Loading
Language
Sovereign Europe · ML-DSA in production
Master your PKI.
Orchestrate every certificate authority. Issue across classical and post-quantum natively. Govern at scale. A sovereign European platform, classical and post-quantum.
- ML-DSA & hybrid issuance in production
- Native ACME · EST · SCEP · CMP
- Sovereign multi-CA: Vault, ADCS, EJBCA
Available for proof of concept and integration projects.
Supervision · Trust CA Zetacert
All systems operational
M
Certificates
14,115
+128 this month
Expiring < 30d
42
auto-renewal
PQC-ready
38%
ML-DSA / hybrid
Active PKIs
3 / 3
Vault · ADCS · EJBCA
Vault
ADCS
EJBCA
ACME
CMP
SIEM
Recent certificatesView all
| Common Name | Algorithm | Status |
|---|---|---|
| api.zetacert.com | ML-DSA-65 | Active |
| mtls.svc.internal | RSA-2048 | ML-DSA-65 | Active |
| vpn-gw-03.corp | ECDSA P-256 | Active |
| broker.iot.zc | ML-DSA-44 | Issuing |
| legacy.app.lan | RSA-2048 | Renew |
RFC 8555 · EST · SCEP · CMP · Sovereign encryption, your keys
Real problems. Concrete answers.
Orphan certificates
Certificates with no owner, no team, no renewal process. When an employee leaves, their certificates stay. Until they expire.
Zero PKI visibility
Certificates scattered across multiple CAs, manual files, disparate tools. No single view. No single source of truth.
Single-CA dependency
One certificate authority for everything. One point of failure. One vendor lock-in. One problem when it goes down.
Multi-entity governance
Multiple business units, multiple CISOs, multiple policies. One PKI that cannot segment or delegate.
PQC transition complexity
New algorithms, new key sizes, new trust chains. No tooling to inventory, plan, or execute the migration.
Built for teams that manage PKI
From security teams to global enterprises, the platform adapts to your organization.
CISO / Security
Full visibility and compliance across your entire certificate estate.
PKI Teams
Lifecycle automation, multi-CA, zero manual intervention.
GRC / Audit
Immutable audit trail, quality scoring, compliance exports.
Large Enterprises
Multi-org, data isolation, centralized governance.
Two products. Zero blind spots.
End-to-end PKI control, from certificate issuance to multi-CA orchestration, engineered for crypto-agility — classical today, post-quantum ready.
CLM Orchestrator
PKIFactor
Take control of every certificate authority, public and private, from one governance platform. No more spreadsheets. No more surprises.
- Multi-CA Orchestration
- ACME & EST Automation
- Audit & Regulatory Compliance
Certificate Authority
ZetaCA
Post-quantum native certificate authority — RSA, ECDSA and ML-DSA from day one. Validated on Utimaco u.trust GP, PKCS#11-compatible. Starter edition free and perpetual, Enterprise and Quantum on license.
- Classical & post-quantum issuance
- Universal HSM compatibility
- On-premise & air-gapped deployment
ZetaCA standalone, or with PKIFactor
Pick your level of orchestration: ZetaCA as a standalone CA for isolated or air-gapped environments, or paired with PKIFactor for multi-CA centralised governance.
PKIFactor + ZetaCA
Cryptographic power meets orchestration intelligence. The complete enterprise PKI stack.
Cryptography
Orchestration
One console. Every certificate.
Real-time operations console for PKIFactor, ZetaCA, and your existing CAs. Built for Security, DevOps, and GRC teams.
Real-time visibility
Detect expiry, incidents, and policy drift the second they happen, across every certificate you own.
Centralized command
Enforce policies, trigger renewals, and revoke certificates without leaving this console.
Multi-CA · PKI connectors
Every authority. One orchestration.
Vault, Microsoft ADCS, EJBCA, DigiCert, ZetaCA… PKIFactor drives issuance across all your existing authorities behind a single console — no migration, no lock-in.
- Native connectors + generic REST (step-ca, Keyfactor…)
- Profiles, quotas and approvals per authority
- Continuous health & connection tests
PKI ConnectorsAll connectedAdd
Trust CA Zetacert
HashiCorp Vault
Profiles
4
Issued
8,240
test OK
EJBCA CE
EJBCA
Profiles
3
Issued
3,110
test OK
SRV ADCS
Microsoft ADCS
Profiles
2
Issued
1,980
test OK
DigiCert
DigiCert · public
Profiles
1
Issued
640
test OK
ZetaCA Demo
ZetaCA
Profiles
2
Issued
145
test OK
Generic REST connector
Domain Validations47-day readyNew domain
Domains
128
Validated
124
Pending
4
Re-validation
auto · 24h
DNS providersOVHAzureCloudflareGCPGandiWebhook
| Domain | Checked | Status |
|---|---|---|
| api.zetacert.com | 2 min | Validated |
| *.svc.internal | 5 min | Validated |
| shop.acme.eu | 12 min | Validated |
| vpn.acme.eu | 1 hr | Re-validating |
| legacy.acme.eu | — | Pending |
Domain validation · DCV
47-day certificates? Validation has to be automatic.
The CA/B mandate cuts TLS certificates to 47 days by 2029. PKIFactor pre-validates your domains and automates DCV (DNS-01, HTTP) across OVH, Azure, Cloudflare, GCP and Gandi — renewals never break.
- Continuous pre-validation, re-validated before expiry
- DNS-01 & HTTP, multi DNS provider
- Automated OV & DV (Sectigo, OVH…)
Post-quantum
See, prioritize, migrate your cryptography.
