What's the Difference Between Keytos Shield and EZCA + EZRADIUS and Which Should I Choose?

What is Keytos Shield?

With Keytos Shield now available globally, we’ve been getting some questions about what it is and how it compares to our existing EZCA and EZRADIUS solutions. In this article, we’ll break down the key differences between the two approaches and provide guidance on which solution might be the best fit for your organization.

What Can I Do With Keytos Shield?

Keytos Shield is an all-in-one platform for passwordless identities. While we have a lot of long-term plans for the platform, we currently include Cloud PKI and Cloud RADIUS as part of every Shield subscription. Later this year we’ll also be adding FIDO2 Passkey + Smart Card Offering and we’re also planning to add S/MIME Email Signing/Encryption as well not too long after. Our goal is to offer all these capabilities and more at the same low cost, making Shield the obvious choice for organizations looking to move to passwordless.

Does Shield Replace EZCA and EZRADIUS?

But wait, doesn’t Keytos already have a cloud PKI and cloud RADIUS solution? Why does Keytos need Shield then, and will it replace EZCA and EZRADIUS?

EZCA and EZRADIUS are our existing solutions for cloud PKI and cloud RADIUS, and they aren’t going anywhere. They’ve been serving thousands of organizations reliably for years, providing robust and deep functionality for those specific needs, and we will continue to do so. Shield is a common platform that sits on top of EZCA and EZRADIUS’ core infrastructure, unifying their capabilities and giving you a single subscription, licensing model, and onboarding experience without needing to manage them separately.

Customers can choose between Shield and EZCA + EZRADIUS and there’s no need to migrate if you’re already happily using EZCA + EZRADIUS in your environment. We’ll continue to support both options as they all share the same common underlying infrastructure.

How Does Shield Improve Cloud PKI and Cloud RADIUS Compared to EZCA + EZRADIUS?

EZRADIUS + EZCA - Platform as a Service (PaaS)

EZCA and EZRADIUS were built with a “platform as a service” (PaaS) model in mind, where you can deploy specific components independently and manage them just like you manage cloud resources in Azure and AWS. Just like you can deploy an S3 bucket or an Azure storage account and configure them within AWS or Azure, EZCA and EZRADIUS were meant to be deployable as independent services that you manage and configure separately.

With EZCA you can deploy cloud certificate authorities (CAs) and configure certificate issuance, and with EZRADIUS you can deploy a virtual cloud RADIUS server and configure authentication policies. The overall model is:

1. Deploy each component independently.
2. Configure each component independently.
3. Integrate the components into each other, where applicable
4. Integrate the components into your overall IT environment.

Shield - Software as a Service (SaaS)

Keytos Shield is built with a “software as a service” (SaaS) model in mind. Instead of deploying and managing individual components, you get a fully managed platform with a simple onboarding flow for both cloud PKI and cloud RADIUS. We handle the PKI configuration & RADIUS setup for you, allowing you to focus on using the services rather than managing them. This allows you to:

1. Deploy a single subscription for both cloud PKI and cloud RADIUS.
2. Follow a single onboarding flow for both cloud PKI and cloud RADIUS.
3. Integrate your cloud PKI and cloud RADIUS into your overall IT environment.

This results in less steps, less configuration, and an overall easier experience for IT administrators.

How Do I Choose Between Keytos Shield and EZCA + EZRADIUS?

When choosing between Keytos Shield and EZCA + EZRADIUS, you’ll want to compare features, costs, and ease of management. Let’s break down each aspect to help you make an informed decision.

What Features Does Each Option Offer?

Since Keytos Shield is built on the same core infrastructure as EZCA and EZRADIUS, it has most of the same features as each platform. However, there are a few areas where we’re simplifying the Shield experience to make it more user-friendly and easier to manage. Over time we’ll work to continuously add more features where they’re missing.

How Much Does Shield Cost Compared to EZCA + EZRADIUS?

How Did EZCA and EZRADIUS Mix Billing Models and What Were the Upfront Costs?

When we built Keytos Shield we also wanted to simplify our billing model to make it easy, predictable, and transparent for you to know the exact cost upfront without any hidden fees or surprises. While EZCA + EZRADIUS were also easy, predictable, and transparent, they mixed different billing models like per CA and per authenticated user/device, which could make it harder to estimate the total cost accurately.

Deploying EZCA with a Root CA + Issuing SCEP CA, while more affordable compared to the rest of the industry, still cost $400 per month for 2 Basic CAs. While a huge cost saver for many organizations migrating from an existing AD CS PKI environment, it was still a significant expense for many smaller organizations.

How Does Keytos Shield Simplify Billing With a Single User License?

For Shield, we made it easy. We license per user, and you get unlimited certificates and RADIUS authentications included. This means that users can have as many devices as they need without worrying about additional costs. It also keeps your scaling predictable and straightforward, allowing you to plan your growth based solely on the number of users.

How Do the Costs Compare for Cloud PKI and Cloud RADIUS?

Use the following interactive cost comparison tool to see how Keytos Shield stacks up against EZCA + EZRADIUS based on your organization’s size and needs. This calculator assumes you’re using a 2-tier PKI (Root CA + Issuing SCEP CA) setup with user certificates for authentication.

Assumes EZCA Root + Issuing CA at $400/mo (Basic) or $1,000/mo (Premium), plus EZRADIUS shared infrastructure pricing. Shield pricing reflects its published Basic and Premium tiers. Actual costs can vary by configuration.

How Can I Get Started with Keytos Shield?

If you want to begin your passwordless journey with Keytos Shield, you can start by signing up for a subscription and onboarding to Keytos Shield via our Getting Started Guide.

Get Started with Keytos Shield PKI + RADIUS

Every subscription comes with a 30-day free trial, and you can cancel at any time.

How Can I Get Started with EZCA and EZRADIUS?

If you prefer a PaaS experience and want full control over your cloud PKI and cloud RADIUS, EZCA and EZRADIUS are great options to deploy and manage within your organization. You can start by signing up for their services and following their respective setup guides to get your environment up and running.

Get Started with EZCA Cloud PKI Get Started with EZRADIUS Cloud RADIUS

Just like Shield, both EZCA and EZRADIUS provide 30-day free trials, allowing you to try them out before committing to a subscription.

Want to Talk to a Keytos Engineer About The Best Option For Your Environment?

Want to talk to a Keytos Engineer to discuss your organization’s specific needs? You can reach out to us for a personalized consultation here.

Schedule a Demo