MenuOur Vision

Partners

Language

Products

CLM OrchestratorPKIFactorCommand and automate every certificate authority from a single governance layer.

Explore PKIFactor

View Editions

Certificate AuthorityZetaCAPost-quantum certificate authority. Validated on Utimaco u.trust GP, PKCS#11-compatible.

Explore ZetaCA

View Editions

ZetaCA Editions

A CA built for your scale.

Classical, enterprise or post-quantum. One foundation. Three power levels.

Available for proof of concept and integration projects.

Starter

Full classical PKI. Zero license, zero compromise.

Certificate Authorities

Multi-CA hierarchy (Root, Sub-CA, import)

Classical cryptography (RSA, ECDSA)

28 built-in templates (7 EKU x 4 families)

Full CRL, Delta CRL and OCSP Responder

Users(10 max)

Certificate authorities(3 max)

Administration & governance

Admin UI + Sysadmin UI

Full REST API

RBAC 3 roles (Admin, Operator, Auditor)

Hash-chained audit log + Prometheus

Ceremony control (TIER 1 mandatory + TIER 2 quorum)

Infrastructure

LDAP / Active Directory

KMS envelope encryption (AWS KMS, Vault Transit, GCP KMS, Fernet fallback)

Post-Quantum

Recommended

Enterprise

Hardware HSM, HA and LDAP. The CA your CISO has been waiting for.

Certificate Authorities

Multi-CA hierarchy (Root, Sub-CA, import)

Classical cryptography (RSA, ECDSA)

28 built-in templates (7 EKU x 4 families)

Custom templates (admin-defined policies)

Full CRL, Delta CRL and OCSP Responder

Users

Certificate authorities

Administration & governance

Admin UI + Sysadmin UI

Full REST API

RBAC 3 roles (Admin, Operator, Auditor)

Hash-chained audit log + Prometheus

Ceremony control (TIER 1 mandatory + TIER 2 quorum)

mTLS authentication

Encrypted backup / restore

Infrastructure

LDAP / Active Directory

KMS envelope encryption (AWS KMS, Vault Transit, GCP KMS, Fernet fallback)

HSM / PKCS#11 (tested Utimaco, any PKCS#11 compatible)

High availability (Patroni + HAProxy)

SIEM (Syslog)

Post-Quantum

Free 30-day trial included

Quantum

ML-DSA, composite, dual-cert. Native post-quantum issuance, ML-DSA signing in Utimaco HSM.

Certificate Authorities

Multi-CA hierarchy (Root, Sub-CA, import)

Classical cryptography (RSA, ECDSA)

28 built-in templates (7 EKU x 4 families)

Custom templates (admin-defined policies)

Full CRL, Delta CRL and OCSP Responder

Users

Certificate authorities

Administration & governance

Admin UI + Sysadmin UI

Full REST API

RBAC 3 roles (Admin, Operator, Auditor)

Hash-chained audit log + Prometheus

Ceremony control (TIER 1 mandatory + TIER 2 quorum)

mTLS authentication

Encrypted backup / restore

Infrastructure

LDAP / Active Directory

KMS envelope encryption (AWS KMS, Vault Transit, GCP KMS, Fernet fallback)

HSM / PKCS#11 (tested Utimaco, any PKCS#11 compatible)

High availability (Patroni + HAProxy)

SIEM (Syslog)

Post-Quantum

ML-DSA (Dilithium), SLH-DSA (SPHINCS+), FN-DSA (Falcon)

IETF Composite (ECDSA+ML-DSA, RSA+ML-DSA…)

Dual-cert (RFC 9763 RelatedCertificate) and Hybrid AltSig (X.509 §9.8)

Cryptographic family segregation

ML-DSA in HSM (Utimaco QuantumProtect) — SLH-DSA / FN-DSA in software

FIPS 204 §6.2 external-μ optimization (high-throughput ML-DSA signing)

Free 30-day trial included

Starter

Full classical PKI. Zero license, zero compromise.

