Solutions
One platform. Zero passwords.
Cloud PKI for Azure, Intune, and Entra ID
The best cloud RADIUS for Microsoft environments
Entra ID authentication to SSH endpoints
Passwordless security key and smart card onboarding for Entra ID
Eliminate SSL certificate outages and vulnerabilities
Blog
Partner
Your trusted partner for passwordless security
Join our global partner network
Run and scale your own highly available Certificate Authority without the upfront investment and ongoing maintenance of operating your own PKI environment.
1,200+
Global organizations
trust Keytos
7.3M+
Cryptographic operations
per month in EZCA
20+
Deployment regions
around the globe
99.95%
Enterprise-tier service availability
"The only CA platform that is actually native to Azure that enabled us to easily deploy PKI for PIV authentication on Entra ID. Being able to use EZCA instead of Windows Server VMs with CA roles is so much cleaner and easier to deploy - truly game changing."
Zachary C. · Vice President of Customer Solutions
Cloud certificate authorities at cloud scale, built for the Microsoft environment your team already runs.
EZCA was built by ex-Microsoft engineers to natively connect to Azure, Entra ID, and Intune. Deploy & bill through the Microsoft Marketplace and use your existing MACC commitment.
Point Intune at EZCA and begin issuing certificates in minutes. Instantly revoke when devices are wiped or retired. Listed by Microsoft as an official third-party SCEP CA.
Keep your on-premises root and issue from the cloud, or modernize AD CS without replacing it. Setup is a few clicks, not a rebuild.
Automate cert issuance across your web servers, IoT devices, Kubernetes clusters, and cloud services using ACME, SCEP, and EST. Leverage the same tools and automation you already have.
Building your own PKI normally means buying HSMs, running redundant servers, and owning patching, CRLs, and disaster recovery. EZCA is a fully managed PKI service that handles all of the complexity for you for one low, monthly cost.
EZCA comes with out-of-the-box defaults that ensure your PKI environment starts and stays secure. Plus, every action is logged and exportable to your own SIEM solution, or downloadable for audit-ready reports.
No servers to buy, no HSMs to rack, no CRL infrastructure to babysit. Create a CA and start issuing certificates the same day.
Deploy EZCA from the Microsoft Marketplace and create a new HSM backed certificate authority, or chain up to the AD CS environment you already run.
EZCA supports popular MDM providers like Intune and Jamf for device certificates, plus ACME and EST for web and IoT certificates. Issue your first cert in minutes.
Issue and manage certificates for users, devices, applications, Wi-Fi, VPN, web services, and IoT from one centralized PKI platform.
EZCA is the only CA platform that is actually native to Azure, enabling easy PKI deployment for PIV authentication without standing up Windows Server VMs - much cleaner and easier to deploy.
Easy to use, with quick and knowledgeable support via chat and helpful documentation for third-party integrations. Setup required minimal effort, and the EZCA/EZRADIUS/Intune integration was key for CMMC compliance.
Ease of use and tight integration with Entra, supporting auto-renewal and hybrid CA integration.
Straightforward and well documented setup, highly reliable, vendor-agnostic approach, and a sensible pricing model based on Certificate Authorities rather than certificates issued.
Eliminates the need to stand up and maintain a traditional on-prem PKI/CA infrastructure for 802.1X, with fully automated certificate issuance and renewal through Intune SCEP integration.
Very easy to deploy, support chat includes AI assistance with a human fallback, and integration was seamless with a quick setup.
From device authentication to cloud PKI modernization, see how EZCA helps Microsoft-first teams deploy certificates without the infrastructure burden.
As a trusted Microsoft Intune Certificate Authority partner, EZCA issues user and device certificates to every Intune-supported OS and platform, with no CA servers to run.
Move to phishing resistant credentials and eliminate passwords for all your Entra ID users, with support for strong identity mapping and hybrid environments.
EZCA is the first Azure based CA that scales to meet certificate requirements for Azure IoT Hub and Azure IoT Central, including certificate-based device authentication.
Move at your own pace by chaining to your existing on-premises PKI in just a few clicks, or fully move to the cloud and modernize your PKI.
No cost per certificate, no servers, no HSMs, no geo-redundant data centres to pay for. Start with a monthly subscription and scale your certificate authorities as you need them.
Basic
FIPS 140-3 HSM backed CAs with Azure IoT and Key Vault integration
Premium
Most popular ✦Higher throughput, public certificate management, and priority support
Private Infrastructure
Fully isolated infrastructure for your most critical workloads
EZCA starts at $200 per CA per month for Basic and $500 per CA per month for Premium, which adds higher throughput, public certificate management, and priority support. Private Infrastructure and self-hosted licensing options are also available.
A certificate authority (CA) is a service that issues digital certificates, which are used to verify the identity of entities and secure communications over networks. When you create a CA, it becomes a trusted entity that can vouch for the authenticity of the certificates it issues, enabling secure communication and trust within your network or with external parties. Learn more in our blog post which goes in depth on certificate authorities.
EZCA is able to issue certificates through all the major industry standard protocols, including SCEP, ACME, and EST. It also integrates directly with Intune SCEP, Azure Key Vault, and Entra ID Application. It also has APIs that you can build upon in your own applications and workflows, providing flexibility and extensibility for diverse use cases.
EZCA supports both public and private certificate authorities, as well as root CAs and subordinate CAs, giving you flexibility in how you structure your PKI environment and issue certificates. Learn more in our blog post.
Yes. EZCA is a trusted Microsoft Intune Certificate Authority partner, so you can set up a compliant Azure-based CA for Intune SCEP and deliver user or device certificates to every managed device. Learn more about how Intune SCEP integration works with EZCA.
Yes. You can chain to your on-premises CA in a few clicks, and EZCA layers on top of your existing AD CS environment, so you can modernize certificate management without overhauling your current setup.
Yes. EZCA can issue certificates through the ACME protocol, so your engineers use the same automation tools for internal certificates that they already use for public ones.
Yes. Basic CAs are backed by FIPS 140-3 (Level 2) validated Hardware Security Modules (HSMs) and Premium CAs by FIPS 140-3 (Level 3). You can also bring your own HSM and give EZCA access to sign certificates instead.
Yes. EZCA scales to meet certificate requirements for Azure IoT Hub and Azure IoT Central, including certificate-based device authentication.
Yes. EZCA supports both Certificate Revocation Lists (CRLs) and the Online Certificate Status Protocol (OCSP) for certificate revocation checking.
All CA changes, certificate requests, and approvals are logged and can be exported to your preferred SIEM, so your security team can analyze them and compliance audits are simpler.
Yes. Keytos solutions can be deployed and billed directly to your Azure subscription through the Microsoft Marketplace, so the spend can count toward existing enterprise MACC agreements.
