Discover every certificate
Network scan and unified inventory across your whole estate — ADCS, Vault, EJBCA, public CAs. No unknown certificates, no expiry ambushes.
Loading
Language
Automate every certificate, across all your PKIs.
PKIFactor issues, deploys and renews your certificates automatically — on every certificate authority, over ACME, EST, SCEP and CMP. One governance, zero surprise expirations, and a PKI already ready for post-quantum.
Available for proof of concept and integration projects.
Lifecycle
Four steps. Nothing slips through.
From request to revocation, every certificate is tracked, governed and automated.
1
Request
Submit via portal, API or ACME / EST / SCEP / CMP protocol. Multi-level approval before issuance.
2
Issuance
Certificate issued by the CA of your choice. Template, algorithm and validity applied automatically.
3
Renewal
Automatic renewal before expiration. Alerts, scoring and audit at every rotation.
4
Revocation
Immediate revocation with CRL/OCSP propagation. Full traceability in the audit trail.
1
Request
Submit via portal, API or ACME / EST / SCEP / CMP protocol. Multi-level approval before issuance.
2
Issuance
Certificate issued by the CA of your choice. Template, algorithm and validity applied automatically.
3
Renewal
Automatic renewal before expiration. Alerts, scoring and audit at every rotation.
4
Revocation
Immediate revocation with CRL/OCSP propagation. Full traceability in the audit trail.
Problem3 PKIs. 100k+ certificates.0 visibility.
Manual management is a ticking time bomb
Solution
Total governance.
One platform. Every certificate under control.
ADCS
Public
Private
Cloud
How it works
PKIFactor connects to any certificate authority. Provide the cryptographic endpoints and PKIFactor orchestrates the rest: lifecycle, policies, audit, renewals.
PKIFactor
CLM Orchestrator
ACME / EST / SCEP / CMP / API
ZetaCA
ADCS
Vault
Other CAs
One platform to govern every certificate, across every certificate authority.
01Full visibility
pkifactor://inventory/discovery
All Certificates
Unified inventory across every CA
247 discovered
Common Name
Issuer
Expiry
Status
api.internal.io
ZetaCA
312 days
Active
*.app.prod.io
HashiCorp Vault
18 days
Renewing
mail.corp.local
ADCS
4 days
Critical
vpn.gateway.io
EJBCA
47 days
Warning
www.zetacert.com
Sectigo
198 days
Active
broker.iot.net
Let's Encrypt
61 days
Active
Network scan complete
3 shadow certificates surfaced
02Issuance & renewal
Automate the entire lifecycle
ACME, EST, SCEP, CMP: your certificates issue, deploy and renew with no intervention — ready for 100- then 47-day cycles.
pkifactor://profiles/active
Certificate Profiles
Define issuance parameters and policies
Name
PKI
ACME
Status
Internal mTLS
Vault PKI Engine
vault - CA: pki_int
Enabled
Active
IoT Device Identity
Vault PKI Engine
vault - CA: pki_int
Disabled
Active
Code Signing
EJBCA Community
ejbca - CA: MgmtCA
Disabled
Draft
Wildcard Certificate
Microsoft ADCS
adcs - CA: Corp-SubCA
Enabled
Active
New Certificate Profile
Web Server Production
Vault PKI Engine
RSA 4096
Enable ACME
Allow Wildcards
03Governance & compliance
Continuous audit. Zero gaps.
Every action traced, every policy enforced, real-time alerts — with a post-quantum (ML-DSA) transition built in.
pkifactor://governance/audit-trail
Audit Trail
Real-time governance and compliance logging
Range: Last 24h
System Agent
Auto-Renewal Success *.app.internal.io
Alice Chen (DevOps)
New Certificate Request api.staging.com
Policy Engine
Compliance Violation Blocked wildcard-prod.key
Policy WarningID: #REQ-9281
Wildcard Certificate Request
Requested by frontend-team
Violation: Wildcard certificates are unrestricted in Production environment. Manual approval is required by SecOps.