PKIFactor inventories every algorithm and key size across your estate, scores quantum exposure, and drives the shift to ML-DSA and hybrid — without breaking what runs today.
- Continuous inventory of algorithms & key sizes
- Scored quantum exposure, migration cohorts
- ML-DSA / hybrid rollout, crypto-agile end to end
Crypto InventoryReport
Deployed PQC / hybrid
2,545
18% of estate
Quantum-vulnerable
11,560
82% · RSA · ECDSA
Planned migration
6,400
12 cohorts
Algorithm distribution14,115 certificates
RSA-2048
7,890Vulnerable
ECDSA P-256
2,540Vulnerable
RSA-4096
1,130Vulnerable
ML-DSA-65
1,410PQC
RSA-2048 | ML-DSA-65
1,135Hybrid
Migration planCrypto-agile
TLS servers
→ hybrid RSA | ML-DSA
62%
mTLS internal
→ ML-DSA-65
34%
IoT · SCEP
→ ML-DSA-44
12%
api.zetacert.comValidRenewRevoke
Authority
Trust CA Zetacert
Algorithm
ML-DSA-65
Serial
3A:F2:9C:1E:7B:04
Profile
srv-tls
Validity
2026-05-12 → 2026-07-14
Expires in
63d
Subject Alt Names (SAN)
api.zetacert.comwww.zetacert.comapi.eu.zetacert.com
Trust chain
- TRUST ZETA ROOT CA
- SUB ZETA INTERMEDIATE CA
- api.zetacert.com
HistoryOCSP: Good
- Requested · 2026-05-12
- Approved · 2026-05-12approver: m.thioub
- Issued · 2026-05-12
Lifecycle · Certificate record
Every certificate, traced from request to revocation.
Subject, trust chain, SANs, profile, full history and revocation status — every issued certificate keeps an immutable audit trail, exportable for compliance.
- Trust chain & SANs at a glance
- Immutable history: request, approval, issuance, renewal
- One-click renewal & revocation (OCSP/CRL)
Governance & compliance
Approvals under control. Tamper-proof traceability.
Role-based (RBAC) approval workflow, and an immutable audit trail of every action — issuance, approval, revocation, configuration — exportable as JSON/CEF to your SIEM.
- Per-organization validators, separation of duties
- Immutable, timestamped audit trail
- Continuous SIEM export (CEF/Syslog, JSON)
GovernanceSIEM export · CEF
Approval queue3 pending · Role: Validator
M
shop.acme.eu
m.diop · srv-tls · RSA-2048
Approve
A
*.svc.internal
a.martin · mtls · ML-DSA-65
Approve
D
api.stage.acme.eu
devops-ci · srv-tls · ECDSA P-256
Approve
Audit trail immutable
- Certificate issued api.zetacert.comsystem · 2 min
- Request approved shop.acme.eum.thioub · 5 min
- Certificate renewed vpn.acme.euauto · 18 min
- Certificate revoked old.acme.eua.durand · 1 hr
- Connector updated EJBCA CEadmin · 2 hr
Public tool · Free
Audit your certificates. For free, no account.
CryptoAudit runs the same detector chain we use in ZetaCert Research against an individual certificate or a hostname. No account, no data retention. Answer in seconds.
Batch GCDFermat factorisationModulus lengthCA mis-issuance
Run an audit at audit.zetacert.comFAQ
Frequently Asked Questions
Everything you need to know about ZetaCert, deployment options, and integration.
What is the difference with a traditional PKI (ADCS, EJBCA)?
PKIFactor is an orchestrator (CLM), not a PKI. Unlike ZetaCA, ADCS, or EJBCA, it does not sign certificates. It connects to these authorities to manage the certificate lifecycle.
Does ZetaCert replace my existing solutions?
No, PKIFactor complements them. It acts as a conductor above your PKIs (like ZetaCA or ADCS) to unify visibility and automation.
How does the network scan work?
Our discovery agent scans your defined IP ranges and ports to identify all exposed SSL/TLS certificates, whether managed or not (shadow IT). No agent is required on target servers for passive scanning.
Can I install it on my own infrastructure (On-Premise)?
Absolutely. ZetaCert is designed to be deployed On-Premise (VM, Kubernetes) or in a Private Cloud to ensure complete data sovereignty and proximity to your internal PKIs.
Which automation protocols do you support?
We natively support ACME (RFC 8555), EST (RFC 7030), and have a full REST API. Integration with common web servers (IIS, Nginx, Apache) is available.
Does ZetaCert escrow my private keys?
No. ZetaCert does not escrow any private key. PKIFactor accepts CSRs signed elsewhere and never stores the associated private key. ZetaCA generates its CA keys inside a PKCS#11 HSM, where they never leave. Key escrow (S/MIME recovery, ediscovery, legal hold) belongs in a dedicated KMS/IDM product — not in a PKI nor a CLM. This is a deliberate architecture choice to preserve non-repudiation and limit the blast radius of a compromise.
How can I check the cryptographic health of my own certificates?
We operate a free, accountless public service at audit.zetacert.com. Submit a hostname or upload a PEM certificate: the service runs the same detector chain used by ZetaCert Research (batch GCD, Fermat close-prime factorisation, modulus length check, public-exponent verification, notAfter plausibility, CA mis-issuance). No data is retained beyond the request.
Stop managing certificates. Start governing them.
30 min. Your PKI challenges. Our solutions. No commitment.
Classical & Post-Quantum
Sovereign & On-Premise
European Infrastructure
Available for proof of concept and integration projects.