DuoKey

PKI and Certificate Lifecycle Management

DuoKey vs Evertrust

Evertrust, a French vendor, sells Evertrust PKI (Stream) and Evertrust CLM (Horizon), deployed on premises, in containers, in the cloud or as managed SaaS. DuoKey is a Swiss PKI and certificate lifecycle platform: private CAs with HSM-protected keys, ACME, EST, SCEP and CMP, discovery, deployment and automated renewal with rollback, code signing, M-of-N governance, post-quantum certificates and a tamper-evident audit trail, operated by DuoKey or on your premises.

DuoKey

27 / 32

Evertrust

23 / 32

Compared capabilities supported, based on public documentation.

Book a call→See the comparison

Only DuoKey

  • CMPv2 (RFC 4210/9483)
  • Push deployment to endpoints (load balancers, firewalls, web servers, Windows) with rollback
  • Code signing service
  • Approval workflow / M-of-N quorum for sensitive PKI operations
  • Context-based (IP, location, time) policy on CA / PKI operations
  • SIEM integration
  • 24/7 support with SLA response times

Feature by feature

DuoKey and Evertrust, side by side

CapabilityDuoKeyEvertrust

CA and issuance

1Private CA hierarchy

Run own root/intermediate CAs with lifecycle controls

YesRoot, intermediate, imported CAs; cascade revokeSource
YesRoot, intermediate, external CAsSource

2Public / external CA brokering

Order and renew public or cloud CA certificates (Let's Encrypt, DigiCert, Sectigo, AWS PCA, ADCS...) from one console

YesLet's Encrypt, DigiCert, Sectigo, AWS, Azure, GCP, ADCSSource
YesDigiCert, Sectigo, GlobalSign, AWS, ADCS, Let's EncryptSource

3Revocation

CRL and OCSP for relying parties

YesPer-CA OCSP and CRLSource
YesCRL and RFC 6960 OCSPSource

4Adjacent PKI services

SSH CA and/or RFC 3161 timestamping

YesSSH CA, RFC 3161 timestampingSource
YesRFC 3161 TSA, OpenSSH CASource

Enrollment

5ACME (RFC 8555)

YesPer-CA ACME directorySource
YesACME (marketing)Source

6EST (RFC 7030)

YesIncl. serverkeygen, csrattrsSource
YesESTSource

7SCEP (RFC 8894)

YesConfigurable SCEP profilesSource
YesSCEP, NDES emulationSource

8CMPv2 (RFC 4210/9483)

YesCMP incl. lightweight profileSource
Not documentedNo CMP found

9Microsoft autoenrollment (GPO / WCCE / MS-XCEP)

PartialMS-XCEP / MS-WSTEP autoenrollment (preview)Source
YesWCCE autoenrollmentSource

10Intune / MDM certificate delivery

PartialIntune SCEP and PKCS (preview); static SCEP for JamfSource
YesIntune, Jamf, Workspace ONESource

11Kubernetes cert-manager issuer

YesVia ACME issuer, verified end to endSource
Yescert-manager issuer (marketing)Source

Visibility and automation

12Certificate discovery (network scan and/or agents)

YesNetwork scanners and agentsSource
YesNetwork scan, agent, importSource

13Central inventory with policy / compliance checks

YesMozilla/NIST/PCI checks, ServiceNow CMDBSource
YesPolicy violations, A-E gradingSource

14Automated renewal and redeployment

YesServer-side renew and redeploy, retries, rollbackSource
YesPolicy-based renewal and redeploySource

15Expiry alerting

YesE-mail, Teams, Slack, webhooks per thresholdSource
YesEmail, Slack/Teams, webhook alertsSource

16Push deployment to endpoints (load balancers, firewalls, web servers, Windows) with rollback

YesF5, FortiGate, Azure, IIS, Nginx, JKS + rollbackSource
PartialF5, AKV, AWS ACM, IIS push; no rollbackSource

17Short-lived certificates / 47-day TLS readiness at scale

PartialACME ARI and short validity; http-01 onlySource
PartialCites 47 days; no readiness claimSource

Key protection

18HSM-protected CA keys (non-exportable)

YesCA keys generated in HSM or KMS, never exportedSource
YesPKCS#11 HSM and cloud KMS signingSource

19CA keys split with MPC / threshold (never whole in one place)

PartialMPC-held CA keys, ECDSA P-256 only (preview)Source
Not documented

20Post-quantum certificates (ML-DSA, SLH-DSA, hybrid/composite)

