EZCA vs Let's Encrypt

EZCA is a cloud PKI service for running certificate authorities without operating the underlying PKI infrastructure yourself. It issues certificates through ACME, EST, and SCEP, and provides APIs for applications and workflows. Certificate uses include users, devices, applications, Wi-Fi, VPN, web services, and IoT, including device authentication for Azure IoT Hub and Azure IoT Central. Integrations include Azure, Entra ID, Intune, Azure Key Vault, and Azure applications; Intune and Jamf are supported for device certificates. EZCA can chain to an existing on-premises CA or bring an AD CS CA into a cloud setup. The maker says its CAs are HSM-backed, with Basic using FIPS 140-3 Level 2 and Premium Level 3. CA changes, requests, and approvals are logged for export to a preferred SIEM, and revocation checks use CRLs and OCSP. Basic costs $200 a month per CA, and a 30-day trial is available; there is no free plan. Plans differ in throughput, support, availability, and infrastructure options.

Let’s Encrypt is a global Certificate Authority that provides SSL/TLS certificates for HTTPS connections. The ACME protocol verifies control of a domain, and compatible clients can automate issuance, management, and renewal. Its client directory includes Apache HTTP Server, Caddy, nginx, Kubernetes, Docker, and Windows/IIS environments. Certificates are Domain Validation only; Let’s Encrypt says it does not plan to issue Organization Validation or Extended Validation certificates. Wildcard certificates are available through the DNS-01 challenge. Standard certificates last 90 days, with an optional six-day lifetime; these periods cannot be adjusted. Subscribers generate and manage private keys on their own servers. Issued and revoked certificates are publicly recorded, and the service says its certificates are trusted by most browsers and operating systems. Certificates cost nothing. A registered domain can receive up to 50 certificates every seven days under published rate limits. Direct subscriber support is not offered.