- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Entrust PKI
The certificates your own systems trust — machine identities, device certificates, internal TLS, code signing. Read the scope carefully: this is private PKI. Entrust sold its public TLS certificate business to Sectigo in September 2025.
Data residency & processing — two different questions
Where data lives
Yours — on-premises appliances in India
nShield HSMs are physical appliances in your own data centre, and private PKI can run on-premises too. Keys are generated and held in hardware you own, in India, under your administrators — residency is demonstrated by an access log and a hardware serial number rather than by contract terms.
The constraint, stated plainly
No India region for the managed service
nShield as a Service runs in the UK, US, Germany and Australia. Entrust has live engineering hiring in Bengaluru and Pune, and that is people in India, not data in India — passing off an engineering team as residency evidence is a mistake that tends to surface in an audit.
For a residency-bound Indian buyer the answer is appliances you operate, which is very likely what your regulator wanted anyway. Note what does not exist so its absence is not misread: Gartner publishes no Magic Quadrant for HSM or key management at all, only Market Guides, which have no Leader quadrant — and we could not verify an HSM Leader placement for Entrust with any analyst. A search caution specific to this vendor: “Entrust India” surfaces several unrelated companies, including a Bengaluru wealth manager, so check you are reading about Entrust Corporation before drawing conclusions.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Entrust portfolio
This page covers Entrust PKI — the private certificate authority. The rest of the Entrust portfolio on TechBag:
Quick facts
30-second orientation- Product
- Entrust PKI — private certificate authority
- CRITICAL SCOPE
- PRIVATE PKI — public TLS was sold to Sectigo, Sept 2025
- What it issues
- Machine identities, device certs, internal TLS, code signing
- On-premises
- Entrust Certificate Authority, or the PKI Hub appliance
- As a service
- PKIaaS — US (Dallas, Denver) or EU (Munich, Frankfurt)
- Enrolment
- ACME, EST, SCEP, CMP, plus Intune, Jamf and other MDMs
- CA keys
- nShield HSMs — yours on-prem, Entrust's in PKIaaS
- Vendor
- Entrust — CEO Tony Ball, from 31 March 2026
- Ownership
- Private, via Datacard — Germany's Quandt family
- PKI Hub
- Launched January 2025 — CA, CLM, OCSP, timestamping
- Analyst standing
- No private-PKI analyst ranking cited here
- Data residency
- PKIaaS has no India region; on-prem keeps the CA in India
- Pricing
- Quote-only — no published list price
- Buy in India via
- TechBag — INR, GST, deployment scoping
Understand private PKI before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
Private certificate authority infrastructure — the certificates your own organisation issues and your own systems trust.
Ad-hoc certificates vs a private CA — the honest table
What a private CA changes, dimension by dimension.
| Dimension | Ad-hoc / self-signed certificates | Entrust PKI |
|---|---|---|
| Who issues certificates | Whoever needs one, self-signed | One CA under one policy |
| The trust decision | Click past the warning | Chains to a root you control |
| Device onboarding | Manual export and import | Enrolled via MDM or SCEP |
| Renewal | A calendar reminder, if any | ACME or EST, automatically |
| Revocation | Not possible in practice | CRL and OCSP |
| CA key protection | A file on a server | Held in an HSM |
| Audit trail | None | Every issuance logged |
| Public websites | Need a public CA | Still need a public CA — not this |
Private PKI issues trust only your own systems honour. Browser-trusted certificates for public websites need a public CA — Entrust sold that business to Sectigo in 2025. TechBag scopes both sides.
The five pieces of a private PKI
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Root CA
A root key kept offline or in an HSM signs only the issuing CAs beneath it; everything your systems trust chains back to it, so protecting it is the whole game.
Issuing CAs
Subordinate CAs sign end-entity certificates under policies you define — split by use case, so a problem with device certificates never touches code signing.
Enrolment
ACME, EST, SCEP and CMP, plus MDM connectors such as Intune and Jamf, let servers and devices request and renew certificates without raising a ticket.
Validation
CRLs and OCSP let relying systems check whether a certificate was revoked — the part home-grown PKIs neglect until a compromised key forces the question.
Deployment
Run Entrust Certificate Authority or the PKI Hub appliance in your own data centre, or subscribe to PKIaaS hosted in Entrust’s US or EU data centres.
Everything chains back to a root you control; automation and revocation are what keep that trust current.
Twelve capabilities. Issue, automate, govern.
What Entrust PKI actually does — issue certificates under your own root, enrol and renew them automatically, and keep revocation and policy under control.
Your Own Root of Trust
A root and issuing hierarchy you control, so trust is decided by your policy rather than by a browser vendor or a commercial CA’s audit record.
Certificate Profiles per Use Case
Separate templates for servers, devices, users, code signing and S/MIME, each with its own validity, key type and extensions.
CA Keys in nShield HSMs
Protect root and issuing keys in nShield HSMs on-premises; in PKIaaS, Entrust holds them in nShield HSMs inside Tier III data centres.
