Entrust PKI
The certificates your own systems trust — machine identities, device certificates, internal TLS, code signing. Read the scope carefully: this is private PKI. Entrust sold its public TLS certificate business to Sectigo in September 2025.
Data residency & processing — two different questions
Where data lives
Yours — on-premises appliances in India
nShield HSMs are physical appliances in your own data centre, and private PKI can run on-premises too. Keys are generated and held in hardware you own, in India, under your administrators — residency is demonstrated by an access log and a hardware serial number rather than by contract terms.
The constraint, stated plainly
No India region for the managed service
nShield as a Service runs in the UK, US, Germany and Australia. Entrust has live engineering hiring in Bengaluru and Pune, and that is people in India, not data in India — passing off an engineering team as residency evidence is a mistake that tends to surface in an audit.
For a residency-bound Indian buyer the answer is appliances you operate, which is very likely what your regulator wanted anyway. Note what does not exist so its absence is not misread: Gartner publishes no Magic Quadrant for HSM or key management at all, only Market Guides, which have no Leader quadrant — and we could not verify an HSM Leader placement for Entrust with any analyst. A search caution specific to this vendor: “Entrust India” surfaces several unrelated companies, including a Bengaluru wealth manager, so check you are reading about Entrust Corporation before drawing conclusions.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Entrust portfolio
This page covers Entrust PKI — the private certificate authority. The rest of the Entrust portfolio on TechBag:
Quick facts
30-second orientation- Product
- Entrust PKI — private certificate authority
- CRITICAL SCOPE
- PRIVATE PKI — public TLS was sold to Sectigo, Sept 2025
- What it issues
- Machine identities, device certs, internal TLS, code signing
- On-premises
- Entrust Certificate Authority, or the PKI Hub appliance
- As a service
- PKIaaS — US (Dallas, Denver) or EU (Munich, Frankfurt)
- Enrolment
- ACME, EST, SCEP, CMP, plus Intune, Jamf and other MDMs
- CA keys
- nShield HSMs — yours on-prem, Entrust's in PKIaaS
- Vendor
- Entrust — CEO Tony Ball, from 31 March 2026
- Ownership
- Private, via Datacard — Germany's Quandt family
- PKI Hub
- Launched January 2025 — CA, CLM, OCSP, timestamping
- Analyst standing
- No private-PKI analyst ranking cited here
- Data residency
- PKIaaS has no India region; on-prem keeps the CA in India
- Pricing
- Quote-only — no published list price
- Buy in India via
- TechBag — INR, GST, deployment scoping
Understand private PKI before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
Private certificate authority infrastructure — the certificates your own organisation issues and your own systems trust.
Ad-hoc certificates vs a private CA — the honest table
What a private CA changes, dimension by dimension.
| Dimension | Ad-hoc / self-signed certificates | Entrust PKI |
|---|---|---|
| Who issues certificates | Whoever needs one, self-signed | One CA under one policy |
| The trust decision | Click past the warning | Chains to a root you control |
| Device onboarding | Manual export and import | Enrolled via MDM or SCEP |
| Renewal | A calendar reminder, if any | ACME or EST, automatically |
| Revocation | Not possible in practice | CRL and OCSP |
| CA key protection | A file on a server | Held in an HSM |
| Audit trail | None | Every issuance logged |
| Public websites | Need a public CA | Still need a public CA — not this |
Private PKI issues trust only your own systems honour. Browser-trusted certificates for public websites need a public CA — Entrust sold that business to Sectigo in 2025. TechBag scopes both sides.
The five pieces of a private PKI
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Root CA
A root key kept offline or in an HSM signs only the issuing CAs beneath it; everything your systems trust chains back to it, so protecting it is the whole game.
Issuing CAs
Subordinate CAs sign end-entity certificates under policies you define — split by use case, so a problem with device certificates never touches code signing.
Enrolment
ACME, EST, SCEP and CMP, plus MDM connectors such as Intune and Jamf, let servers and devices request and renew certificates without raising a ticket.
Validation
CRLs and OCSP let relying systems check whether a certificate was revoked — the part home-grown PKIs neglect until a compromised key forces the question.
Deployment
Run Entrust Certificate Authority or the PKI Hub appliance in your own data centre, or subscribe to PKIaaS hosted in Entrust’s US or EU data centres.
Everything chains back to a root you control; automation and revocation are what keep that trust current.
Twelve capabilities. Issue, automate, govern.
What Entrust PKI actually does — issue certificates under your own root, enrol and renew them automatically, and keep revocation and policy under control.
Your Own Root of Trust
A root and issuing hierarchy you control, so trust is decided by your policy rather than by a browser vendor or a commercial CA’s audit record.
Certificate Profiles per Use Case
Separate templates for servers, devices, users, code signing and S/MIME, each with its own validity, key type and extensions.
