Solutions
Cloud PKI, cloud RADIUS, passwordless onboarding, all in one platform.
Cloud PKI for Azure, Intune, and Entra ID
The best cloud RADIUS for Microsoft environments
Entra ID authentication to SSH endpoints
Passwordless security key and smart card onboarding for Entra ID
Eliminate SSL certificate outages and vulnerabilities
Blog
Partner
Your trusted partner for passwordless security
Join our global partner network
Learn how Keytos EZCA makes cloud PKI easy and affordable.
1,200+
Global organizations
trust Keytos
45M+
RADIUS authentications
per month in EZRADIUS
7.3M+
Digital identities
created per month
20+
Deployment regions
around the globe
Are you looking for a Keyfactor alternative? You have come to the right place! Keytos has been leading the cryptography and PKI space in Azure for the past few years by creating cloud native PKI and passwordless SSH solutions that help organizations scale and protect their cloud.
One of the main reasons many Azure customers, from Fortune 500 companies to small startups, choose Keytos and EZCA as their Azure certificate authority is our native integrations with Azure services, making it easy to create your PKIaaS in Azure and set it and forget it. EZCA then takes care of all the certificate management operations on its own. EZCA gained popularity in the IoT space thanks to its guides that take you through the whole process of creating certificates for Azure IoT, from IoT security best practices to step by step guides for certificate authentication in Azure IoT Hub, as well as our easy to use APIs and NuGet package, making IoT certificate issuance and management as easy as possible.
The same PKI ground, plus the Azure integrations and the passwordless tooling, at a published price.
| Capability | |
Keyfactor |
|---|---|---|
| Pricing | $200 per CA per month, infrastructure included | EJBCA SaaS from $105,000 a year, entry level |
| Intune SCEP connection | Yes | Yes |
| ACME support | Yes | Yes |
| SOC 2 and ISO 27001 compliant | Yes | Yes |
| Public CA certificate management | Yes | Yes |
| Bring your own infrastructure | Yes, including bring your own HSM | Yes |
| SSH certificates | Yes, through EZSSH | Yes |
| Cloud platform | Built for Azure from the ground up, in Azure Public, Government and GCC High | EJBCA SaaS is delivered on AWS |
| Azure IoT Hub integration | One-click, and it tells IoT Hub when a certificate is revoked | Not covered |
| Azure Key Vault certificate rotation | One-click creation and automatic renewal of HSM backed Key Vault certificates | Not covered |
| Entra ID application certificate rotation | Yes, app registration credentials rotated before they expire | Not covered |
| SSH access management | EZSSH grants access per session against Entra ID, with no standing keys | Manages SSH keys, not just-in-time access to the endpoints |
| FIDO2 and smart card management | EZCMS sources, ships, onboards and manages the keys end to end | Not covered |
| Cloud RADIUS | EZRADIUS, with real-time Entra ID and Intune checks | Not covered |
| Microsoft Sentinel integration | Every Keytos tool sends its security logs to Sentinel | Not covered |
Comparison based on publicly available Keyfactor documentation and its AWS Marketplace listings as of September 2026.
While ease of use and quick setup are important factors for a PKI solution, ensuring security and compliance is paramount. Keytos is a globally trusted security solution provider that prioritizes security by adopting industry-leading measures to secure our infrastructure. Our team of experts constantly monitors and updates our systems to ensure that they meet the highest security standards. Additionally, our SaaS offerings' high availability SLA allows your team to focus on other pressing security issues while your CAs are automatically updated and secured.
Creating a new certificate authority can be an intimidating process. Our team of PKI experts will be with you every step of the way. When you book your first EZCA demo, an ex-Microsoft PKI expert will join the call and guide you through the whole process. That same expert will then be available to answer any questions you have as you continue your PKI planning, ensuring you follow best practices.
While many legacy PKI vendors have modernized their solutions by modifying an on-premises product to run on the cloud, we built EZCA from the ground up to maximize the scalability and availability of the cloud, enabling us to offer a great experience at a fraction of the cost.
Cloud certificates, RADIUS authentication, FIDO2 and smart card management, and SSH access management all come from the same place, share the same Entra ID integration, and send their logs to the same Sentinel workspace. That is one contract, one support relationship, and one set of access policies rather than a PKI product bolted to three others.
EZCA is the only CA platform that is actually native to Azure, enabling easy PKI deployment for PIV authentication without standing up Windows Server VMs - much cleaner and easier to deploy.
Easy to use, with quick and knowledgeable support via chat and helpful documentation for third-party integrations. Setup required minimal effort, and the EZCA/EZRADIUS/Intune integration was key for CMMC compliance.
Ease of use and tight integration with Entra, supporting auto-renewal and hybrid CA integration.
Straightforward and well documented setup, highly reliable, vendor-agnostic approach, and a sensible pricing model based on Certificate Authorities rather than certificates issued.
Eliminates the need to stand up and maintain a traditional on-prem PKI/CA infrastructure for 802.1X, with fully automated certificate issuance and renewal through Intune SCEP integration.
Very easy to deploy, support chat includes AI assistance with a human fallback, and integration was seamless with a quick setup.
Keyfactor does not publish pricing on its own site. The public figures are its AWS Marketplace listings for EJBCA SaaS, where an entry level deployment is a 12-month contract of $64,000 for a KMS backed CA or $105,000 for a CloudHSM backed CA. Both listings note that AWS infrastructure costs are on top.
