • Multifactor and role-based access controls.
  • 24/7 support offered.

Limits

  • CKMS pricing is on request.
  • Short-lived certificates depend on target CA support.
  • S/MIME hosted SaaS costs €6.50 a month per user.

Who it suits

CKMS suits businesses managing digital certificates and keys, including managed service providers serving customers. Its deployment choices cover customer infrastructure, private cloud and managed service.

KeyTalk CKMS in depth

Read the full write-up

KeyTalk CKMS automates PKI setup and the enrollment, distribution, and management of digital certificates. It is aimed at organizations and service providers managing certificates across their own or customers’ environments. Its breadth of discovery and deployment options is compelling, but the core platform requires custom pricing.

Overview

CKMS combines certificate lifecycle workflows with network discovery, a private CA, access controls, and integrations for certificate authorities and infrastructure. That makes it a stronger fit for teams coordinating certificate operations across varied systems than for someone seeking only a lightweight ACME client. Buyers should weigh that scope against the effort of evaluating a custom-priced platform.

Key features

A central repository holds certificates and keys, while automated or semi-automated deployment and renewal are backed by reporting, notifications, and alerts. Smart Security Scan finds certificates and keys on a network and lets teams import valid findings. The combination is useful when existing certificate assets need to be brought into managed workflows, not just when issuing new certificates.

Supported integrations and protocols include DigiCert, DigiCert QuoVadis, GlobalSign, Microsoft CA, Intune, MobileIron, load balancers, HSMs, Citrix, SCEP, and ACME. This gives organizations several routes to connect certificate operations to existing systems, although a specific environment still needs to be checked for coverage.

The included private CA can run under an existing root CA or as a standalone root. Access controls include AD and Entra ID authorization, multifactor authentication, and role-based access tied to security groups. Asymmetric key pairs can be stored in an AES256-encrypted management database or a linked HSM, giving organizations a choice between database storage and hardware-backed storage.

KeyTalk says CKMS can assign certificate lifespans as short as one second, but only where the target certificate authority supports that lifespan. The capability is therefore useful for short-lived certificate strategies, not a guarantee that every CA can issue certificates on that schedule.

Deployment choices include a virtual machine on customer infrastructure, private cloud environments such as AWS, Azure, and Google Cloud, or KeyTalk-managed PKI as a service. KeyTalk also offers 24/7 support. Its separate S/MIME service can be installed on premises or hosted as SaaS; it includes a certificate from GlobalSign or DigiCert, and the hosted service also includes an HSM.

Pricing

CKMS is paid, with custom pricing. Organizations evaluating the full lifecycle platform should request a quote rather than infer its cost from the separate S/MIME plans.

The published S/MIME options are priced per user per month and automatically renew:

S/MIME on-premise: €5 a month, up to 250 participants, with multiple devices and staggered discounts for larger organizations. It suits organizations that want an on-premise S/MIME installation; the participant ceiling matters when sizing a larger deployment.

S/MIME hosted SaaS: €6.50 a month, up to 250 participants, with staggered discounts for larger organizations. It suits buyers who prefer KeyTalk-hosted S/MIME, but unlike the on-premise plan’s stated allowance, the plan does not mention multiple devices.

Both plans are capped at 250 participants, so larger organizations should account for the scale and discounts when comparing costs.

Platforms

CKMS supports Android, iOS, Linux, macOS, Windows, and self-hosted deployment. The range suits organizations managing certificates across mixed operating systems, while the virtual-machine and cloud options let them choose where the service runs.

Who it's for

CKMS is a candidate for businesses with substantial certificate operations and managed service providers serving customers. KeyTalk describes multi-tenant features for those use cases, while the discovery, private CA, access controls, and deployment choices address needs beyond issuing certificates alone. It is less suited to buyers who need a simple, self-service tool with a clear price before engaging a vendor.

Pros and cons

Pros: Network discovery can surface existing certificates and keys for import, helping teams build on an existing estate rather than start from scratch.

Pros: The private CA, identity-based access controls, and database or HSM key storage bring several PKI and security needs into one platform.

Pros: Customer infrastructure, private cloud, and managed-service deployments accommodate different operating preferences.

Cons: Custom pricing makes the full platform harder to compare on cost without a quote.

Cons: The public S/MIME plans stop at 250 participants, and the shortest certificate lifespans depend on the target CA.

Alternatives

For a different scale or operating model, consider these options:

Certify The Web offers a free evaluation with no feature limitations or time limit, making it worth considering for buyers seeking a no-cost starting point.

Qualys External Attack Surface Management offers CSAM with EASM at no cost for 30 days, a fit for readers wanting a time-limited evaluation.

EJBCA has a free open-source Community Edition for basic PKI learning, testing, and prototyping; it is explicitly not intended for production.

GeoTrust is another paid certificate-related option.

ManageEngine Key Manager Plus offers an on-premises license for 25 managed keys at $59 a month, for buyers whose needs fit that stated key allowance.

acme.sh is a free GPLv3 shell-script ACME client, suited to readers looking for a narrower, no-cost client.

Certbot is free, open-source software for readers seeking a no-cost certificate tool.

Entrust Certificate Manager is another paid certificate-management option.

For a broader comparison, browse Certificate Management Software or Public Key Infrastructure Software.

Verdict

Choose KeyTalk CKMS if you need certificate discovery, lifecycle automation, private CA capabilities, and deployment flexibility across your own or customers’ environments. Its strongest case is the combination of those controls with multi-tenant use and several deployment models. Look elsewhere if you need a readily comparable price or a simple no-cost tool; the core platform is custom-priced, and the S/MIME plans have a 250-participant cap.

Verdict

KeyTalk CKMS combines certificate lifecycle management with network discovery, access controls and several deployment models. Confirm CKMS pricing and whether a target certificate authority supports the required certificate lifespan.

Where Specifiction places it

Alternatives to KeyTalk CKMSAll alternatives →