How to choose the best PKI solution in 2026: private CA, CLM, ACME/EST/SCEP/CMP, 47-day readiness, HSM, PQC. AD CS, DigiCert, Keyfactor, Evertrust, DuoKey.
There is no single best PKI solution in 2026; the best one is the one that fits your estate. A good PKI solution runs your private certificate authority (CA) with keys held in hardware, issues certificates through the enrollment protocols your systems actually speak (ACME, EST, SCEP, CMP, Windows autoenrollment), finds and renews every certificate automatically, and leaves an audit trail you can defend. Microsoft AD CS, DigiCert ONE, Keyfactor, Evertrust and DuoKey all cover large parts of that list; they differ most on 47-day readiness, key custody, governance and where they run.
This guide is for security, infrastructure and identity teams comparing PKI and certificate lifecycle management (CLM) products. It explains the decision criteria, compares five options using public documentation (reviewed October 2026), says plainly where each one leads, and shows where DuoKey fits and where it does not. If you are about to write an RFP, the companion PKI RFP template and checklist turns the same criteria into requirement tables.
Buyers searching for the best PKI solution usually mean one of three different things:
Most products blur these lines. DigiCert ONE and Keyfactor sell a CA and a CLM layer together, Evertrust splits them into PKI (Stream) and CLM (Horizon), and AD CS is a CA role without a CLM layer. Start by deciding which layer you are actually buying; the rest of the comparison follows from that.
The criteria below mirror the sections of a real PKI RFP. They are the same 32 criteria used in DuoKey's public PKI comparison pages, each sourced to vendor documentation.
| Group | What to test | Why it decides the outcome |
|---|---|---|
| CA and issuance | Private hierarchy, external CA brokering, CRL/OCSP, SSH CA and timestamping | Defines what the platform can replace |
| Enrollment | ACME, EST, SCEP, CMP, Windows autoenrollment, Intune/MDM, cert-manager | Decides whether devices and workloads can get certificates without custom work |
| Visibility and automation | Discovery, policy checks, renewal, expiry alerts, push deployment with rollback, 47-day scale | Decides how many outages you will have |
| Key protection | HSM-backed non-exportable CA keys, threshold/MPC custody, post-quantum algorithms | Decides what happens if a CA host is compromised |
| Use cases | S/MIME escrow, code signing, IoT identity | Decides whether one platform can cover them all |
| Governance | RBAC, approvals, M-of-N, context policy, tamper-evident audit, SIEM | Decides whether auditors accept the evidence |
| Deployment and vendor | SaaS or on-prem, HA/DR, SLA, certifications, jurisdiction | Decides risk and total cost |
A private CA issues certificates trusted only by systems you configure: VPN, Wi-Fi, device identity, service-to-service TLS, code and document signing. It does not replace public CAs for websites that browsers must trust.
PKI as a service means a provider operates the CA hierarchy, revocation endpoints and lifecycle tooling for you. The key question is who holds the CA keys: the provider, or a vault or HSM under your control.
CLM manages the certificates themselves, public and private, wherever they live. With public TLS lifetimes shrinking, CLM is where most of the operational risk now sits.
Many organizations end up with both: public certificates from a public CA, private certificates from a private CA, and one CLM view over everything. A good platform can broker external CAs so that the inventory, renewal and deployment logic is common.
Protocol coverage is the fastest way to filter a shortlist, because it determines whether your estate can enroll without custom glue.
| Protocol | Typical use | Standard |
|---|---|---|
| ACME | Web servers, load balancers, Kubernetes cert-manager | RFC 8555 |
| EST | Devices and network equipment over HTTPS | RFC 7030 |
| SCEP | MDM platforms, network devices | RFC 8894 |
| CMP | Telecom, industrial and automotive device provisioning | RFC 4210, lightweight profile RFC 9483 |
| Microsoft autoenrollment | Domain-joined Windows clients through Group Policy | MS-XCEP / MS-WSTEP |
According to each vendor's public documentation, DigiCert ONE, Keyfactor and DuoKey cover all five. Evertrust documents ACME, EST, SCEP and Windows autoenrollment, but no CMP support was found. AD CS covers autoenrollment and SCEP through NDES; Microsoft does not document ACME, EST or CMPv2 issuance for AD CS. If you provision telecom or industrial devices, make CMP a pass/fail item.
The CA/Browser Forum's Ballot SC-081 reduces the maximum validity of publicly trusted TLS certificates to 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. The rule applies to public TLS, not to your private CA, but many organizations choose short lifetimes internally too, because short-lived certificates shrink the damage window of a stolen key. A detailed timeline is in our 47-day certificate guide.
What "ready" means in practice:
On the public record, Keyfactor leads on readiness evidence: it publishes dedicated 47-day documentation. DuoKey documents ARI and the three challenge types. DigiCert describes the 47-day trend but publishes no scale specification we could find; Evertrust cites 47 days without a readiness claim; AD CS shows nothing equivalent. Treat vendor claims as the start of a proof of concept, not the end of it.