EZCA is $200 a month for a Basic CA, $2,400 a year, and that includes the infrastructure, the redundancy, the FIPS 140-3 HSM and the support. Nothing runs in your own subscription, so there is no second bill.
Basic and Premium cover most organizations, and you can work out what you would pay right now without talking to anyone. If you need fully isolated infrastructure, Private Infrastructure is listed with them, and if you want to run EZCA in your own environment there is a Self-Hosted Licensing plan as well, with its price published too.
Basic
FIPS 140-3 HSM backed CAs with Azure IoT and Key Vault integration
Premium
Most popular ✦Higher throughput, public certificate management, and priority support
Private Infrastructure
Fully isolated infrastructure for your most critical workloads
SSH is priced separately and just as plainly: EZSSH starts at $3 per user per month and includes access management, not just certificate issuance. Keytos Shield bundles cloud PKI and cloud RADIUS for one low per-user price.
When you are building an IoT application, you do not want to spend your time running a secure and scalable certificate authority. That is why we built our one-click integration with Azure IoT. It lets you create a certificate authority and connect it to your Azure IoT Hub in minutes, and it notifies IoT Hub when a certificate is revoked, so you can spend your time where it matters. We have also written a guide on IoT identity security best practices.
EZCA offers plenty of automatic issuance protocols, including SCEP and ACME, but one of the most used features is one-click Azure Key Vault certificate creation and management. It lets you create and manage certificates following Azure best practices in an HSM backed key vault, and it fully automates certificate issuance in Azure.
SCEP is the most popular way for IT teams to issue certificates to managed devices, and EZCA's SCEP feature gets certificates onto yours in minutes. Its easy setup and management put it on Microsoft's list of certificate authorities for Intune, and with our self-service user certificate feature, even users on unmanaged devices can get certificates.
Keytos also lets you source, manage and ship your hardware keys and smart cards. EZCMS is the only credential management system that can onboard FIDO2 keys to Entra ID's native FIDO2 solution, and our key attestation technology and government ID matching make it safe to onboard a remote workforce from anywhere in the world.
EZSSH was the first SSH access management tool to give you just in time access to your SSH endpoints with your Entra ID account, without a high privilege agent and without a network connection to the endpoints. That means your existing access policies, RBAC and conditional access included, apply to SSH, using cryptographic certificates native to the SSH protocol.
As a Microsoft security partner, we could not build Azure based solutions without sending alerts and logs to Microsoft Sentinel. Every Keytos tool sends its security logs there, giving your SOC team a single pane of glass to monitor the infrastructure and spot anomalies.
Keytos Shield combines cloud PKI, cloud RADIUS network authentication, and FIDO2 Passkey + Smart Card onboarding into a single platform built natively for Microsoft Entra ID and Intune.
EZCA replaces complex on-premises PKI with a cloud-native certificate authority built on Azure and backed by HSMs, giving you enterprise-grade security without the infrastructure burden.
EZRADIUS is the only Cloud RADIUS service built natively for Microsoft Entra ID and Intune, eliminating infrastructure overhead while delivering enterprise-grade security.
EZSSH removes the need to manage, rotate and remove SSH keys for all your users from all your hosts. No more keys in engineers' desktops waiting to be stolen by bad actors.
Get your workforce to phishing-resistant MFA faster with guided passwordless onboarding that works across all your existing Microsoft identity infrastructure.
EZMONITOR continuously scans your infrastructure for expiring TLS certificates and misconfigurations, alerting your team before an outage hits production.
For a Microsoft estate, yes. EZCA covers the certificate authority work with SCEP, ACME, EST, OCSP and CRL, and EZSSH and EZCMS cover the SSH and credential management that would otherwise need Keyfactor Command. Keyfactor also sells code signing and cryptographic posture management, so check whether you rely on those before planning a cutover.
Keyfactor does not publish pricing on its own site. The public figures are its AWS Marketplace listings for EJBCA SaaS, where an entry level deployment is a 12-month contract of $64,000 for a KMS backed CA or $105,000 for a CloudHSM backed CA, and both note that AWS infrastructure costs are extra. EZCA publishes every price: a Basic CA is $200 a month, infrastructure included.
Yes. EZCA is on Microsoft's list of third-party certification authority partners for Intune, so certificates go out through the SCEP profiles you already use. Keyfactor Command and EJBCA are on that list as well, so this is common ground rather than a difference.
Not quite, and the difference is the point. Keyfactor discovers and manages SSH keys. EZSSH issues short-lived SSH certificates and controls who may use them, so access is granted just in time against your Entra ID account, with your existing RBAC and conditional access policies applying, and no standing keys left on the endpoint to manage.
That is what it was built for. Beyond Intune SCEP certificates, EZCA issues domain controller certificates for Hybrid Key Trust Windows Hello for Business, internal SSL certificates for sites and service to service authentication, and smart card certificates, so the scenarios that keep an AD CS server alive are covered without the server.
Yes. The Keytos toolset runs in Azure Public, Azure Government and Azure GCC High environments, and the full toolset is available to GCC High customers.
No annual enterprise contract. No infrastructure bill of your own. No hidden fees. Just a published price per certificate authority, and cancel anytime.