CA Keys in nShield HSMs
Protect root and issuing keys in nShield HSMs on-premises; in PKIaaS, Entrust holds them in nShield HSMs inside Tier III data centres.
RFC 3161 Timestamping
PKI Hub includes a timestamping authority, so signed code and documents can prove when they were signed long after the certificate expires.
Standard Enrolment Protocols
ACME, EST, SCEP and CMP let servers, network gear and devices enrol and renew on their own — the only way short lifetimes stay manageable.
Device Enrolment via MDM
PKIaaS connects to Intune, Jamf, Workspace ONE, Ivanti and MaaS360, so managed laptops and phones receive certificates as they are provisioned.
REST API for Issuance
Entrust CA Gateway exposes issuance, revocation and reporting over a REST API, for DevOps pipelines and third-party tools.
One Container-Based Appliance
PKI Hub packages the CA, enrolment gateway, OCSP, timestamping and Certificate Hub as one virtual appliance for cloud or on-premises.
CRL and OCSP Validation
Revoke a certificate and relying systems learn of it through published CRLs or real-time OCSP responses.
Certificates You Can See
Certificate Hub, bundled in PKI Hub, inventories certificates from Entrust and other CAs, so the private PKI is never a black box.
Issuance Policy You Define
Who may request which certificate, with what key length and validity, is set in policy — and every issuance is auditable afterwards.
Post-Quantum Readiness
Entrust describes PKI Hub as post-quantum-ready; test the specific algorithms and client support you need before depending on it.
Watch Entrust PKI in action
What Entrust PKI is, and where it sits in Entrust’s Cryptographic Security Platform.
What is Entrust PKI?
Private PKI, presented by Entrust.
Cryptographic Security Platform Overview
Where PKI sits.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Machines outnumber people. So do their certificates.
Here’s what genuinely sets Entrust PKI apart.
Private PKI was not part of the Sectigo sale
Entrust sold its public TLS certificate business to Sectigo in September 2025 after browser distrust, though much online material still calls it a public CA. Private PKI was not sold and works differently: certificates are trusted because your systems trust your CA, not because browsers ship a root, so the distrust doesn’t carry over.
Machine identity is the volume problem nobody sized for
Human users get identity governance and access reviews, but machine identities, such as services, workloads, containers and devices, far outnumber them and often get a spreadsheet. Each needs expiring certificates in growing numbers. Private PKI makes issuing them a process, sized by workload count, not headcount.
Shortening certificate lifetimes make automation mandatory
Certificate validity periods keep shrinking, and manual issuance that coped when certificates lasted years causes repeated outages when they last months. A private CA with automation makes shorter lifetimes a non-event, which is why PKI spending is rising in organisations that thought this solved.
You define the trust, which is the point
A private CA lets your organisation set issuance policy, validity, revocation and which identities get which certificates. That suits internal machine identity, where the question is whether your systems should trust a certificate, and it frees you from dependence on a commercial CA’s compliance record.
The honest positioning
Buy Entrust PKI when your own systems must trust the certificates and you want the CA run properly, especially as machine identity outgrows manual issuance. It no longer sells public TLS certificates. If you are deploying nShield, rooting the private CA in the same hardware is a coherent architecture.
The numbers behind Entrust
What your Entrust PKI journey looks like
Separate public from private
Split certificates browsers must trust (now a public CA’s job) from those only your systems trust; this product covers the latter.
Count machine identities, not people
Inventory servers, devices, containers and signing use cases. Sizing a private CA by headcount misses most of the certificates it will issue.
Choose on-premises or PKIaaS
PKIaaS runs only in US or EU data centres; to keep CA keys in India, use Entrust Certificate Authority or PKI Hub on your hardware.
Build the hierarchy and the ceremony
Generate the root in an HSM at a witnessed key ceremony, stand up issuing CAs per use case, and publish CRL and OCSP before issuing anything.
Automate enrolment and renewal
Move servers to ACME or EST and devices to MDM enrolment, so renewals happen without tickets as certificate lifetimes shorten.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Our Wi-Fi and VPN certificates now arrive through Intune. The helpdesk queue for expired laptop certificates disappeared.”
“We assumed private PKI went to Sectigo with the public business. It did not, and that saved us a migration.”
“Rooting the CA in the nShield units we already owned is why we chose it over rebuilding AD CS.”
“PKIaaS was the easy option until residency came up. No India region, so we deployed on-premises.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the private-PKI market — tap any vendor to see why it sits where it does.
TechBag Private-PKI Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Private CA on-prem, as an appliance or as a service; CA keys in nShield.
Enrolment Automation × CA Control
How widely certificates can be enrolled automatically vs how much control you keep over the CA and its keys.
