Solutions
Cloud PKI, cloud RADIUS, passwordless onboarding, all in one platform.
Cloud PKI for Azure, Intune, and Entra ID
The best cloud RADIUS for Microsoft environments
Entra ID authentication to SSH endpoints
Passwordless security key and smart card onboarding for Entra ID
Eliminate SSL certificate outages and vulnerabilities
Blog
Partner
Your trusted partner for passwordless security
Join our global partner network
Learn how Keytos EZCA provides a full cloud PKI solution.
1,200+
Global organizations
trust Keytos
45M+
RADIUS authentications
per month in EZRADIUS
7.3M+
Digital identities
created per month
20+
Deployment regions
around the globe
Looking for a cloud based PKI? As the move to the cloud and the transition to zero trust continue, so do your certificate needs, and legacy on-premises certificate authorities simply do not scale with them.
That is why we built EZCA, a certificate authority designed for the cloud rather than ported to it. It takes the complexity of running your own PKI away, and its native Azure integrations are what make it the right choice for an Azure estate.
The same PKI standards, at a published price, with the Azure integrations EJBCA has no equivalent for.
| Capability | |
EJBCA SaaS |
|---|---|---|
| Pricing | $200 per CA per month, infrastructure included | From $105,000 a year, entry level |
| SOC 2 Type 2 compliant | Yes | Yes |
| OCSP | Yes | Yes |
| CRL | Yes | Yes |
| ACME certificates | Yes | Yes |
| Intune integration | Yes | Yes |
| Pay as you go | Yes | Yes |
| Certificates at no extra cost | Yes | Yes |
| Single sign-on with Entra ID identities | Yes, administrators sign in with the identities you already govern | Not covered |
| Automatic Entra ID application certificate rotation | Yes, app registration credentials replaced before they expire | Not covered |
| Azure Key Vault auto rotation | One-click creation and automatic renewal of HSM backed Key Vault certificates | Not covered |
| Azure IoT one-click integration | Yes, and it tells IoT Hub when a certificate is revoked | Not covered |
| Smart card integration | Yes, through EZCMS for smart card and FIDO2 onboarding | Not covered |
| Public CA integration | Yes, public certificates issued and renewed beside your private ones | Not covered |
| Bring your own AD CS certificate authority | Yes, put modern issuance in front of the CA you already run | Not covered |
| Built for Azure | Built for the Microsoft cloud from the ground up, in Azure Public, Government and GCC High | Not covered |
Feature rows from Keytos's own EJBCA comparison, last reviewed September 2026. Pricing from Keyfactor's AWS Marketplace listings for EJBCA SaaS, which is where the only public figures are.
Whether you are creating a CA for Intune SCEP, ACME for your internal sites, passwordless authentication, or automating public SSL certificate rotation, EZCA is the single tool that gets you to full crypto agility rather than another product to bolt on.
Creating a new certificate authority can be an intimidating process. Our team of PKI experts will be with you every step of the way. When you book your first EZCA demo, a PKI expert will join the call and guide you through the whole process. That same expert will then be available to answer any questions you have as you continue your PKI planning, ensuring you follow best practices.
While many legacy PKI vendors have modernized their solutions by modifying an on-premises product to run on the cloud, we built EZCA from the ground up to maximize the scalability and availability of the cloud, enabling us to offer a great experience at a fraction of the cost.
EZCA offers a range of plans designed to meet your security needs. Our Basic CA plan enables secure certificate issuance for most organizations, while our advanced plans offer additional features that can help you meet more stringent security requirements. These features include FIPS 140-3 Level 3 HSMs, private infrastructure options, bring your own infrastructure, and bring your own HSM options. Whether you are a small business or a large enterprise, EZCA has a plan that can meet your unique security needs.
EZCA is the only CA platform that is actually native to Azure, enabling easy PKI deployment for PIV authentication without standing up Windows Server VMs - much cleaner and easier to deploy.
Easy to use, with quick and knowledgeable support via chat and helpful documentation for third-party integrations. Setup required minimal effort, and the EZCA/EZRADIUS/Intune integration was key for CMMC compliance.
Ease of use and tight integration with Entra, supporting auto-renewal and hybrid CA integration.
Straightforward and well documented setup, highly reliable, vendor-agnostic approach, and a sensible pricing model based on Certificate Authorities rather than certificates issued.
Eliminates the need to stand up and maintain a traditional on-prem PKI/CA infrastructure for 802.1X, with fully automated certificate issuance and renewal through Intune SCEP integration.
Very easy to deploy, support chat includes AI assistance with a human fallback, and integration was seamless with a quick setup.
Keyfactor, which owns EJBCA, does not publish pricing on its own site. The public figures are its AWS Marketplace listings for EJBCA SaaS, where an entry level deployment is a 12-month contract of $64,000 for a KMS backed CA or $105,000 for a CloudHSM backed CA. Both listings note that AWS infrastructure costs are on top.
