DuoKey

PKI and Certificate Lifecycle Management

DuoKey vs Keyfactor

Keyfactor combines Keyfactor Command for certificate lifecycle management with EJBCA for the CA, plus Signum and SignServer for signing, delivered as software, appliances, containers or SaaS. DuoKey is a Swiss PKI and certificate lifecycle platform: private CAs with HSM-protected keys, ACME, EST, SCEP and CMP, discovery, deployment and automated renewal with rollback, code signing, M-of-N governance, post-quantum certificates and a tamper-evident audit trail, operated by DuoKey or on your premises.

DuoKey

31 / 32

Keyfactor

28 / 32

Compared capabilities supported, based on public documentation.

Book a call→See the comparison

Only DuoKey

  • Push deployment to endpoints (load balancers, firewalls, web servers, Windows) with rollback
  • Context-based (IP, location, time) policy on CA / PKI operations
  • 24/7 support with SLA response times

Feature by feature

DuoKey and Keyfactor, side by side

CapabilityDuoKeyKeyfactor

CA and issuance

1Private CA hierarchy

Run own root/intermediate CAs with lifecycle controls

YesRoot, intermediate, imported CAs; cascade revokeSource
YesEJBCA CA hierarchy, single node or clusterSource

2Public / external CA brokering

Order and renew public or cloud CA certificates (Let's Encrypt, DigiCert, Sectigo, AWS PCA, ADCS...) from one console

YesLet's Encrypt, DigiCert, Sectigo, AWS, Azure, GCP, ADCS (NDES, Server 2025)Source
YesAnyCA Gateway: DigiCert, Sectigo, AWS PCA, ADCSSource

3Revocation

CRL and OCSP for relying parties

YesPer-CA OCSP and CRLSource
YesCRL and OCSPSource

4Adjacent PKI services

SSH CA and/or RFC 3161 timestamping

YesSSH CA, RFC 3161 timestampingSource
YesEJBCA SSH CA, SignServer RFC 3161Source

Enrollment

5ACME (RFC 8555)

YesPer-CA ACME directorySource
YesACME (Enterprise)Source

6EST (RFC 7030)

YesIncl. serverkeygen, csrattrsSource
YesEST (Enterprise)Source

7SCEP (RFC 8894)

YesConfigurable SCEP profilesSource
YesSCEPSource

8CMPv2 (RFC 4210/9483)

YesCMP incl. lightweight profile; tested with OpenSSLSource
YesCMP, limitations applySource

9Microsoft autoenrollment (GPO / WCCE / MS-XCEP)

YesMS-XCEP / MS-WSTEP, validated on Server 2025 and Windows 11Source
YesMicrosoft auto-enrollment integrationSource

10Intune / MDM certificate delivery

YesIntune SCEP and PKCS; static SCEP for JamfSource
YesSCEP RA validated with IntuneSource

11Kubernetes cert-manager issuer

YesVia ACME issuer, verified end to endSource
YesEJBCA and Command cert-manager issuersSource

Visibility and automation

12Certificate discovery (network scan and/or agents)

YesNetwork scanners and agentsSource
YesSSL network discovery via orchestratorsSource

13Central inventory with policy / compliance checks

YesMozilla/NIST/PCI checks, ServiceNow CMDBSource
YesInventory with non-compliance alertsSource

14Automated renewal and redeployment

YesServer-side renew and redeploy, retries, rollbackSource
YesZero-touch renewal and deploymentSource

15Expiry alerting

YesE-mail, Teams, Slack, webhooks per thresholdSource
YesExpiration alerts and workflowsSource

16Push deployment to endpoints (load balancers, firewalls, web servers, Windows) with rollback

YesF5, FortiGate, Azure, IIS, Nginx, JKS, AD LDAPS + rollbackSource
PartialOrchestrator push; rollback not documentedSource

17Short-lived certificates / 47-day TLS readiness at scale

YesACME ARI, http-01/dns-01/tls-alpn-01; ~50 cert/s measuredSource
YesDedicated 47-day documentationSource

