DigiCert Private CA vs EZCA
DigiCert Private CA
digicert.comEZCA
keytos.ioSide by side
| Figure | DigiCert Private CA | EZCA |
|---|---|---|
| Price from | — | $200/mo |
| Free plan | — | — |
| Free trial | — | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| iOS | — | Yes |
| Android | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 4 |
| Spec score · Public Key Infrastructure Software | 7.4 (#15) | 8.4 (#4) |
| Security | DigiCert lists FIPS 140-2 Level 3 HSM key protection, role-based access, and full audit logging. | The maker says EZCA uses HSM-backed CAs, with Basic backed by FIPS 140-3 Level 2 HSMs and Premium by Level 3 HSMs. |
| Support | DigiCert provides PKI specialists for installation, migration, and other support, with support documents and Monday-Friday 24/7 specialist availability. | Basic includes support within one business day, Premium includes 24/7 support within 24 hours, and Private Infrastructure includes 24/7 support within one hour. |
Plans
EZCA
- Basic$200 a month
- Premium$500 a month
- Self-Hosted Licensing$3,000 a month
- Private Infrastructure$6,000 a month
In their own words
DigiCert Private CA
DigiCert Private CA has no write-up on Specifiction yet; its figures are above.
EZCA
EZCA is a cloud PKI service for running certificate authorities without operating the underlying PKI infrastructure yourself. It issues certificates through ACME, EST, and SCEP, and provides APIs for applications and workflows. Certificate uses include users, devices, applications, Wi-Fi, VPN, web services, and IoT, including device authentication for Azure IoT Hub and Azure IoT Central. Integrations include Azure, Entra ID, Intune, Azure Key Vault, and Azure applications; Intune and Jamf are supported for device certificates. EZCA can chain to an existing on-premises CA or bring an AD CS CA into a cloud setup. The maker says its CAs are HSM-backed, with Basic using FIPS 140-3 Level 2 and Premium Level 3. CA changes, requests, and approvals are logged for export to a preferred SIEM, and revocation checks use CRLs and OCSP. Basic costs $200 a month per CA, and a 30-day trial is available; there is no free plan. Plans differ in throughput, support, availability, and infrastructure options.