Recommended

Enterprise

Hardware HSM, HA and LDAP. The CA your CISO has been waiting for.

Free 30-day trial included

Quantum

ML-DSA, composite, dual-cert. Native post-quantum issuance, ML-DSA signing in Utimaco HSM.

Free 30-day trial included

Certificate Authorities

Multi-CA hierarchy (Root, Sub-CA, import)

Classical cryptography (RSA, ECDSA)

28 built-in templates (7 EKU x 4 families)

Custom templates (admin-defined policies)

Full CRL, Delta CRL and OCSP Responder

Users

10 max

Certificate authorities

3 max

Administration & governance

Admin UI + Sysadmin UI

Full REST API

RBAC 3 roles (Admin, Operator, Auditor)

Hash-chained audit log + Prometheus

Ceremony control (TIER 1 mandatory + TIER 2 quorum)

mTLS authentication

Encrypted backup / restore

Infrastructure

LDAP / Active Directory

KMS envelope encryption (AWS KMS, Vault Transit, GCP KMS, Fernet fallback)

HSM / PKCS#11 (tested Utimaco, any PKCS#11 compatible)

High availability (Patroni + HAProxy)

SIEM (Syslog)

Post-Quantum

ML-DSA (Dilithium), SLH-DSA (SPHINCS+), FN-DSA (Falcon)

IETF Composite (ECDSA+ML-DSA, RSA+ML-DSA…)

Dual-cert (RFC 9763 RelatedCertificate) and Hybrid AltSig (X.509 §9.8)

Cryptographic family segregation

ML-DSA in HSM (Utimaco QuantumProtect) — SLH-DSA / FN-DSA in software

FIPS 204 §6.2 external-μ optimization (high-throughput ML-DSA signing)

MenuOur Vision

Partners

Language

Products

CLM OrchestratorPKIFactorCommand and automate every certificate authority from a single governance layer.

Explore PKIFactor

View Editions

Certificate AuthorityZetaCAPost-quantum certificate authority. Validated on Utimaco u.trust GP, PKCS#11-compatible.

Explore ZetaCA

View Editions

ZetaCA Editions

A CA built for your scale.

Classical, enterprise or post-quantum. One foundation. Three power levels.

Available for proof of concept and integration projects.

Starter

Full classical PKI. Zero license, zero compromise.

Certificate Authorities

Multi-CA hierarchy (Root, Sub-CA, import)

Classical cryptography (RSA, ECDSA)

28 built-in templates (7 EKU x 4 families)

Full CRL, Delta CRL and OCSP Responder

Users(10 max)

Certificate authorities(3 max)

Administration & governance

Admin UI + Sysadmin UI

Full REST API

RBAC 3 roles (Admin, Operator, Auditor)

Hash-chained audit log + Prometheus

Ceremony control (TIER 1 mandatory + TIER 2 quorum)

Infrastructure

LDAP / Active Directory

KMS envelope encryption (AWS KMS, Vault Transit, GCP KMS, Fernet fallback)

Post-Quantum

Recommended

Enterprise

Hardware HSM, HA and LDAP. The CA your CISO has been waiting for.

Certificate Authorities

Multi-CA hierarchy (Root, Sub-CA, import)

Classical cryptography (RSA, ECDSA)

28 built-in templates (7 EKU x 4 families)

Custom templates (admin-defined policies)

Full CRL, Delta CRL and OCSP Responder

Users

Certificate authorities

Administration & governance

Admin UI + Sysadmin UI

Full REST API

RBAC 3 roles (Admin, Operator, Auditor)

Hash-chained audit log + Prometheus

Ceremony control (TIER 1 mandatory + TIER 2 quorum)

mTLS authentication

Encrypted backup / restore

Infrastructure

LDAP / Active Directory

KMS envelope encryption (AWS KMS, Vault Transit, GCP KMS, Fernet fallback)

HSM / PKCS#11 (tested Utimaco, any PKCS#11 compatible)

High availability (Patroni + HAProxy)

SIEM (Syslog)

Post-Quantum

Free 30-day trial included

Quantum

ML-DSA, composite, dual-cert. Native post-quantum issuance, ML-DSA signing in Utimaco HSM.