HSM-backed CA keys. All five options can keep CA keys in hardware or a managed key service. AD CS makes the HSM optional (otherwise the key sits on the CA server). DigiCert documents FIPS 140-2 Level 3 HSMs. Keyfactor and Evertrust support cloud and on-premises HSMs and cloud KMS signing. DuoKey generates CA keys in an HSM or KMS and does not export them.
Threshold custody. Only one option in this comparison documents splitting CA keys so they are never whole in one place. DuoKey's documentation describes CA keys held by a multi-party computation (MPC) cluster, where certificates, CRLs and OCSP responses are signed jointly and the key is never assembled in Cockpit or in any single node. As of 24 October 2026 this is validated for ECDSA P-256 CAs only. The other four vendors do not document an equivalent; for AD CS, multiple key recovery agents are not a quorum. If your threat model includes a malicious administrator or a compromised HSM partition, this criterion matters; if not, a conventional HSM is a proven answer.
Post-quantum certificates. NIST standardized ML-DSA (FIPS 204) and SLH-DSA (FIPS 205); the IETF defined ML-DSA in X.509 in RFC 9881. Keyfactor and DuoKey document ML-DSA, SLH-DSA and composite certificates; Evertrust documents ML-DSA, ML-KEM and SLH-DSA; DigiCert documents ML-DSA and SLH-DSA (draft) without composite; AD CS supports ML-DSA on Windows Server 2025 with composite planned. Public TLS is not yet open to post-quantum certificates, so the realistic use case today is private PKI. See our ML-DSA certificate guide.
Based on vendor documentation reviewed October 2026. "Not found" means the capability is not described in public documentation, not that it does not exist. Verify every line in a proof of concept.
| Criterion | AD CS | DigiCert ONE | Keyfactor | Evertrust | DuoKey |
|---|---|---|---|---|---|
| Private CA hierarchy | Yes | Yes | Yes | Yes | Yes |
| External / public CA brokering | Not found | Yes | Yes | Yes | Yes |
| ACME | Not found | Yes | Yes | Yes | Yes |
| EST | Not found | Yes | Yes | Yes | Yes |
| SCEP | Yes (NDES) | Yes | Yes | Yes | Yes |
| CMP | Not found | Yes | Yes (limitations) | Not found | Yes |
| Windows autoenrollment | Yes | Yes | Yes | Yes | Yes |
| Certificate discovery | Not found | Yes | Yes | Yes | Yes |
| Automated renewal and redeploy | Partial | Yes | Yes | Yes | Yes |
| Push deployment with rollback | Not found | Yes | Partial (rollback not documented) | Partial (no rollback) | Yes |
| 47-day readiness at scale | Not found | Partial | Yes | Partial | Yes |
| HSM-protected CA keys | Yes | Yes | Yes | Yes | Yes |
| MPC / threshold CA keys | Not found | Not found | Not found | Not found | Yes (ECDSA P-256 CAs) |
| Post-quantum certificates | Partial | Partial | Yes | Yes | Yes |
| Code signing service | Partial | Yes | Yes | Partial | Yes |
| M-of-N approval | Partial | Partial | Yes | Partial | Yes |
| Context-based policy (IP, country, time) | Not found | Not found | Partial | Not found | Yes |
| Tamper-evident audit log | Not found | Not found | Yes | Yes | Yes |
| SIEM integration | Yes | Partial | Yes | Partial | Yes |
| 24/7 support with published SLA | Not found | Yes | Partial | Partial | Yes |
| Vendor certifications | Partial | Yes | Yes | Yes | Yes |
Head-to-head details, with a cited source for every cell, are on the comparison pages: DuoKey vs Microsoft AD CS, vs DigiCert, vs Keyfactor and vs Evertrust.
Microsoft AD CS. Deep Active Directory integration: Group Policy autoenrollment and renewal, CEP/CES for non-domain clients, NDES, key archival with separated roles and detailed audit events. It is included with Windows Server, supports ML-DSA on Windows Server 2025, and Microsoft Cloud PKI adds a SaaS issuing CA for Intune-managed devices. The gaps are modern enrollment protocols, discovery, push deployment and a signed audit trail, and AD CS template misconfigurations are a well-documented attack surface (see securing PKI against AD CS ESC attacks). For a purely Windows-domain estate with modest needs, it can remain the right answer.
DigiCert ONE. One of the most complete platforms: all major protocols, connectors to third-party CAs, FIPS 140-2 Level 3 HSMs, shipping PQC certificates, code signing, IoT, S/MIME escrow. DigiCert is also a publicly trusted CA with WebTrust, SOC 2 Type II, EU qualified and Swiss ZertES status, and a published 99.99% uptime SLA with 15-minute Sev1 response on its Premium tier. If you want public and private certificates from one vendor with the strongest compliance credentials, DigiCert leads.
