EZCA vs OpenXPKI

EZCA is a cloud PKI service for running certificate authorities without operating the underlying PKI infrastructure yourself. It issues certificates through ACME, EST, and SCEP, and provides APIs for applications and workflows. Certificate uses include users, devices, applications, Wi-Fi, VPN, web services, and IoT, including device authentication for Azure IoT Hub and Azure IoT Central. Integrations include Azure, Entra ID, Intune, Azure Key Vault, and Azure applications; Intune and Jamf are supported for device certificates. EZCA can chain to an existing on-premises CA or bring an AD CS CA into a cloud setup. The maker says its CAs are HSM-backed, with Basic using FIPS 140-3 Level 2 and Premium Level 3. CA changes, requests, and approvals are logged for export to a preferred SIEM, and revocation checks use CRLs and OCSP. Basic costs $200 a month per CA, and a 30-day trial is available; there is no free plan. Plans differ in throughput, support, availability, and infrastructure options.

OpenXPKI is PKI and Trustcenter software for managing X.509v3 certificates in professional environments. Its customizable workflows cover requests, renewals, and revocations, with enrollment through SCEP, EST, SimpleCMC, ACME, and a REST-like API with OpenAPI support. One instance can host multiple PKI Realms, each with separate namespaces, profiles, workflows, and policies. The Ember.js web interface serves users, operators, and administrators in major browsers. Connectors reach flat files, LDAP, SQL databases, and web services; Enterprise Edition adds extensions for DigiCert, Sectigo, and SwissSign. Hardware Security Modules are supported through PKCS#11. YAML configuration can be tracked with revision control, and custom reporting workflows can produce downloadable CSVs. Community Edition is free and fully functional, with Debian 12 packages and mailing-list support. Enterprise Edition has packages for RHEL, SLES, and Ubuntu Server LTS; service and commercial support options are also listed, with SLAs available. The software was founded in 2009.