DuoKey

PKI and Certificate Lifecycle Management

DuoKey vs DigiCert

DigiCert sells DigiCert ONE, a platform combining Trust Lifecycle Manager, Private CA, Software Trust Manager and Device Trust Manager, delivered from DigiCert's cloud, on premises, hybrid or air-gapped. DuoKey is a Swiss PKI and certificate lifecycle platform: private CAs, ACME, EST, SCEP and CMP, discovery, deployment with rollback, post-quantum certificates and a tamper-evident audit trail, operated by DuoKey or on your premises.

DuoKey

21 / 32

DigiCert

23 / 32

Compared capabilities supported, based on public documentation.

Book a call→See the comparison

Only DuoKey

  • Adjacent PKI services
  • Post-quantum certificates (ML-DSA, SLH-DSA, hybrid/composite)
  • Tamper-evident (signed / hash-chained) audit log
  • SIEM integration
  • High availability / disaster recovery

Feature by feature

DuoKey and DigiCert, side by side

CapabilityDuoKeyDigiCert

CA and issuance

1Private CA hierarchy

Run own root/intermediate CAs with lifecycle controls

YesRoot, intermediate, imported CAs; cascade revokeSource
YesRoot and intermediate CAsSource

2Public / external CA brokering

Order and renew public or cloud CA certificates (Let's Encrypt, DigiCert, Sectigo, AWS PCA, ADCS...) from one console

YesLet's Encrypt, DigiCert, Sectigo, AWS, Azure, GCP, ADCSSource
YesAWS PCA, Entrust, Let's Encrypt, Microsoft, SectigoSource

3Revocation

CRL and OCSP for relying parties

YesPer-CA OCSP and CRLSource
YesFull and delta CRL, OCSPSource

4Adjacent PKI services

SSH CA and/or RFC 3161 timestamping

YesSSH CA, RFC 3161 timestampingSource
PartialRFC 3161 TSA; no SSH CASource

Enrollment

5ACME (RFC 8555)

YesPer-CA ACME directorySource
YesACME incl. third-party clientsSource

6EST (RFC 7030)

YesIncl. serverkeygen, csrattrsSource
YesESTSource

7SCEP (RFC 8894)

YesConfigurable SCEP profilesSource
YesSCEP incl. iOS directSource

8CMPv2 (RFC 4210/9483)

YesCMP incl. lightweight profileSource
YesCMP / CMPv2Source

9Microsoft autoenrollment (GPO / WCCE / MS-XCEP)

Not documentedNo Windows autoenrollmentSource
YesDigiCert Autoenrollment Server for ADSource

10Intune / MDM certificate delivery

PartialIntune delivery for S/MIME onlySource
YesIntune SCEP integrationSource

11Kubernetes cert-manager issuer

YesVia ACME issuer, verified end to endSource
YesDigiCert Issuer for cert-managerSource

Visibility and automation

12Certificate discovery (network scan and/or agents)

YesNetwork scanners and agentsSource
YesNetwork, cloud, endpoint, CT logs (marketing)Source

13Central inventory with policy / compliance checks

YesMozilla/NIST/PCI checks, ServiceNow CMDBSource
YesInventory and policy alerts (marketing)Source

14Automated renewal and redeployment

PartialACME client-driven renewal documentedSource
YesAuto-renew and redeploySource

15Expiry alerting

PartialGeneric webhook and email alertingSource
YesExpiry alertsSource

16Push deployment to endpoints (load balancers, firewalls, web servers, Windows) with rollback

YesF5, FortiGate, Azure, IIS, Nginx, JKS + rollbackSource
YesF5 push with fallback, agentsSource

17Short-lived certificates / 47-day TLS readiness at scale

PartialDay-level validity and ACMESource
Partial47-day trend described; no scale specSource

Key protection

18HSM-protected CA keys (non-exportable)

PartialVault-backed; HSM path for PQC CAsSource
YesFIPS 140-2 Level 3 HSMsSource

19CA keys split with MPC / threshold (never whole in one place)

Not documentedNot documented for CA keys
Not documented

20Post-quantum certificates (ML-DSA, SLH-DSA, hybrid/composite)

YesML-DSA, SLH-DSA, ML-DSA-65+P256 compositeSource
PartialML-DSA, SLH-DSA (draft); no compositeSource

Use cases

21S/MIME with key escrow and recovery

YesEscrow and recovery, Intune deliverySource
YesCloud key escrow and recoverySource

22Code signing service

PartialCode-signing certificatesSource
YesSoftware Trust Manager, HSM-backedSource

23IoT / device identity at scale

Not documentedNo published scale figuresSource
YesDevice Trust Manager, in-factorySource