EZCA is $200 a month for a Basic CA, $2,400 a year, and that includes the infrastructure, the redundancy, the FIPS 140-3 HSM and the support. Nothing runs in your own subscription, so there is no second bill.
Basic and Premium cover most organizations, and you can work out what you would pay right now without talking to anyone. If you need fully isolated infrastructure, Private Infrastructure is listed with them, and if you want to run EZCA in your own environment there is a Self-Hosted Licensing plan too.
Basic
FIPS 140-3 HSM backed CAs with Azure IoT and Key Vault integration
Premium
Most popular ✦Higher throughput, public certificate management, and priority support
Private Infrastructure
Fully isolated infrastructure for your most critical workloads
If you need cloud RADIUS as well as cloud PKI, Keytos Shield bundles both for one low per-user price. EZCA and EZRADIUS can also be deployed independently if you only need one of them.
EZCA is the first cloud PKI designed for Azure, in Azure, by ex-Microsoft engineers, which makes it feel like an extension of the platform rather than something pointed at it. As a Microsoft partner we offer it in the Azure Marketplace, so you can set up a cloud PKI straight from the Azure portal.
EZCA offers plenty of automatic issuance protocols, including SCEP and ACME, but one of the most used features is one-click Azure Key Vault certificate creation and management. It lets you create and manage certificates following Azure best practices in an HSM backed key vault, and it fully automates certificate issuance in Azure.
As cloud services have multiplied, so have the identities protecting them, past the point where anyone can manage those credentials by hand. EZCA rotates Entra ID application certificates automatically, so app registration credentials are replaced before they expire rather than after something breaks.
IoT devices have become a must have for many businesses, and, as with most emerging technology, they have caught the attention of attackers. Most IoT attacks, from small targeted ones to large scale events like the Mirai botnet's attack on DNS infrastructure, share a weak device identity story. We have written guides on IoT identity security best practices, built a one-click integration with Azure IoT, and published code samples that get you a working prototype in days rather than months.
As a Microsoft security partner, we could not build an Azure based PKI without sending alerts and logs to Microsoft Sentinel. Every Keytos tool sends its security logs there, giving your SOC team a single pane of glass to monitor the infrastructure and spot anomalies.
Intune lets you manage your organization's devices without an on-premises domain. With EZCA you can create an Azure based certificate authority for Intune and issue SCEP certificates without the overhead of running AD CS and an Intune SCEP connector, and EZCA is on Microsoft's list of certificate authorities for Intune.
Keytos Shield combines cloud PKI, cloud RADIUS network authentication, and FIDO2 Passkey + Smart Card onboarding into a single platform built natively for Microsoft Entra ID and Intune.
EZCA replaces complex on-premises PKI with a cloud-native certificate authority built on Azure and backed by HSMs, giving you enterprise-grade security without the infrastructure burden.
EZRADIUS is the only Cloud RADIUS service built natively for Microsoft Entra ID and Intune, eliminating infrastructure overhead while delivering enterprise-grade security.
EZSSH removes the need to manage, rotate and remove SSH keys for all your users from all your hosts. No more keys in engineers' desktops waiting to be stolen by bad actors.
Get your workforce to phishing-resistant MFA faster with guided passwordless onboarding that works across all your existing Microsoft identity infrastructure.
EZMONITOR continuously scans your infrastructure for expiring TLS certificates and misconfigurations, alerting your team before an outage hits production.
For a Microsoft estate, yes. The two cover the same PKI ground: SCEP, ACME, OCSP, CRL, Intune and pay as you go billing with no per-certificate charge. EZCA then adds the Azure integrations EJBCA has no equivalent for, including Azure Key Vault certificate rotation, Entra ID application certificate rotation, Azure IoT Hub and Microsoft Sentinel.
EJBCA Community is open source and free to download, and if you have the PKI expertise in house to deploy, secure, patch and keep it available, that is a legitimate option. This page compares EJBCA SaaS, the hosted commercial edition, because that is the like-for-like against a managed service. The cost of Community is your team's time and the infrastructure it runs on, which is the same cost that makes people leave AD CS.
Keyfactor, which owns EJBCA, does not publish pricing on its own site. The public figures are its AWS Marketplace listings, where an entry level EJBCA SaaS deployment is a 12-month contract of $64,000 for a KMS backed CA or $105,000 for a CloudHSM backed CA, and both note that AWS infrastructure costs are on top. EZCA publishes every price: a Basic CA is $200 a month, infrastructure included.
Yes. EZCA is on Microsoft's list of third-party certification authority partners for Intune, so certificates go out through the SCEP profiles you already use. EJBCA is on that list as well, so this is common ground rather than a difference.
Yes. EZCA can bring your own certificate authority, connecting to the AD CS you already run, so you can put modern issuance and automation in front of the CA you have before deciding whether to retire it.
Yes. EZCA runs in Azure Public, Azure Government and Azure GCC High environments, and the full Keytos toolset is available to GCC High customers.
No annual enterprise contract. No infrastructure bill of your own. No per-certificate fees. Just a published price per certificate authority, and cancel anytime.