Common Name
*.pki.io
Key Type
ECDSA P-256
PKIFactor
Dashboard
Certificates
Trust Chains
New Request
Infrastructure
Profiles
PKI Connectors
Key Stores
PQC Transition
Crypto Inventory
System
Users
Audit Trail
SIEM
Settings
Logout
Dashboard
J
1,284
Total Certificates
1,147
Active
23
Expiring < 90d
4
Connectors
PKI Connectors
Microsoft ADCS
Connected
HashiCorp Vault
Connected
EJBCA
Connected
Sectigo SCM
Syncing
Certificates Expiring Soon
monitoring.internal
2 daysdicom.health.corp
4 dayspatient-portal.prod
9 daysapi-gateway.internal
21 daysmail.corp.local
34 daysProtocols & Capabilities
ACME (RFC 8555)
Fully automated certificate issuance
EST (RFC 7030)
Secure enrollment for IoT and mobile devices
SSO / OIDC
Enterprise identity federation out of the box
Post-Quantum (PQC)
Hybrid and quantum-resistant certificate models
KMS Encryption
Hardware-backed key management and envelope encryption
Public Certificate Authorities
Direct integration with major public certificate authorities
Native Connectors & Integrations
PKIFactor natively integrates with your certificate authorities, protocols and existing infrastructure.
Certificate Authorities
- Microsoft ADCS
- EJBCA
- Sectigo
- DigiCert
- Let's Encrypt
- GlobalSign
Protocols
- ACME v2
- EST
- REST API
Security & HSM
- PKCS#11
- Utimaco CryptoServer
- TPM 2.0
- KMIP
Infrastructure
- HashiCorp Vault
- Kubernetes
- LDAP / AD
- SIEM
Technology Partnership
PKIFactor & Utimaco
Hardware vault for the keys of every certificate you orchestrate.
ZetaCert
×
PKIFactor relies on Utimaco u.trust GP HSMs (CryptoServer firmware) as a KMS-grade backbone via PKCS#11 R3, for the generation, storage and rotation of the keys behind every orchestrated certificate. Private keys stay in hardware, never exposed in memory, and managed centrally regardless of which Certificate Authority is in use.
HSM-native generation
Keys for certificates issued via PKIFactor are generated directly inside the Utimaco HSM, never in application memory.
Centralized custody
All keys reside in a single hardware vault. End of key sprawl across endpoints.
Automated rotation
PKIFactor orchestrates large-scale key rotation without manual intervention, with guaranteed service continuity.
Cryptographic auditability
Every key operation (generation, signing, rotation) is logged by the HSM. Audit and compliance ready out of the box.
Built for every security stakeholder
Use Case 01
DevOps & Cloud Architects
Certificates on demand via API and ACME. Kill the manual tickets. Embed PKI directly into your CI/CD pipelines.
API-First Architecture
ACME & EST Protocols
Full REST API (60+ endpoints)
CI/CD Pipeline Compatible
PKIFactor — frequently asked questions
- What is PKIFactor?
- PKIFactor is ZetaCert's sovereign certificate lifecycle management (CLM) platform. It discovers, governs and automates certificates across your entire estate, orchestrating issuance on your existing authorities (HashiCorp Vault, Microsoft ADCS, EJBCA, DigiCert, ZetaCA) behind a single console.
- Is PKIFactor the same as Keyfactor?
- No. PKIFactor is a distinct product from French company ZetaCert Technologies. It is a sovereign European CLM, self-hostable, with classical and post-quantum (ML-DSA) issuance. Keyfactor is a different, US vendor; the names look alike but they are neither the same company nor the same product.
- How is PKIFactor different from a PKI or a certificate authority?
- A PKI/CA issues and signs certificates. PKIFactor is the conductor above them: it doesn't replace your authorities, it drives them — inventory, policies, approvals, renewals, revocations — in a unified, automated way across all your CAs.
- Is PKIFactor sovereign and on-premise deployable?
- Yes. PKIFactor deploys on-premise (VM, Kubernetes) or in a private cloud to guarantee data sovereignty and proximity to your internal PKIs. Keys stay with you.
- Which protocols and authorities does PKIFactor support?
- PKIFactor natively supports ACME (RFC 8555), EST, SCEP and CMP, plus a REST API. On the authority side: Vault, ADCS, EJBCA, DigiCert and ZetaCA, plus a generic REST connector (step-ca, Keyfactor, EJBCA…).
- Does PKIFactor handle the post-quantum transition?
- Yes. PKIFactor issues ML-DSA and hybrid (RSA/ECDSA + ML-DSA) certificates in production, and inventories your estate's quantum exposure to drive migration — in line with the hybridization approach recommended by France's ANSSI.
PKIFactor Editions
Stop enduring your PKI. Choose your level of control.
Starter to evaluate. Enterprise for production. Quantum to stay ahead of the quantum threat.
Compare EditionsAvailable for proof of concept and integration projects.