Governance

24Granular RBAC

YesHierarchical PKI permissionsSource
YesRole-based accessSource

25Approval workflow / M-of-N quorum for sensitive PKI operations

PartialApprover workflow; quorum for S/MIME recoverySource
PartialSigning approvals; no M-of-NSource

26Context-based (IP, location, time) policy on CA / PKI operations

Not documentedAccess policies not bound to CAsSource
Not documentedIP limits on CertCentral onlySource

27Tamper-evident (signed / hash-chained) audit log

YesHMAC-SHA256 plus hash chainSource
Not documentedAudit logs; no signing or chainingSource

28SIEM integration

YesSplunk, syslog, ElasticSource
PartialThird-party Splunk add-on onlySource

Deployment and vendor

29SaaS and on-premises options

YesDuoKey-hosted or on-premisesSource
YesCloud, on-prem, hybrid, air-gappedSource

30High availability / disaster recovery

YesStateless API nodes, replicasSource
Partial99.99% SaaS SLA; customer HA not publicSource

3124/7 support with SLA response times

Yes24/7 on Platinum, 1-hour criticalSource
YesPremium: Sev1 15-minute responseSource

32Vendor certifications (ISO 27001, SOC 2, WebTrust / eIDAS QTSP, Common Criteria)

YesISO 27001, SOC 2, TISAX AL3Source
YesWebTrust, SOC 2, ETSI QTSP, ZertESSource

Why teams choose DuoKey

Key differences with DigiCert

01

Tamper-evident audit

DigiCert ONE provides platform and product audit logs to filter and export; no signing or hash chaining is documented. DuoKey signs every audit record with HMAC-SHA256 and chains it with SHA-256, so any edit or deletion is detectable.

02

Native SIEM forwarding

DigiCert ONE's documented Splunk path is a third-party, developer-supported add-on. DuoKey forwards audit events natively to Splunk, syslog and Elastic.

03

SSH CA and composite certificates included

DigiCert documents an RFC 3161 timestamping service but no SSH certificate authority, and its PQC support covers ML-DSA and SLH-DSA without composite certificates. DuoKey includes an SSH CA, RFC 3161 timestamping and a hybrid ML-DSA-65 + ECDSA-P256 composite.

04

Swiss jurisdiction

DigiCert is a US company and its PQC-enabled HSM is available in US data centres only. DuoKey SA is a Swiss company and operates its service under Swiss law, or runs entirely on your premises.

What DigiCert does well

DigiCert ONE is one of the most complete platforms: ACME, EST, SCEP, CMP, AD autoenrollment, Intune and cert-manager, connectors to third-party CAs, FIPS 140-2 Level 3 HSMs, shipping PQC certificates, code signing, IoT and S/MIME escrow. DigiCert is a publicly trusted CA with WebTrust, SOC 2 Type II, EU qualified and Swiss ZertES status, and a 99.99% uptime SLA.

FAQ

Is DuoKey an alternative to DigiCert for PKI and certificate lifecycle management?

Yes. DuoKey provides private CAs, brokering of public and cloud CAs, ACME, EST, SCEP and CMP, discovery, deployment with rollback and post-quantum certificates, operated by DuoKey or on your premises.

Can I keep DigiCert and add DuoKey?

Yes. DuoKey can front existing CAs as issuers (Microsoft AD CS through NDES, DigiCert, Sectigo, Let's Encrypt, AWS, Azure, Google) while centralising inventory and deployment.

How were these criteria chosen?

They follow the sections of a PKI and certificate lifecycle RFP: issuance, enrollment protocols, visibility and automation, key protection, use cases, governance and deployment. Every cell links to the public document it is based on.

