Private Compliance PKI
A fully audited Certificate Authority, dedicated to your organization
Private Compliance PKI is a cloud-hosted, WebTrust-audited CA hierarchy that belongs entirely to your organization. Your own Root CA and Issuing CA(s), HSM-backed keys, auditor-witnessed Key Ceremonies, and independently verified compliance controls, operated by SSL on the same infrastructure that underpins our public trust platform.
WebTrust governance. Your hierarchy. Your policies.
Private Compliance PKI is managed PKI-as-a-service built for organizations that need the flexibility of a private CA combined with the independently audited rigor of a public trust operation.
What sets it apart from a standard private CA:
WebTrust audit coverage
The same independent CPA audit that certifies SSL's public CA operations covers your dedicated hierarchy. You inherit the audit evidence without building the audit program yourself.
Auditor-witnessed Key Ceremonies
Your Root CA private key is generated in a formal, documented ceremony conducted by SSL's PKI team and witnessed by the independent auditor.
HSM-backed root keys
The Root CA key lives in a FIPS 140-2 Level 3 HSM, offline, activated only by multi-party dual control.
Documented chain of trust
Every policy and procedure governing your hierarchy is documented, audited, and available as compliance evidence.
The result: your PKI satisfies SOC2, HIPAA, banking, energy, and supply chain compliance requirements, because the audit already happened.
Key benefits
Service tiers
Pricing is indicative and subject to change. Contact us for a tailored quote.
Professional
- Compliance-Focused
- 500 Certs included
- $10,000 one-time setup fee
- 1 Root + 1 Issuing CA
- Single use case (TLS Auth, Client Auth, Device Identity, or Code Signing)
- Overage: $2.10 / active cert / month above 500
Enterprise
- Automation & Zero Trust
- 5,000 Certs included
- One-time setup fee applies
- 1 Root + 1 Issuing CA
- Multiple Use Cases (TLS Auth, Client Auth, Device Identity, Code Signing)
- Overage applies above 5,000 active certificates
Ecosystem / IoT
- High Scale
- 100,000 Certs included
- One-time setup fee applies
- 1 Root CA + up to 3 Issuing CAs (additional ICAs available)
- Use for TLS Auth, Client Auth, Device Identity, or Code Signing
- Overage applies above 100,000 active certificates
- CPS & profile customization (optional add-on)
Common use cases
How onboarding works
Compliance & standards
WebTrust for CAs
SSL's dedicated PKI operations are covered by the same WebTrust audit as our public trust platform
FIPS 140-2 Level 3
RFC 5280 (X.509)
ACME RFC 8555
SCEP / EST
NIST PQC standards
Frequently asked questions
The key difference is the WebTrust audit. Private Compliance PKI operates under SSL's independent audit program. Private Enterprise PKI uses the same HSM infrastructure without the compliance program. Choose Private Compliance PKI if you need to demonstrate independently audited governance to partners, regulators, or enterprise customers.
Managed PKI Certificates is a shared multi-tenant service, you don't own the Root CA. Private Compliance PKI gives you a fully dedicated Root CA and Issuing CA hierarchy with custom certificate policies and naming.
No. The Root CA is generated within SSL's audited infrastructure as part of a formally witnessed Key Ceremony. Introducing an externally managed root would break the audit boundary. Cross-certification options can be discussed.
An independent CPA has verified that SSL's data centers, personnel, and cryptographic processes meet the WebTrust Principles and Criteria for Certification Authorities, providing an audit pass-through for your SOC2, HIPAA, or industry requirements.
No. SSL's Unified REST API covers both your public-trust certificates and your dedicated PKI hierarchy.
Ready to build your compliant PKI?
Related Products
Private Enterprise PKI
Same dedicated infrastructure, without the WebTrust audit, lower cost for internal-only use.
Managed PKI Certificates
WebTrust-audited private PKI on shared infrastructure, no dedicated Root CA, lower cost.
