Managed Cloud PKI Service Built for Azure AD

The ultimate benefit of a private PKI is passwordless, certificate-based authentication. It’s no secret that passwords are a vulnerability, with organizations like Microsoft recommending that you move away from credentials-based PEAP-MSCHAPv2 to passwordless protocols like EAP-TLS. Certificate-based authentication can be used to secure a range of resources, including your wired & wireless network, VPN, applications, desktop logins, and much more.

Additionally, there are benefits for your end-users. With digital certificates, employees no longer have to deal with frustrating password reset policies and disconnects due to password changes.

Active Directory Certificate Services is Microsoft’s legacy PKI solution that gives organizations the ability to build their own on-premise Public Key Infrastructure. Unfortunately, this often ends up being a costlier venture in terms of finances and time spent. Building a private PKI requires expertise, space for the servers, and regular maintenance. Certificate lifecycle management with Active Directory Certificate Services - from issuance to renewal to building a certificate revocation list - is time-consuming.

What’s more, Active Directory Certificate Services has its own limitations that our cloud PKI solution does not. For example, you can’t search for individual certificates in Active Directory Certificate Services easily. This means there is no real way to tell who has which certificate or when specific devices were enrolled for certificates. 

It’s also important to understand the costs of building a PKI with Active Directory Certificate Services. Aside from taking potentially hundreds of hours to set up initially, there’s a high upfront infrastructure and software cost that can easily exceed $200,000 USD. On top of up-front software and infrastructure costs, Active Directory Certificate Services will have recurring costs in the form of high maintenance.

We wouldn’t be able to call it PKI as a Service if we didn’t provide you everything you needed to deploy certificates. For endpoint distribution, we have our automatic gateway APIs for managed devices and our self-service onboarding technology for unmanaged devices/BYODs. 

When it comes to revocation, our cloud-based PKI can revoke certificates in a few different ways, including manually and through automatic revocation with some MDMs such as Intune. Our PKI as a service also includes customizable policies you can create, such as non-utilization, which means certificates that aren’t used for a definable period of time (such as 60 days) are automatically revoked.

Our PKI makes renewal simple, too. For managed devices, certificate renewal typically happens on an automatic basis a month or two before the certificate’s expiration. For BYODs, administrators can set a customizable notification email to go out to end-users, encouraging them to re-enroll for a certificate before it expires.

The user experience with certificate-based authentication differs based on whether they are using managed or unmanaged devices/BYODs. For managed devices, the end user will never notice the certificate enrollment process - our PKI as a service includes gateway APIs that will automatically enroll them for a certificate. 

For BYODs, you can utilize our self-service onboarding technology, which allows end users to configure their devices for certificates in a matter of minutes. Users simply navigate to our onboarding page, which can be customized, and login using their Azure AD (Microsoft Entra ID) credentials once. Afterwards, our dissolvable client can easily configure their devices for certificates and enroll them quickly.

After enrollment, certificate-based authentication is mostly the same for either type of end-user. They no longer need to remember a plethora of passwords, reset those passwords regularly, or adhere to complex password requirements.

Our PKI allows you to create a private certificate authority only. However, you can create as many private certificate authorities as you need. Our customers commonly build a different certificate authority for different groups of people to enable role-based access control, such as having a separate certificate authority for their HR and DevOps teams. This makes managing certificates for different roles organized and efficient.

Yes. Our platform can issue a client certificate to smart cards such as Yubikeys to allow for smart card-based single sign-on. We also support Windows Hello for Business, so users can access their devices through smart card logon.