YesML-DSA, SLH-DSA, ML-DSA-65+P256 compositeSource
YesML-DSA, ML-KEM, SLH-DSASource

Use cases

21S/MIME with key escrow and recovery

YesEscrow and recovery, Intune deliverySource
YesEscrow per profile, recoverySource

22Code signing service

YesSignTool, JAR, Git, cosign; vault keys, M-of-NSource
PartialCode-signing certs; no signing serviceSource

23IoT / device identity at scale

PartialEST/CMP provisioning; no published throughputSource
YesIoT certificates (marketing)Source

Governance

24Granular RBAC

YesHierarchical PKI permissionsSource
YesRoles and teamsSource

25Approval workflow / M-of-N quorum for sensitive PKI operations

YesM-of-N on CA revoke, archive, changes, issuanceSource
PartialMulti-step approvals; no M-of-NSource

26Context-based (IP, location, time) policy on CA / PKI operations

YesUser, IP, country, time on issue and revokeSource
Not documented

27Tamper-evident (signed / hash-chained) audit log

YesHMAC-SHA256 plus hash chainSource
YesEvents chained and sealedSource

28SIEM integration

YesSplunk, syslog, ElasticSource
PartialSyslog and JSON logsSource

Deployment and vendor

29SaaS and on-premises options

YesDuoKey-hosted or on-premisesSource
YesOn-prem, containers, cloud, SaaSSource

30High availability / disaster recovery

YesStateless API nodes, replicasSource
YesActive-active clusteringSource

3124/7 support with SLA response times

Yes24/7 on Platinum, 1-hour criticalSource
Partial24/7 claim; partner help is business hoursSource

32Vendor certifications (ISO 27001, SOC 2, WebTrust / eIDAS QTSP, Common Criteria)

YesISO 27001, SOC 2, TISAX AL3Source
YesISO 27001, ANSSI CSPNSource

Why teams choose DuoKey

Key differences with Evertrust

01

CMP for telecom and industrial devices

No CMP support is documented for Evertrust. DuoKey serves CMP (RFC 4210 and the lightweight RFC 9483 profile) alongside ACME, EST and SCEP.

02

Deploy with rollback

Evertrust pushes certificates to F5, Azure Key Vault, AWS ACM and IIS; rollback is not documented. DuoKey deploys to F5, FortiGate, Azure, IIS, Nginx and Java keystores with validation and rollback.

03

Hybrid composite certificates

Evertrust lists ML-DSA, ML-KEM and SLH-DSA. DuoKey also issues a hybrid ML-DSA-65 + ECDSA-P256 composite for a classical fallback during migration.

04

PKI inside a wider key platform

DuoKey runs PKI in the same Cockpit as key management, Microsoft 365 DKE and cryptographic posture management, under Swiss rather than French jurisdiction.

What Evertrust does well

Evertrust is a strong European choice: ANSSI CSPN certification (2025) and ISO 27001, ACME, EST, SCEP, Windows autoenrollment, Intune and cert-manager, around 18 CA connectors, ML-DSA, ML-KEM and SLH-DSA, an SSH CA and timestamping, active-active HA and a signed, chained audit log.

FAQ

Is DuoKey an alternative to Evertrust for PKI and certificate lifecycle management?

Yes. DuoKey provides private CAs with keys kept in an HSM or KMS, brokering of public and cloud CAs, ACME, EST, SCEP and CMP, discovery, deployment and automated renewal with rollback, expiry alerts, a code signing service, M-of-N approval of sensitive operations and post-quantum certificates, operated by DuoKey or on your premises.

Can I keep Evertrust and add DuoKey?

Yes. DuoKey can front existing CAs as issuers (Microsoft AD CS through NDES, DigiCert, Sectigo, Let's Encrypt, AWS, Azure, Google) while centralising inventory and deployment.

How were these criteria chosen?

They follow the sections of a PKI and certificate lifecycle RFP: issuance, enrollment protocols, visibility and automation, key protection, use cases, governance and deployment. Every cell links to the public document it is based on.