RFC 3161 Timestamping
PKI Hub includes a timestamping authority, so signed code and documents can prove when they were signed long after the certificate expires.
Standard Enrolment Protocols
ACME, EST, SCEP and CMP let servers, network gear and devices enrol and renew on their own — the only way short lifetimes stay manageable.
Device Enrolment via MDM
PKIaaS connects to Intune, Jamf, Workspace ONE, Ivanti and MaaS360, so managed laptops and phones receive certificates as they are provisioned.
REST API for Issuance
Entrust CA Gateway exposes issuance, revocation and reporting over a REST API, for DevOps pipelines and third-party tools.
One Container-Based Appliance
PKI Hub packages the CA, enrolment gateway, OCSP, timestamping and Certificate Hub as one virtual appliance for cloud or on-premises.
CRL and OCSP Validation
Revoke a certificate and relying systems learn of it through published CRLs or real-time OCSP responses.
Certificates You Can See
Certificate Hub, bundled in PKI Hub, inventories certificates from Entrust and other CAs, so the private PKI is never a black box.
Issuance Policy You Define
Who may request which certificate, with what key length and validity, is set in policy — and every issuance is auditable afterwards.
Post-Quantum Readiness
Entrust describes PKI Hub as post-quantum-ready; test the specific algorithms and client support you need before depending on it.
Watch Entrust PKI in action
What Entrust PKI is, and where it sits in Entrust’s Cryptographic Security Platform.
What is Entrust PKI?
Private PKI, presented by Entrust.
Cryptographic Security Platform Overview
Where PKI sits.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Machines outnumber people. So do their certificates.
Here’s what genuinely sets Entrust PKI apart.
Private PKI was not part of the Sectigo sale
This is the first thing to establish, because the internet will mislead you. Entrust sold its public TLS certificate business to Sectigo in September 2025 after browser distrust, and a great deal of well-ranked material still describes Entrust as a public certificate authority. Private PKI is a different product with a different trust model and it was not sold. The distinction is substantive rather than legal: a public certificate is trusted because browsers ship the root, while a private certificate is trusted because your organisation configured its systems to trust your CA. The browser distrust event was fatal to the first and does not carry the same implication for the second.
Machine identity is the volume problem nobody sized for
Human users get identity governance, joiner-mover-leaver processes and access reviews. Machine identities — services, workloads, containers, devices — vastly outnumber them in any modern estate and frequently get a spreadsheet. Every one of them needs a certificate, those certificates expire, and the number keeps growing as infrastructure becomes more automated. Private PKI is the infrastructure that makes issuing them a process rather than a series of individual favours, and the sizing that matters is workload count rather than headcount.
Shortening certificate lifetimes make automation mandatory
Industry certificate validity periods keep contracting, and the direction of travel is clear. Manual issuance and renewal scale badly against that: a process that worked when certificates lasted years becomes a recurring outage generator when they last months. A private CA with automation is what turns a shortening lifetime from an operational threat into a non-event, and it is the reason PKI investment is rising in organisations that had considered it a solved problem.
You define the trust, which is the point
With a private CA, your organisation decides what its systems trust and on what terms — issuance policy, validity periods, revocation, which identities may receive which certificates. That control is exactly what makes it appropriate for internal machine identity, where the relevant question is not whether the wider internet trusts a certificate but whether your systems should. It also means you are not dependent on a commercial CA's compliance record, which is a lesson the last two years made vivid.
The honest positioning
Buy Entrust PKI when you need certificates your own systems trust and you want the CA infrastructure run properly rather than improvised — particularly if machine identity volume is growing faster than your ability to issue by hand. Do not buy it expecting public TLS certificates, which Entrust no longer sells. And if you are already deploying nShield, running the private CA rooted in the same hardware is a coherent architecture rather than two separate purchases, which is a genuine reason to consider them together.
The numbers behind Entrust
What your Entrust PKI journey looks like
Separate public from private
List which certificates must be browser-trusted — those need a public CA now — and which only your own systems must trust. Only the second list is this product.
Count machine identities, not people
Inventory servers, devices, containers and signing use cases. Sizing a private CA by headcount misses most of the certificates it will issue.
Choose on-premises or PKIaaS
PKIaaS runs only in US or EU data centres. If CA keys or records must stay in India, plan Entrust Certificate Authority or PKI Hub on your hardware.
Build the hierarchy and the ceremony
Generate the root in an HSM at a witnessed key ceremony, stand up issuing CAs per use case, and publish CRL and OCSP before issuing anything.
Automate enrolment and renewal
Move servers to ACME or EST and devices to MDM enrolment, so renewals happen without tickets as certificate lifetimes shorten.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Our Wi-Fi and VPN certificates now arrive through Intune. The helpdesk queue for expired laptop certificates disappeared.”
“We assumed private PKI went to Sectigo with the public business. It did not, and that saved us a migration.”
“Rooting the CA in the nShield units we already owned is why we chose it over rebuilding AD CS.”
“PKIaaS was the easy option until residency came up. No India region, so we deployed on-premises.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the private-PKI market — tap any vendor to see why it sits where it does.
