EZCA vs OpenCA PKI
EZCA
keytos.ioOpenCA PKI
openca.orgSide by side
| Figure | EZCA | OpenCA PKI |
|---|---|---|
| Price from | $200/mo | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| iOS | Yes | — |
| Android | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 4 | 1 |
| Spec score · Public Key Infrastructure Software | 8.4 (#4) | 8.4 (#5) |
| Founded | 2021 | 1998 |
| Support | Basic includes support within one business day, Premium includes 24/7 support within 24 hours, and Private Infrastructure includes 24/7 support within one hour. | The project describes community support through mailing lists, forums, and online chat, and mentions paid support from independent third parties. |
| What it does | EZCA is a cloud PKI service for running and scaling certificate authorities without operating the PKI infrastructure yourself. | OpenCA PKI is open-source software for setting up and administering certification authorities and public-key infrastructures. |
Plans
EZCA
- Basic$200 a month
- Premium$500 a month
- Self-Hosted Licensing$3,000 a month
- Private Infrastructure$6,000 a month
In their own words
EZCA
EZCA is a cloud PKI service for running certificate authorities without operating the underlying PKI infrastructure yourself. It issues certificates through ACME, EST, and SCEP, and provides APIs for applications and workflows. Certificate uses include users, devices, applications, Wi-Fi, VPN, web services, and IoT, including device authentication for Azure IoT Hub and Azure IoT Central. Integrations include Azure, Entra ID, Intune, Azure Key Vault, and Azure applications; Intune and Jamf are supported for device certificates. EZCA can chain to an existing on-premises CA or bring an AD CS CA into a cloud setup. The maker says its CAs are HSM-backed, with Basic using FIPS 140-3 Level 2 and Premium Level 3. CA changes, requests, and approvals are logged for export to a preferred SIEM, and revocation checks use CRLs and OCSP. Basic costs $200 a month per CA, and a 30-day trial is available; there is no free plan. Plans differ in throughput, support, availability, and infrastructure options.
OpenCA PKI
OpenCA PKI is free, open-source software for establishing and managing a public key infrastructure, with an out-of-the-box Certification Authority. It is intended for on-premises deployment and is listed for Linux, macOS, self-hosted, and web environments. The project says it implements commonly used protocols with full-strength cryptography; listed capabilities include SCEP support, HSM integration, and certificate profiles. The download page lists OpenCA PKI (SpecialK) version 1.5.1. Installation requires other software, including OpenLDAP, OpenSSL, Apache, and Apache mod_ssl, and OpenCA Tools version 1.3.0 is listed as a prerequisite to install first. The project dates to 1998 and describes its work as volunteer-driven and managed through collaboration and consensus. Community support is available through mailing lists, forums, and online chat; independent third parties offer paid support. Security concerns can be reported privately by email or publicly through the project issue trackers. The documentation page says downloadable documentation is unavailable and notes that the OpenCA Guide for version 0.9.2 is outdated in some parts.