Broad enrolment, with CA keys in its own HSMs.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Entrust PKI vs the private-CA field
Microsoft AD CS, Keyfactor EJBCA, AWS Private CA and DigiCert — honest lanes; the edge is a private CA with nShield-backed keys, on-premises or as a service.
| Dimension | Entrust PKI | Microsoft AD CS | Keyfactor EJBCA | AWS Private CA | DigiCert |
|---|---|---|---|---|---|
| What it actually is | Private CA on-prem, as an appliance, or as a service | The CA role built into Windows Server | Open-source-rooted CA, community and enterprise editions | Managed private CA inside AWS | Public CA that also sells private PKI |
| Public TLS certificates | Sold to Sectigo, Sept 2025 | Private only | Private only | Private only — public certificates come from ACM | A public CA |
| Managed option | PKIaaS, US or EU regions | You run it | SaaS and cloud-marketplace editions | Fully managed | DigiCert-hosted private CA |
| HSM protection of CA keys | nShield, same vendor | Supported with a third-party HSM | PKCS#11 HSMs supported | Keys held in AWS-managed HSMs | HSM-backed hosted CAs |
| Enrolment automation | ACME, EST, SCEP, CMP, MDM connectors | Autoenrollment for domain machines; NDES for SCEP | ACME, EST, SCEP, CMP | API and AWS-integrated services | ACME and connectors |
| India data residency | On-prem yes; PKIaaS has no India region | Runs wherever your servers are | Self-host anywhere | Depends on the AWS region — confirm availability | Confirm hosted regions with DigiCert |
| Published pricing | Quote-only | Included with the Windows Server licence | Community edition is free | Per-CA and per-certificate prices published | Quote-only |
| The thing to plan around | On-prem vs PKIaaS against your residency rule | Hardening and high availability are yours to build | Community edition needs in-house PKI skill | Best when workloads already live in AWS | Keep public and private scopes separate in the contract |
| Best fit | Private PKI rooted in nShield hardware | Windows-domain estates with PKI skills | Teams that want open-source roots | AWS-native workloads | One vendor for public and private certificates |
Which private-PKI approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Entrust PKI if…
- ✓You need a private CA run properly, not improvised
- ✓You want CA keys in nShield hardware
- ✓On-premises suits your residency rule, or US/EU hosting is fine
- ✓Device and server enrolment must be automated
Microsoft AD CS if…
- ✓Your estate is Windows-domain-centric and you have PKI skills
Keyfactor EJBCA if…
- ✓You want open-source roots with an enterprise option
AWS Private CA if…
- ✓Your workloads and identities already live in AWS
A public CA if…
- ✓You need browser-trusted certificates — Entrust no longer sells these
Entrust PKI is one of 22 encryption & rights management products TechBag carries. The encryption & rights management guide narrows them to a shortlist and shows the reasoning. →
What could this save you?
Drag the sliders (certificates issued per year; loaded engineer-hour cost). Estimates assume the manual request, issuance and renewal effort removed once enrolment is automated — the larger, unpriced win is the outage an expired or rogue certificate never causes. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Entrust PKI is quote-priced (no public list) — shaped by deployment (on-premises CA, PKI Hub appliance or PKIaaS), the number of CAs and certificates, and whether you add nShield HSMs for the CA keys. TechBag right-sizes it and quotes in INR with GST.
On-premises CA
Best when CA keys must stay in India
- Entrust Certificate Authority on your servers
- Root and issuing keys in your nShield HSMs
- You run availability and upgrades
PKI Hub appliance
Best for a faster on-premises build
- CA, enrolment, OCSP and timestamping together
- Certificate Hub lifecycle management included
- Cloud or on-premises deployment
PKI as a Service
Best when US or EU hosting is acceptable
- Dedicated CAs operated by Entrust
- CA keys in hosted nShield HSMs
- No India region — check residency first
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 10 questions to ask every vendor
Take this into your next vendor call — including ours.
Have we separated browser-trusted certificates (a public CA) from private ones (this product)?
How many machine identities — servers, devices, workloads — will this CA issue to within three years?
On-premises CA, PKI Hub appliance or PKIaaS — and which does our residency rule allow?
Are we clear that PKIaaS runs only in US or EU data centres, with no India region?
Where will the root key live — an nShield HSM we own, or Entrust’s hosted HSMs?
How many issuing CAs, split by which use cases and trust boundaries?
Which protocols do our devices and servers support — ACME, EST, SCEP, CMP or MDM?
Where will CRLs and OCSP be published, and can every relying system reach them?
What happens to certificates issued by our existing CA during the cut-over?
What drives the price — CAs, certificates or appliances — and what does renewal look like?
Questions buyers ask
Ready to run your own trust properly?
Separate public from private certificates, choose on-premises or PKIaaS against your residency rule, or let a TechBag advisor scope the hierarchy with you.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.