KeyTalk CKMS

KeyTalk CKMS automates PKI implementation and the enrollment, distribution, and management of digital certificates. It keeps certificates and keys in a central repository, supports automated or semi-automated deployment and renewal, and provides reporting, notifications, and alerts. Smart Security Scan can find certificates and keys across a network, with valid findings available for import. CKMS includes a private certificate authority that can operate beneath an existing root CA or as a standalone root. Listed integrations and protocols include DigiCert, DigiCert QuoVadis, GlobalSign, Microsoft CA, Intune, MobileIron, load balancers, HSMs, Citrix, SCEP, and ACME. Access controls include AD and Entra ID authorization, multifactor authentication, and role-based permissions using security groups. Customers can deploy it as a virtual machine on their infrastructure or private cloud, or use KeyTalk-managed PKI as a service. The product supports Android, iOS, Linux, macOS, Windows, and self-hosted environments. CKMS pricing is available on request, and a free trial is offered. Separate S/MIME services have listed per-user monthly prices.

KeyTalk CKMS brings certificate discovery, lifecycle workflows, access controls, and multiple deployment approaches into one platform. Its price is available on request, so organizations should seek a quote to assess fit.

CKMS may suit businesses and managed service providers that need certificate lifecycle management, network discovery, and deployment choices. Its multi-tenant features are intended for providers serving customers.

Overview

KeyTalk CKMS is a certificate management platform that automates PKI implementation and digital certificate enrollment, delivery, and upkeep. It is best suited to organizations managing certificates across their own infrastructure or customer environments. Its breadth of discovery, lifecycle workflows, and deployment options makes it a strong fit for complex certificate operations, while custom pricing means buyers need a quote to assess the full platform.

Key features

CKMS brings certificates and keys into a central repository, with automated or semi-automated deployment and renewal, plus reporting, notifications, and alerts. Smart Security Scan finds certificates and keys across a network and allows valid results to be imported, helping teams bring existing assets into managed workflows.

Its integrations and supported protocols include DigiCert, DigiCert QuoVadis, GlobalSign, Microsoft CA, Intune, MobileIron, load balancers, HSMs, Citrix, SCEP, and ACME. That range can connect certificate work to existing systems, though organizations should verify support for the specific products they rely on.

The included private CA can operate beneath an existing root CA or as a standalone root. Access controls include authorization through AD and Entra ID, multifactor authentication, and role-based permissions tied to security groups. Asymmetric keys can be stored in an AES256-encrypted management database or a linked HSM. KeyTalk also says CKMS can issue certificates with a lifespan as short as one second when the target CA supports it, giving organizations flexibility for short-lived credentials without guaranteeing that every CA can provide them.

CKMS is available as a virtual machine for customer infrastructure, in private cloud environments such as AWS, Azure, and Google Cloud, or as KeyTalk-managed PKI as a service. The S/MIME service is separate in scope: it supports on-premise installation or hosted SaaS and includes a GlobalSign or DigiCert certificate; the hosted service also includes an HSM.

Pricing

CKMS is a paid product with custom pricing, and a free trial is available. Organizations evaluating the broader platform should request a quote. KeyTalk separately publishes two per-user S/MIME plans, both with automatic renewal:

• S/MIME on-premise: €5 a month, billed per user per month. It supports up to 250 participants across multiple devices, with staggered discounts for larger organizations.
• S/MIME hosted SaaS: €6.50 a month, billed per user per month, for up to 250 participants. The hosted option includes an HSM; the stated plan does not include the multiple-device detail or larger-organization discount terms of the on-premise offer.

Both S/MIME plans have a 250-participant ceiling, so larger deployments should clarify available terms with KeyTalk. The lower-priced on-premise plan requires customer-side installation; hosted SaaS costs more and includes an HSM.

Platforms

KeyTalk lists Android, iOS, Linux, macOS, Windows, and self-hosted availability. Deployment can run on customer infrastructure, in a private cloud, or as a managed service. KeyTalk says it provides 24/7 customer support.

Who it's for

CKMS is a strong candidate for organizations that need to discover and manage certificates across varied infrastructure, use a private CA, or choose between self-managed and KeyTalk-managed deployment. Its multi-tenant features also suit managed service providers and businesses serving customers. Teams seeking only a straightforward S/MIME service may prefer to compare the two per-user offerings directly; buyers who need a fixed price for the complete CKMS platform will need to establish scope through a quote.

Pros and cons

• Pros: Network discovery can surface certificates and keys for import, helping teams address existing assets as well as new issuance.
• Pros: Deployment spans customer infrastructure, major private clouds, and KeyTalk-managed service, giving organizations a choice about operational responsibility.
• Pros: Private CA options, access controls, and HSM integration cover core PKI administration and key protection needs.
• Cons: The full CKMS platform uses custom pricing, which makes direct budget comparisons harder before a quote.
• Cons: The published S/MIME plans are capped at 250 participants, limiting their fit for larger groups unless different terms are arranged.
• Cons: Very short certificate lifespans depend on support from the target CA, so that capability is not universal.

Alternatives

Certificate Management Software and Public Key Infrastructure Software are useful starting points for comparing products in these categories.

• Entrust Certificate Manager is a paid option for organizations looking for certificate management across mobile, Linux, API, web, and self-hosted platforms; its pricing requires a conversation with Entrust.
• Smallstep ZTNA may suit teams seeking an enterprise relay across iOS, Linux, macOS, self-hosted, and Windows environments; pricing is provided by demo request.
• Microsoft Cloud PKI is worth considering for organizations that want automated certificate lifecycle management on Android, iOS, macOS, or Windows, at $2 a month billed yearly with auto-renewal.
• Certify The Web offers a free evaluation with no feature limitations and no time limit, making it a useful option for buyers who want to assess a free certificate-management tool before paying.
• GeoTrust may fit teams focused on SSL monitoring or certificate-related tools, with an SSL Monitor plan at $2 a month per standard domain and volume pricing also offered.
• lego is a free, open-source choice for teams seeking a project that runs across API, Linux, macOS, or self-hosted environments.
• Oracle Cloud Infrastructure Secret Management is a free option for managing secrets in Oracle Cloud Infrastructure, with stated tenancy and version limits.
• Qualys External Attack Surface Management provides a 30-day no-cost trial of its CyberSecurity Asset Management offering with external attack surface management.

Verdict

Choose KeyTalk CKMS if your organization needs certificate discovery, lifecycle automation, private CA capabilities, and a choice of self-managed or managed deployment, particularly across multiple customer environments. Its main advantage is the breadth of certificate operations it brings together; its main drawback is that the full platform requires custom pricing, while the clearly priced S/MIME plans stop at 250 participants. If a fixed, readily comparable price is essential, start with alternatives that publish a rate or offer a free tier.