Evidence

Every claim on this page, sourced

DigiCert

  1. [1]www.digicert.comcriteria 1, 18, 29https://www.digicert.com/private-ca
  2. [2]docs.digicert.comcriteria 2https://docs.digicert.com/en/trust-architecture-playbook/issuance-pillar/ca-connectors-and-third-party-issuance.html
  3. [3]docs.digicert.comcriteria 3https://docs.digicert.com/de/digicert-private-ca/set-up-a-private-ca/set-default-ocsp--crl--aia-issuer--and-certificate-policies.html
  4. [4]knowledge.digicert.comcriteria 4https://knowledge.digicert.com/general-information/rfc3161-compliant-time-stamp-authority-server
  5. [5]docs.digicert.comcriteria 5, 6, 7, 8, 9https://docs.digicert.com/en/trust-lifecycle-manager/define-policies-to-ensure-compliance/certificate-profiles/enrollment-and-authentication-methods.html
  6. [6]docs.digicert.comcriteria 10https://docs.digicert.com/en/trust-lifecycle-manager/integration-guides/intune-scep-integration/introduction.html
  7. [7]docs.digicert.comcriteria 11https://docs.digicert.com/it/digicert-private-ca/private-ca-integrations/integrate-cert-manager-with-private-ca.html
  8. [8]www.digicert.comcriteria 12, 13, 14, 15, 24https://www.digicert.com/trust-lifecycle-manager
  9. [9]www.digicert.comcriteria 16https://www.digicert.com/content/dam/digicert/pdfs/integrations/f5/digicert-integration-solution-brief-f5-en.pdf
  10. [10]www.digicert.comcriteria 17https://www.digicert.com/solutions/security-solutions-for-automation
  11. [11]docs.digicert.comcriteria 20https://docs.digicert.com/en/digicert-private-ca/use-post-quantum-cryptography.html
  12. [12]docs.digicert.comcriteria 21https://docs.digicert.com/en/trust-lifecycle-manager/enroll-and-manage-certificates/digicert-trust-assistant/digicert-trust-assistant-admin-guide/create-certificate-profile-with-digicert-trust-assistant/manual-and-auto-key-recovery.html
  13. [13]www.digicert.comcriteria 22, 25https://www.digicert.com/software-trust-manager
  14. [14]www.digicert.comcriteria 23https://www.digicert.com/device-trust-manager
  15. [15]docs.digicert.comcriteria 26https://docs.digicert.com/en/certcentral/secure-your-certcentral-account/restrict-account-access-by-ip-address-ranges.html
  16. [16]docs.digicert.comcriteria 27https://docs.digicert.com/en/platform-overview/understand-the-digicert-one-platform/understand-audit-logs.html
  17. [17]splunkbase.splunk.comcriteria 28https://splunkbase.splunk.com/app/7816
  18. [18]www.digicert.comcriteria 30, 31https://www.digicert.com/service-level-agreement
  19. [19]www.digicert.comcriteria 32https://www.digicert.com/webtrust-audits

DuoKey

  1. [1]docs.duokey.comcriteria 1, 2, 3, 8, 13, 16, 18, 20https://docs.duokey.com/docs/pki-ssl/overview#core-capabilities
  2. [2]docs.duokey.comcriteria 4https://docs.duokey.com/docs/cockpit/ssh-certificate-authority#what-is-an-ssh-certificate-authority
  3. [3]docs.duokey.comcriteria 5https://docs.duokey.com/docs/developer/pki-api#acme-rfc-8555
  4. [4]docs.duokey.comcriteria 6, 23https://docs.duokey.com/docs/pki-ssl/enrollment-protocols#est-rfc-7030
  5. [5]docs.duokey.comcriteria 7https://docs.duokey.com/docs/pki-ssl/enrollment-protocols#scep-rfc-8894
  6. [6]docs.duokey.comcriteria 9https://docs.duokey.com/docs/pki-ssl/issuers/adcs-ndes#overview
  7. [7]docs.duokey.comcriteria 10, 21https://docs.duokey.com/docs/cockpit/release-notes#205-206
  8. [8]docs.duokey.comcriteria 11, 14https://docs.duokey.com/docs/pki-ssl/enrollment-protocols#using-acme-with-kubernetes-cert-manager
  9. [9]docs.duokey.comcriteria 12https://docs.duokey.com/docs/developer/pki-api#discovery-compliance
  10. [10]docs.duokey.comcriteria 15, 28https://docs.duokey.com/docs/cockpit/deployment#observability
  11. [11]docs.duokey.comcriteria 17, 22https://docs.duokey.com/docs/pki-ssl/operations/create-certificate#phase-1-create-the-request
  12. [12]docs.duokey.comcriteria 24https://docs.duokey.com/docs/developer/pki-api#certificates-requests
  13. [13]docs.duokey.comcriteria 25https://docs.duokey.com/docs/pki-ssl/getting-started#the-certificate-lifecycle
  14. [14]docs.duokey.comcriteria 26https://docs.duokey.com/docs/developer/administration-api#access-policies
  15. [15]docs.duokey.comcriteria 27https://docs.duokey.com/docs/cockpit/security#tamper-evident-audit
  16. [16]docs.duokey.comcriteria 29https://docs.duokey.com/docs/openshift-on-prem/vm-deployment
  17. [17]docs.duokey.comcriteria 30https://docs.duokey.com/docs/cockpit/deployment#high-availability-and-resilience
  18. [18]docs.duokey.comcriteria 31https://docs.duokey.com/docs/why-mpc
  19. [19]duokey.comcriteria 32https://duokey.com/en/compliance/iso-27001

Discuss the decisions that matter most to your security programme.

Tell us where control is difficult today. We will help you identify a practical next step.

Book a callSee the platform