Your own dedicated Certificate Authority — without the compliance program overhead
Private Compliance PKI is a cloud-hosted, WebTrust-audited CA hierarchy that belongs entirely to your organization. Your own Root CA and Issuing CA(s), HSM-backed keys, auditor-witnessed Key Ceremonies, and independently verified compliance controls — operated by SSL on the same infrastructure that underpins our public trust platform.
Dedicated CA infrastructure. Full control. Internal trust.
Private Enterprise PKI provides the same underlying platform as Private Compliance PKI — the same FIPS-hardened HSM infrastructure, the same unified REST API, the same enrollment protocols, and the same observability capabilities — without the WebTrust compliance program and its associated Key Ceremony audit requirements.
What you get:
Your own Root CA
A dedicated CA hierarchy — your Root and Issuing CAs are not shared with any other organization.
HSM-backed CA keys
CA keys generated and stored in FIPS 140-2 Level 3 certified Hardware Security Modules — never exportable in plaintext.
Full certificate lifecycle
Issuance, renewal, rekey, rollover, revocation via ACME, SCEP, EST, and REST API. Built for Kubernetes, MDM, DevOps pipelines.
Custom certificate profiles
Define profiles for your internal use cases — TLS, Client Auth, Code Signing, Device Identity.
What is different from Private Compliance PKI: No WebTrust independent audit coverage, no auditor-witnessed Key Ceremony, trust scope is internal only — certificates issued are not suitable for supply chain or partner ecosystem compliance claims. Lower cost.
Key benefits
Who Private Enterprise PKI is for
Private Enterprise PKI is the right choice when:
- Your use cases are internal only and you do not need to demonstrate your PKI governance to external partners, regulators, or customers
- You need a dedicated CA hierarchy — not a shared platform — for policy, naming, or organizational reasons
- You are running internal mTLS, VPN/Wi?Fi authentication, internal device identity, or developer/staging certificate infrastructure
- Your organization wants full CA control over certificate profiles and policies without the compliance overhead
- You want to progress to Private Compliance PKI in the future — Private Enterprise PKI uses the same platform and can be upgraded
If you need to demonstrate independently audited CA governance externally — for supply chain requirements, regulated industry compliance, or partner ecosystem trust — choose Private Compliance PKI instead.
Service tiers
Pricing is indicative and subject to change. Contact us for a tailored quote.
Lab
- Developer & Testing
- 25 active certs included
- 1 CA (self-signed)
- 100 OCSP responses / month
- Dev, testing & automation prototyping
- Not for production use
Pro
- Small Teams
- 250 active certs included
- 2 CAs
- 10,000 OCSP responses / month
- Internal mTLS, VPN/Wi?Fi (EAP?TLS), small device fleet
- Or $200 / month (PAYG)
- Overage applies above 250 active certs
Business
- Mid-Market
- 5,000 active certs included
- 5 CAs
- 1,000,000 OCSP responses / month
- Multiple use cases (TLS, Client Auth, Device Identity, Code Signing)
- Or $500 / month (PAYG)
- Overage applies above 5,000 active certs
Enterprise
- Large Organizations
- 100,000 active certs included
- 15 CAs
- 10,000,000 OCSP responses / month
- All use cases — Kubernetes, multi-cloud, Intune/Jamf MDM, high-volume device identity
- Or $1,500 / month (PAYG)
- Overage applies above 100,000 active certs
Strategic
- Government & Global Scale
- Custom active cert volume
- Custom CA hierarchy
- Custom OCSP volume
- Government, global enterprises, specialized deployments
- Pricing available upon request
Active = Total Issued − Expired − Revoked. You are only billed for certificates currently valid.
Tier comparison
| 🔹 Lab | 🔸 Pro | 🔶 Business | 🔺 Enterprise | ⭐ Strategic | |
|---|---|---|---|---|---|
| Annual fee | Free | $2,000 / yr | $5,000 / yr | $15,000 / yr | Custom |
| Monthly (PAYG) | Free | $200 / mo | $500 / mo | $1,500 / mo | Custom |
| CA hierarchy | 1 (self-signed) | 2 | 5 | 15 | Custom |
| Included active certs | 25 | 250 | 5,000 | 100,000 | Custom |
| Included OCSP / month | 100 | 10,000 | 1,000,000 | 10,000,000 | Custom |
| Overage | — | Above 250 | Above 5,000 | Above 100,000 | Custom |
Variable Overage Rates — applied when plan limits are exceeded:
- Additional active certificate: $0.15 per certificate / month
- Additional OCSP responses: $0.25 per 100,000 responses
Common use cases
How onboarding works
Compliance & standards
WebTrust for CAs
SSL's dedicated PKI operations are covered by the same WebTrust audit as our public trust platform
FIPS 140-2 Level 3
All CA keys stored and generated in certified HSMs
RFC 5280 (X.509)
All certificates conform to X.509/RFC 5280
ACME RFC 8555
Native ACME support for automated lifecycle management
SCEP / EST
Supported for MDM, network device, and mobile certificate enrollment
NIST PQC standards
ML-KEM, ML-DSA, SLH-DSA hybrid profiles available (Ecosystem tier)
Frequently asked questions
Both give you a dedicated Root CA and Issuing CA(s) on the same FIPS-hardened platform. The difference is the WebTrust audit. Private Compliance PKI's Key Ceremony is witnessed by SSL's independent auditor, and your hierarchy is covered by the same audit program as our public trust operations — giving you "audit pass-through" for SOC2, HIPAA, supply chain, and partner compliance requirements. Private Enterprise PKI is the same infrastructure without the compliance program.
Managed PKI Certificates is a shared multi-tenant service — you don't own the Root CA. Private Enterprise PKI gives you a fully dedicated CA hierarchy with your own Root CA and custom certificate policies, not shared with any other tenant.
Yes — because both products are built on the same platform, upgrading to add WebTrust audit coverage is a process discussion, not an infrastructure migration.
Internal mTLS and service mesh, VPN/Wi-Fi authentication (EAP-TLS), internal device identity, developer and staging CAs, Kubernetes workload identity, and any scenario where you need a dedicated CA hierarchy for internal trust without external compliance requirements.
Ready to build your dedicated internal PKI?
Related Products
Private Compliance PKI
Same dedicated infrastructure + WebTrust audit coverage — for regulated and compliance use cases.
Managed PKI Certificates
WebTrust-audited private PKI on shared infrastructure — no dedicated Root CA, lower cost.
Custom-Branded Issuing CA
Publicly trusted certificates under your brand — no Root CA management required.