Key protection

18HSM-protected CA keys (non-exportable)

YesCA keys generated in HSM or KMS, never exportedSource
YesCloud/on-prem HSM, appliance with HSMSource

19CA keys split with MPC / threshold (never whole in one place)

PartialMPC-held CA keys, ECDSA P-256 only (preview)Source
Not documented

20Post-quantum certificates (ML-DSA, SLH-DSA, hybrid/composite)

YesML-DSA, SLH-DSA, ML-DSA-65+P256 compositeSource
YesML-DSA, SLH-DSA, compositeSource

Use cases

21S/MIME with key escrow and recovery

YesEscrow and recovery, Intune deliverySource
YesKey recovery for CA-generated keysSource

22Code signing service

YesSignTool, JAR, Git, cosign; vault keys, M-of-NSource
YesSignum, SignServerSource

23IoT / device identity at scale

YesIn production at Volkswagen; EST and CMP provisioningSource
YesCommand for IoT (marketing)Source

Governance

24Granular RBAC

YesHierarchical PKI permissionsSource
YesRole-based permissionsSource

25Approval workflow / M-of-N quorum for sensitive PKI operations

YesM-of-N on CA revoke, archive, changes, issuanceSource
YesAccumulative/partitioned approval profilesSource

26Context-based (IP, location, time) policy on CA / PKI operations

YesUser, IP, country, time on issue and revokeSource
PartialTime/location only for Signum signingSource

27Tamper-evident (signed / hash-chained) audit log

YesHMAC-SHA256 plus hash chainSource
YesSigned audit rows, sequence numbersSource

28SIEM integration

YesSplunk, syslog, ElasticSource
YesSIEM/ITSM, rsyslog/LogstashSource

Deployment and vendor

29SaaS and on-premises options

YesDuoKey-hosted or on-premisesSource
YesAppliance, container, cloud, SaaSSource

30High availability / disaster recovery

YesStateless API nodes, replicasSource
YesClustering; SaaS redundant multi-regionSource

3124/7 support with SLA response times

Yes24/7 on Platinum, 1-hour criticalSource
Partial24/7 stated; response times not publicSource

32Vendor certifications (ISO 27001, SOC 2, WebTrust / eIDAS QTSP, Common Criteria)

YesISO 27001, SOC 2, TISAX AL3Source
YesISO 27001, SOC 2 Type II, Common CriteriaSource

Why teams choose DuoKey

Key differences with Keyfactor

01

A hash-chained audit log

EJBCA signs audit rows and numbers them per node; Keyfactor's documentation states that the implementation cannot detect removal of a node's latest entries while its JVM is not running, nor forged entries if the integrity protection token is compromised. DuoKey links every HMAC-SHA256 signed record into a SHA-256 hash chain, so any edit or deletion is detectable.

02

Deploy with rollback

Command pushes certificates through orchestrators; rollback is not documented. DuoKey deploys to F5, FortiGate, Azure, IIS, Nginx and Java keystores with validation and rollback.

03

One platform beyond PKI

DuoKey runs the CA, certificate lifecycle, SSH CA and timestamping in the same Cockpit as key management, Microsoft 365 DKE and cryptographic posture management, with one RBAC model and one audit trail.

04

Swiss jurisdiction

Keyfactor is a US company. EJBCA SaaS runs on AWS or Azure, and Keyfactor documents that features needing an encryption key, such as SCEP, Intune and key recovery, do not work with AWS KMS-based deployments. DuoKey SA is Swiss and operates its service under Swiss law, or runs on your premises.

What Keyfactor does well

Keyfactor is a PKI leader: full protocol coverage (ACME, EST, SCEP, CMP, Microsoft autoenrollment, Intune, cert-manager), ML-DSA, SLH-DSA and composite certificates, accumulative approval profiles, dedicated 47-day renewal tooling, Common Criteria certified EJBCA, ISO 27001 and SOC 2 Type II. It is the strongest competitor on PKI breadth.

FAQ

Is DuoKey an alternative to Keyfactor for PKI and certificate lifecycle management?