TechBag Private-PKI Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Private CA on-prem, as an appliance or as a service; CA keys in nShield.
Enrolment Automation × CA Control
How widely certificates can be enrolled automatically vs how much control you keep over the CA and its keys.
Broad enrolment, with CA keys in its own HSMs.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Entrust PKI vs the private-CA field
Microsoft AD CS, Keyfactor EJBCA, AWS Private CA and DigiCert — honest lanes; the edge is a private CA with nShield-backed keys, on-premises or as a service.
| Dimension | Entrust PKI | Microsoft AD CS | Keyfactor EJBCA | AWS Private CA | DigiCert |
|---|---|---|---|---|---|
| What it actually is | Private CA on-prem, as an appliance, or as a service | The CA role built into Windows Server | Open-source-rooted CA, community and enterprise editions | Managed private CA inside AWS | Public CA that also sells private PKI |
| Public TLS certificates | Sold to Sectigo, Sept 2025 | Private only | Private only | Private only — public certificates come from ACM | A public CA |
| Managed option | PKIaaS, US or EU regions | You run it | SaaS and cloud-marketplace editions | Fully managed | DigiCert-hosted private CA |
| HSM protection of CA keys | nShield, same vendor | Supported with a third-party HSM | PKCS#11 HSMs supported | Keys held in AWS-managed HSMs | HSM-backed hosted CAs |
| Enrolment automation | ACME, EST, SCEP, CMP, MDM connectors | Autoenrollment for domain machines; NDES for SCEP | ACME, EST, SCEP, CMP | API and AWS-integrated services | ACME and connectors |
| India data residency | On-prem yes; PKIaaS has no India region | Runs wherever your servers are | Self-host anywhere | Depends on the AWS region — confirm availability | Confirm hosted regions with DigiCert |
| Published pricing | Quote-only | Included with the Windows Server licence | Community edition is free | Per-CA and per-certificate prices published | Quote-only |
| The thing to plan around | On-prem vs PKIaaS against your residency rule | Hardening and high availability are yours to build | Community edition needs in-house PKI skill | Best when workloads already live in AWS | Keep public and private scopes separate in the contract |
| Best fit | Private PKI rooted in nShield hardware | Windows-domain estates with PKI skills | Teams that want open-source roots | AWS-native workloads | One vendor for public and private certificates |
Which private-PKI approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Entrust PKI if…
- ✓You need a private CA run properly, not improvised
- ✓You want CA keys in nShield hardware
- ✓On-premises suits your residency rule, or US/EU hosting is fine
- ✓Device and server enrolment must be automated
Microsoft AD CS if…
- ✓Your estate is Windows-domain-centric and you have PKI skills
Keyfactor EJBCA if…
- ✓You want open-source roots with an enterprise option
AWS Private CA if…
- ✓Your workloads and identities already live in AWS
A public CA if…
- ✓You need browser-trusted certificates — Entrust no longer sells these
Entrust PKI is one of 21 encryption & rights management products TechBag carries. The encryption & rights management guide narrows them to a shortlist and shows the reasoning. →
What could this save you?
Drag the sliders (certificates issued per year; loaded engineer-hour cost). Estimates assume the manual request, issuance and renewal effort removed once enrolment is automated — the larger, unpriced win is the outage an expired or rogue certificate never causes. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Entrust PKI is quote-priced (no public list) — shaped by deployment (on-premises CA, PKI Hub appliance or PKIaaS), the number of CAs and certificates, and whether you add nShield HSMs for the CA keys. TechBag right-sizes it and quotes in INR with GST.
On-premises CA
Best when CA keys must stay in India
- Entrust Certificate Authority on your servers
- Root and issuing keys in your nShield HSMs
- You run availability and upgrades
PKI Hub appliance
Best for a faster on-premises build
- CA, enrolment, OCSP and timestamping together
- Certificate Hub lifecycle management included
- Cloud or on-premises deployment
PKI as a Service
Best when US or EU hosting is acceptable
- Dedicated CAs operated by Entrust
- CA keys in hosted nShield HSMs
- No India region — check residency first
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 10 questions to ask every vendor
Take this into your next vendor call — including ours.
Have we separated browser-trusted certificates (a public CA) from private ones (this product)?
How many machine identities — servers, devices, workloads — will this CA issue to within three years?
On-premises CA, PKI Hub appliance or PKIaaS — and which does our residency rule allow?
Are we clear that PKIaaS runs only in US or EU data centres, with no India region?
Where will the root key live — an nShield HSM we own, or Entrust’s hosted HSMs?
How many issuing CAs, split by which use cases and trust boundaries?
Which protocols do our devices and servers support — ACME, EST, SCEP, CMP or MDM?
Where will CRLs and OCSP be published, and can every relying system reach them?
What happens to certificates issued by our existing CA during the cut-over?
What drives the price — CAs, certificates or appliances — and what does renewal look like?
Questions buyers ask
Ready to run your own trust properly?
Separate public from private certificates, choose on-premises or PKIaaS against your residency rule, or let a TechBag advisor scope the hierarchy with you.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.