EZCA

EZCA is a cloud PKI service for operating and scaling certificate authorities without running the PKI infrastructure yourself. It issues certificates through ACME, EST and SCEP, and provides APIs for applications and workflows. Certificate use cases include users, devices, applications, Wi-Fi, VPN, web services and IoT; it also supports certificate-based authentication for Azure IoT Hub and Azure IoT Central. Integrations include Azure, Entra ID, Intune, Azure Key Vault and Azure applications, while Intune and Jamf are supported for device certificates. EZCA can connect to an existing on-premises CA or bring an AD CS CA into a cloud setup. The maker says its CAs are HSM-backed, with Basic using FIPS 140-3 Level 2 HSMs and Premium Level 3. CA changes, certificate requests and approvals are logged for export to a preferred SIEM, and revocation checks use CRLs and OCSP. Pricing starts at $200/mo; there is no free plan, but a 30-day trial is listed. Plans vary by capacity, support and infrastructure options.

EZCA offers certificate issuance, integrations and infrastructure choices for cloud PKI deployments. Buyers should compare plan capacity, support and isolation options, as pricing is tied to certificate authority or location.

EZCA may suit organizations managing certificates across users, devices, applications or IoT, particularly those using Azure integrations or an existing CA. It is intended for teams seeking a cloud PKI service rather than operating PKI infrastructure themselves.

EZCA is a managed cloud PKI service for organizations that need certificate authorities without maintaining the underlying infrastructure. It suits Azure-focused teams with mixed device, application, and IoT certificate needs, especially when an existing CA must be carried into a cloud deployment. The main trade-off is that both price and throughput are tied to the number of certificate authorities and deployment locations.

Overview

EZCA uses a hybrid deployment model and covers certificates for users, devices, applications, Wi-Fi, VPN, web services, and IoT. ACME, EST, and SCEP provide the principal enrollment paths, while APIs connect certificate issuance to applications and workflows. There is no stated certificate-count ceiling, but each plan imposes a processing rate per CA, so large bursts of issuance or OCSP traffic still require capacity planning.

Teams can chain the service to an on-premises certificate authority or bring an existing AD CS CA into the cloud arrangement. That makes EZCA a practical migration option for organizations that want managed infrastructure without discarding an established PKI hierarchy.

Key features

Azure and endpoint integration

Integrations include Azure, Entra ID, Intune, Azure Key Vault, and Azure applications. Intune and Jamf support device certificates, extending coverage to managed endpoints. For connected-device deployments, EZCA supports certificate authentication with Azure IoT Hub and Azure IoT Central. This combination is most compelling for Microsoft-centered environments; teams outside that ecosystem should verify that its integrations justify the service's per-CA cost.

Security and operations

Certificate authorities use hardware security modules. Basic uses FIPS 140-3 Level 2 HSMs, while Premium uses Level 3, giving security-conscious buyers a clear upgrade path. CA changes, certificate requests, and approvals are logged and exportable to a preferred SIEM, which supports audit workflows. CRL and OCSP checking provide standard revocation mechanisms.

Pricing

EZCA has no free plan and starts at $200 per month, with a 30-day trial. Pricing is charged per CA on the managed plans or per location on infrastructure plans, rather than by certificate count.

Basic is the sensible entry point for modest CA traffic and standard support, but its one-per-second rate can constrain busy enrollment or revocation-checking workloads. Premium costs 2.5 times more per CA and is aimed at higher demand, stronger HSM protection, public CA management, and tighter availability commitments. Private Infrastructure is for organizations that require isolation and rapid support; Self-Hosted Licensing adds unlimited CAs and self-healing Azure PaaS services at a lower location-based price than Private Infrastructure, but the infrastructure-plan economics depend on how many CAs and locations you operate.

Platforms

EZCA supports Android, iOS, Linux, macOS, Windows, web, API, and self-hosted deployments. That range fits organizations issuing certificates across employee devices, servers, applications, and connected equipment rather than a single endpoint type.

Who it's for

Choose EZCA when Azure, Entra ID, Intune, Key Vault, or Azure IoT is already central to your environment, or when you need managed CA infrastructure with ACME, EST, and SCEP enrollment. Its existing-CA and AD CS options also suit phased cloud transitions. It is less suitable for a small deployment that needs only occasional certificates, because every managed CA carries a monthly charge and Basic has limited per-second throughput.

Pros and cons

• Pro: Azure, Intune, Jamf, and IoT integrations cover a broad Microsoft-oriented certificate estate.
• Pro: ACME, EST, SCEP, APIs, and existing-CA chaining support varied enrollment and migration requirements.
• Pro: HSM-backed tiers, SIEM export, CRL, and OCSP provide concrete security and audit controls.
• Con: Managed plans bill per CA, so organizations with many authorities can see costs rise even without a certificate-count limit.
• Con: Basic's one certificate or OCSP response per CA per second may be insufficient for high-volume environments.
• Con: There is no free plan, and Premium or isolated infrastructure requires a substantial step up in monthly spend.

Alternatives

Entrust Certificate Manager is a paid option with Android, iOS, Linux, self-hosted, web, and API support; choose it when you prefer an Entrust-managed deployment and are prepared to request a quote.

KeyTalk CKMS offers a €5.00-per-user-per-month S/MIME on-premise plan for up to 250 participants, making it a better fit for a smaller, user-focused S/MIME rollout.

SecureW2 Cloud NAC is a paid, quote-based alternative for teams evaluating certificate-backed network access across major desktop and mobile platforms.

Smallstep ZTNA is a paid enterprise relay with pricing supplied through a demo request, suited to buyers considering that product's deployment model instead.

Microsoft Cloud PKI costs $2 a month on a paid yearly subscription with auto-renewal, making it worth considering for organizations seeking a lower-cost Microsoft certificate lifecycle service.

EJBCA, OpenCA PKI, and OpenXPKI are free options for teams willing to run open-source PKI software themselves rather than pay for EZCA's managed infrastructure.

Browse more options in Public Key Infrastructure Software.

Verdict

EZCA is a strong choice for Azure-centered organizations that need managed certificate authorities, broad enrollment protocols, and a path from existing PKI to cloud infrastructure. Choose it for its integrations, HSM-backed tiers, and operational support; look elsewhere if per-CA charges, Basic's throughput, or the absence of a free plan conflicts with your scale or budget.