Certificate Authorities

Multi-CA hierarchy (Root, Sub-CA, import)

Classical cryptography (RSA, ECDSA)

28 built-in templates (7 EKU x 4 families)

Custom templates (admin-defined policies)

Full CRL, Delta CRL and OCSP Responder

Users

Certificate authorities

Administration & governance

Admin UI + Sysadmin UI

Full REST API

RBAC 3 roles (Admin, Operator, Auditor)

Hash-chained audit log + Prometheus

Ceremony control (TIER 1 mandatory + TIER 2 quorum)

mTLS authentication

Encrypted backup / restore

Infrastructure

LDAP / Active Directory

KMS envelope encryption (AWS KMS, Vault Transit, GCP KMS, Fernet fallback)

HSM / PKCS#11 (tested Utimaco, any PKCS#11 compatible)

High availability (Patroni + HAProxy)

SIEM (Syslog)

Post-Quantum

ML-DSA (Dilithium), SLH-DSA (SPHINCS+), FN-DSA (Falcon)

IETF Composite (ECDSA+ML-DSA, RSA+ML-DSA…)

Dual-cert (RFC 9763 RelatedCertificate) and Hybrid AltSig (X.509 §9.8)

Cryptographic family segregation

ML-DSA in HSM (Utimaco QuantumProtect) — SLH-DSA / FN-DSA in software

FIPS 204 §6.2 external-μ optimization (high-throughput ML-DSA signing)

Free 30-day trial included

Starter

Full classical PKI. Zero license, zero compromise.

Recommended

Enterprise

Hardware HSM, HA and LDAP. The CA your CISO has been waiting for.

Free 30-day trial included

Quantum

ML-DSA, composite, dual-cert. Native post-quantum issuance, ML-DSA signing in Utimaco HSM.

Free 30-day trial included

Certificate Authorities

Multi-CA hierarchy (Root, Sub-CA, import)

Classical cryptography (RSA, ECDSA)

28 built-in templates (7 EKU x 4 families)

Custom templates (admin-defined policies)

Full CRL, Delta CRL and OCSP Responder

Users

10 max

Certificate authorities

3 max

Administration & governance

Admin UI + Sysadmin UI

Full REST API

RBAC 3 roles (Admin, Operator, Auditor)

Hash-chained audit log + Prometheus

Ceremony control (TIER 1 mandatory + TIER 2 quorum)

mTLS authentication

Encrypted backup / restore

Infrastructure

LDAP / Active Directory

KMS envelope encryption (AWS KMS, Vault Transit, GCP KMS, Fernet fallback)

HSM / PKCS#11 (tested Utimaco, any PKCS#11 compatible)

High availability (Patroni + HAProxy)

SIEM (Syslog)

Post-Quantum

ML-DSA (Dilithium), SLH-DSA (SPHINCS+), FN-DSA (Falcon)

IETF Composite (ECDSA+ML-DSA, RSA+ML-DSA…)

Dual-cert (RFC 9763 RelatedCertificate) and Hybrid AltSig (X.509 §9.8)

Cryptographic family segregation

ML-DSA in HSM (Utimaco QuantumProtect) — SLH-DSA / FN-DSA in software

FIPS 204 §6.2 external-μ optimization (high-throughput ML-DSA signing)

A CA built for your scale.

Starter

Enterprise

Quantum

Starter

Enterprise

Quantum

Contact Us

A CA built for your scale.

Starter

Enterprise

Quantum

Starter

Enterprise

Quantum

Contact Us