Yes. DuoKey provides private CAs with keys kept in an HSM or KMS, brokering of public and cloud CAs, ACME, EST, SCEP and CMP, discovery, deployment and automated renewal with rollback, expiry alerts, a code signing service, M-of-N approval of sensitive operations and post-quantum certificates, operated by DuoKey or on your premises.

Can I keep Keyfactor and add DuoKey?

Yes. DuoKey can front existing CAs as issuers (Microsoft AD CS through NDES, DigiCert, Sectigo, Let's Encrypt, AWS, Azure, Google) while centralising inventory and deployment.

How were these criteria chosen?

They follow the sections of a PKI and certificate lifecycle RFP: issuance, enrollment protocols, visibility and automation, key protection, use cases, governance and deployment. Every cell links to the public document it is based on.

What are the alternatives to Keyfactor?

For PKI and certificate lifecycle management, buyers usually compare Keyfactor (Command and EJBCA) with DigiCert ONE, Evertrust, Microsoft AD CS with Cloud PKI for Intune, cloud private CAs (AWS Private CA, Google Cloud CAS) and DuoKey. The criteria that separate them are CA key custody, protocol coverage, deployment with rollback, the audit log, certifications and jurisdiction.

Does DuoKey support post-quantum certificates like Keyfactor?

Yes. Keyfactor and DuoKey both document ML-DSA, SLH-DSA and composite certificates. DuoKey issues ML-DSA-44/65/87, SLH-DSA-128F/128S and a hybrid ML-DSA-65 + ECDSA-P256 composite, with post-quantum CA keys held in a vault or HSM.

How do I migrate from EJBCA or Keyfactor Command to DuoKey?

Run the two in parallel: import the existing CA as an external CA or build a new hierarchy, distribute trust, then move consumers protocol by protocol (ACME, EST, SCEP, CMP). Old certificates expire naturally while DuoKey centralises inventory and deployment.

Evidence

Every claim on this page, sourced

Keyfactor

  1. [1]www.keyfactor.comcriteria 1, 18, 29https://www.keyfactor.com/products/ejbca-enterprise/
  2. [2]pre-reqs.keyfactor.comcriteria 2https://pre-reqs.keyfactor.com/customer-requirements/current/anyca-gateway-plug-ins
  3. [3]docs.keyfactor.comcriteria 3, 5, 6, 7, 8, 9https://docs.keyfactor.com/ejbca/latest/interoperability-and-certifications
  4. [4]docs.keyfactor.comcriteria 4https://docs.keyfactor.com/signserver/latest/time-stamp-signer
  5. [5]docs.keyfactor.comcriteria 10https://docs.keyfactor.com/ejbca/latest/microsoft-intune-device-certificate-enrollment
  6. [6]docs.keyfactor.comcriteria 11https://docs.keyfactor.com/how-to/latest/use-ejbca-with-cert-manager
  7. [7]software.keyfactor.comcriteria 12https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SSLDiscovery.htm
  8. [8]www.keyfactor.comcriteria 13, 16, 24, 28https://www.keyfactor.com/products/command/
  9. [9]software.keyfactor.comcriteria 14, 17https://software.keyfactor.com/Core-OnPrem/Current/Content/MasterTopics/47daycerts.htm
  10. [10]software.keyfactor.comcriteria 15https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/WorkflowDefinitions.htm
  11. [11]docs.keyfactor.comcriteria 20https://docs.keyfactor.com/ejbca/latest/supported-algorithms
  12. [12]docs.keyfactor.comcriteria 21https://docs.keyfactor.com/ejbca/latest/ejbca-8-2-release-notes
  13. [13]www.keyfactor.comcriteria 22, 26https://www.keyfactor.com/products/signum/
  14. [14]www.keyfactor.comcriteria 23https://www.keyfactor.com/products/command-iot/
  15. [15]docs.keyfactor.comcriteria 25https://docs.keyfactor.com/ejbca/latest/accumulative-approval-profiles
  16. [16]docs.keyfactor.comcriteria 27https://docs.keyfactor.com/ejbca/latest/integrity-protected-security-audit-log
  17. [17]www.keyfactor.comcriteria 30, 31https://www.keyfactor.com/products/keyfactor-ejbca-saas/
  18. [18]trust.keyfactor.comcriteria 32https://trust.keyfactor.com/