Keyfactor. The strongest competitor on PKI breadth. Full protocol coverage, ML-DSA, SLH-DSA and composite certificates, accumulative approval profiles, dedicated 47-day renewal tooling, a Common Criteria certified EJBCA, ISO 27001 and SOC 2 Type II. If your priority is a mature, flexible CA plus CLM with the deepest public documentation on 47-day readiness, Keyfactor is hard to beat.
Evertrust. A strong European choice: ANSSI CSPN certification (2025) and ISO 27001, ACME, EST, SCEP, Windows autoenrollment, Intune, cert-manager, around 18 CA connectors, ML-DSA, ML-KEM and SLH-DSA, an SSH CA and timestamping, active-active clustering and a signed, chained audit log. For French and European public-sector or regulated buyers who value a French vendor and ANSSI certification, it is a natural shortlist entry.
DuoKey provides a private PKI and certificate lifecycle platform inside DuoKey Cockpit, operated by DuoKey (Swiss company, Swiss law) or on your premises. See the certificates management product page.
Where it is differentiated, according to public documentation:
Where it is not the answer, or where you should look closely:
| Situation | What to prioritize | Shortlist to test |
|---|---|---|
| Windows-domain estate, few protocols, tight budget | Autoenrollment, familiarity | AD CS, plus a CLM layer for discovery and renewal |
| Public and private certificates from one trusted vendor, strict compliance evidence | WebTrust, qualified status, SLA | DigiCert ONE, Keyfactor |
| Large heterogeneous estate, 47-day automation, deep CA flexibility | Protocol breadth, approval profiles, 47-day tooling | Keyfactor, DigiCert, DuoKey |
| Regulated, sovereignty-sensitive, high-value root and issuing keys | Key custody, quorum, audit integrity, jurisdiction | DuoKey, Evertrust, Keyfactor |
Whatever the shortlist, run a proof of concept with three tests: enroll through your real protocols, renew 1,000 certificates on a 47-day cycle in staging, and try to tamper with the audit log. The RFP template contains the full test plan.
What is the best PKI solution in 2026? It depends on your estate. Keyfactor and DigiCert lead on breadth and compliance credentials, AD CS on Windows-domain integration at no extra licence cost, Evertrust on European certification, and DuoKey on key custody, governance and deployment with rollback. Shortlist two or three and prove them in a proof of concept.
What is the difference between a private CA and certificate lifecycle management? A private CA issues and revokes certificates trusted only inside your environment. CLM discovers, inventories, renews, deploys and monitors certificates, whichever CA issued them. Many platforms combine both; AD CS provides only the CA.
Do I need a different PKI for 47-day certificates? The 47-day limit applies to publicly trusted TLS certificates from 15 March 2029, not to private CAs. But the operational lesson applies everywhere: you need automated issuance, renewal and deployment, usually through ACME, and a platform tested at your volume.
Which enrollment protocols should a PKI support? ACME for servers and Kubernetes, EST or SCEP for devices and MDM, CMP for telecom and industrial provisioning, and Microsoft autoenrollment if you run Active Directory. List which of these you actually use and make those mandatory.
Is a hardware security module required for a private CA? For a root or issuing CA of any value, yes: keys should be generated in an HSM or a managed KMS and not be exportable. AD CS makes an HSM optional, which is the weaker default. Threshold (MPC) custody goes further by ensuring the key is never whole in one place.
Can I replace AD CS without breaking existing trust? Yes, with a phased migration: build the new hierarchy, cross-sign or distribute the new root, move enrollment protocol by protocol, and keep the old CA serving revocation until its certificates expire. The PKI as a service guide has a plan.
Do post-quantum certificates matter for PKI today? For private PKI, yes as a readiness item. ML-DSA and SLH-DSA are standardized and several platforms issue them; hybrid or composite certificates ease migration. Public TLS does not accept them yet. Ask each vendor which algorithms are supported and whether CA keys can be post-quantum.
How should I compare vendors fairly? Use the same written requirements for each, demand documentation links for every claim, and test the differentiating items yourself. Our PKI RFP template provides a vendor-neutral set.
The best PKI solution is the one that covers your protocols, automates renewal at your volume, protects CA keys to the level your threat model demands, and produces audit evidence you can defend, all from a vendor whose jurisdiction and certifications match your obligations. On the public record, Keyfactor and DigiCert set the benchmark for breadth and compliance, Evertrust for European certification, AD CS for Windows-native simplicity, and DuoKey for MPC-held CA keys, quorum governance, tamper-evident audit and deployment with rollback. Compare them with your own requirements, not ours.
To see how DuoKey's PKI performs against your list, start a trial or read the certificates management product page.
Written by
DuoKey Team
Related Resources
Tell us where control is difficult today. We will help you identify a practical next step.