Evidence

Every claim on this page, sourced

Evertrust

  1. [1]evertrust.iocriteria 1, 3, 4, 18, 20, 24, 25, 29, 30https://evertrust.io/files/Datasheets/en-datasheet-pki.pdf
  2. [2]evertrust.iocriteria 2, 5, 9, 11, 23https://evertrust.io/clm
  3. [3]docs.evertrust.frcriteria 6https://docs.evertrust.fr/horizon/2.6/admin-guide/protocols/est/est
  4. [4]docs.evertrust.frcriteria 7https://docs.evertrust.fr/horizon/2.6/admin-guide/protocols/scep/scep
  5. [5]evertrust.iocriteria 10, 12, 13, 14, 15, 16, 17, 22https://evertrust.io/files/Datasheets/en-datasheet-clm.pdf
  6. [6]docs.evertrust.frcriteria 21https://docs.evertrust.fr/horizon/2.2/admin-guide/protocols/est
  7. [7]docs.evertrust.frcriteria 27https://docs.evertrust.fr/stream/2.1/admin-guide/system/events
  8. [8]docs.evertrust.frcriteria 28https://docs.evertrust.fr/horizon/2.6/admin-guide/logging
  9. [9]evertrust.iocriteria 31https://evertrust.io/demo/
  10. [10]evertrust.iocriteria 32https://evertrust.io/newsroom/evertrust-pki-achieves-anssi-cspn-certification-reinforcing-european-digital-sovereignty/

DuoKey

  1. [1]docs.duokey.comcriteria 1, 2, 3, 8, 13, 16, 20https://docs.duokey.com/docs/pki-ssl/overview#core-capabilities
  2. [2]docs.duokey.comcriteria 4https://docs.duokey.com/docs/cockpit/ssh-certificate-authority#what-is-an-ssh-certificate-authority
  3. [3]docs.duokey.comcriteria 5https://docs.duokey.com/docs/developer/pki-api#acme-rfc-8555
  4. [4]docs.duokey.comcriteria 6https://docs.duokey.com/docs/pki-ssl/enrollment-protocols#est-rfc-7030
  5. [5]docs.duokey.comcriteria 7https://docs.duokey.com/docs/pki-ssl/enrollment-protocols#scep-rfc-8894
  6. [6]docs.duokey.comcriteria 9https://docs.duokey.com/docs/pki-ssl/windows-autoenrollment#overview
  7. [7]docs.duokey.comcriteria 10https://docs.duokey.com/docs/pki-ssl/intune-mdm#overview
  8. [8]docs.duokey.comcriteria 11https://docs.duokey.com/docs/pki-ssl/enrollment-protocols#using-acme-with-kubernetes-cert-manager
  9. [9]docs.duokey.comcriteria 12https://docs.duokey.com/docs/developer/pki-api#discovery-compliance
  10. [10]docs.duokey.comcriteria 14https://docs.duokey.com/docs/pki-ssl/renewal-and-alerts#renewal-policies
  11. [11]docs.duokey.comcriteria 15https://docs.duokey.com/docs/pki-ssl/renewal-and-alerts#expiry-alerts
  12. [12]docs.duokey.comcriteria 17https://docs.duokey.com/docs/pki-ssl/short-lived-certificates#readiness
  13. [13]docs.duokey.comcriteria 18https://docs.duokey.com/docs/pki-ssl/ca-key-protection#supported-back-ends
  14. [14]docs.duokey.comcriteria 19https://docs.duokey.com/docs/pki-ssl/ca-key-protection#mpc-ca-keys
  15. [15]docs.duokey.comcriteria 21https://docs.duokey.com/docs/cockpit/release-notes#205-206
  16. [16]docs.duokey.comcriteria 22https://docs.duokey.com/docs/pki-ssl/code-signing#overview
  17. [17]docs.duokey.comcriteria 23https://docs.duokey.com/docs/pki-ssl/device-identity#building-blocks
  18. [18]docs.duokey.comcriteria 24https://docs.duokey.com/docs/developer/pki-api#certificates-requests
  19. [19]docs.duokey.comcriteria 25https://docs.duokey.com/docs/pki-ssl/governance#quorum
  20. [20]docs.duokey.comcriteria 26https://docs.duokey.com/docs/pki-ssl/governance#access-policies
  21. [21]docs.duokey.comcriteria 27https://docs.duokey.com/docs/cockpit/security#tamper-evident-audit
  22. [22]docs.duokey.comcriteria 28https://docs.duokey.com/docs/cockpit/deployment#observability
  23. [23]docs.duokey.comcriteria 29https://docs.duokey.com/docs/openshift-on-prem/vm-deployment
  24. [24]docs.duokey.comcriteria 30https://docs.duokey.com/docs/cockpit/deployment#high-availability-and-resilience
  25. [25]docs.duokey.comcriteria 31https://docs.duokey.com/docs/why-mpc
  26. [26]duokey.comcriteria 32https://duokey.com/en/compliance/iso-27001

Discuss the decisions that matter most to your security programme.

Tell us where control is difficult today. We will help you identify a practical next step.

Book a callSee the platform