DuoKey

  1. [1]docs.duokey.comcriteria 1, 2, 3, 8, 13, 16, 20https://docs.duokey.com/docs/pki-ssl/overview#core-capabilities
  2. [2]docs.duokey.comcriteria 4https://docs.duokey.com/docs/cockpit/ssh-certificate-authority#what-is-an-ssh-certificate-authority
  3. [3]docs.duokey.comcriteria 5https://docs.duokey.com/docs/developer/pki-api#acme-rfc-8555
  4. [4]docs.duokey.comcriteria 6https://docs.duokey.com/docs/pki-ssl/enrollment-protocols#est-rfc-7030
  5. [5]docs.duokey.comcriteria 7https://docs.duokey.com/docs/pki-ssl/enrollment-protocols#scep-rfc-8894
  6. [6]docs.duokey.comcriteria 9https://docs.duokey.com/docs/pki-ssl/windows-autoenrollment#overview
  7. [7]docs.duokey.comcriteria 10https://docs.duokey.com/docs/pki-ssl/intune-mdm#overview
  8. [8]docs.duokey.comcriteria 11https://docs.duokey.com/docs/pki-ssl/enrollment-protocols#using-acme-with-kubernetes-cert-manager
  9. [9]docs.duokey.comcriteria 12https://docs.duokey.com/docs/developer/pki-api#discovery-compliance
  10. [10]docs.duokey.comcriteria 14https://docs.duokey.com/docs/pki-ssl/renewal-and-alerts#renewal-policies
  11. [11]docs.duokey.comcriteria 15https://docs.duokey.com/docs/pki-ssl/renewal-and-alerts#expiry-alerts
  12. [12]docs.duokey.comcriteria 17https://docs.duokey.com/docs/pki-ssl/short-lived-certificates#load
  13. [13]docs.duokey.comcriteria 18https://docs.duokey.com/docs/pki-ssl/ca-key-protection#supported-back-ends
  14. [14]docs.duokey.comcriteria 19https://docs.duokey.com/docs/pki-ssl/ca-key-protection#mpc-ca-keys
  15. [15]docs.duokey.comcriteria 21https://docs.duokey.com/docs/cockpit/release-notes#205-206
  16. [16]docs.duokey.comcriteria 22https://docs.duokey.com/docs/pki-ssl/code-signing#overview
  17. [17]duokey.comcriteria 23https://duokey.com/en/customers/volkswagen-ota-edge
  18. [18]docs.duokey.comcriteria 24https://docs.duokey.com/docs/developer/pki-api#certificates-requests
  19. [19]docs.duokey.comcriteria 25https://docs.duokey.com/docs/pki-ssl/governance#quorum
  20. [20]docs.duokey.comcriteria 26https://docs.duokey.com/docs/pki-ssl/governance#access-policies
  21. [21]docs.duokey.comcriteria 27https://docs.duokey.com/docs/cockpit/security#tamper-evident-audit
  22. [22]docs.duokey.comcriteria 28https://docs.duokey.com/docs/cockpit/deployment#observability
  23. [23]docs.duokey.comcriteria 29https://docs.duokey.com/docs/openshift-on-prem/vm-deployment
  24. [24]docs.duokey.comcriteria 30https://docs.duokey.com/docs/cockpit/deployment#high-availability-and-resilience
  25. [25]docs.duokey.comcriteria 31https://docs.duokey.com/docs/why-mpc
  26. [26]duokey.comcriteria 32https://duokey.com/en/compliance/iso-27001

Sprechen Sie über die Entscheidungen, die für Ihr Sicherheitsprogramm zählen.

Sagen Sie uns, wo Kontrolle heute schwierig ist. Wir helfen Ihnen, den nächsten praktischen Schritt zu finden.

Demo anfragenLösungen entdecken