DuoKey

PKI and Certificate Lifecycle Management

DuoKey vs Microsoft AD CS

Microsoft Active Directory Certificate Services is a Windows Server role that runs enterprise and standalone CAs on premises. Microsoft Cloud PKI adds a SaaS issuing CA for Intune-managed devices. DuoKey is a Swiss PKI and certificate lifecycle platform: private CAs with HSM-protected keys, ACME, EST, SCEP and CMP, discovery, deployment and automated renewal with rollback, code signing, M-of-N governance, post-quantum certificates and a tamper-evident audit trail, operated by DuoKey or on your premises.

DuoKey

27 / 32

Microsoft AD CS

11 / 32

Compared capabilities supported, based on public documentation.

Book a call→See the comparison

Only DuoKey

  • Public / external CA brokering
  • Adjacent PKI services
  • ACME (RFC 8555)
  • EST (RFC 7030)
  • CMPv2 (RFC 4210/9483)
  • Kubernetes cert-manager issuer
  • Certificate discovery (network scan and/or agents)
  • Central inventory with policy / compliance checks
  • Automated renewal and redeployment
  • Expiry alerting
  • Push deployment to endpoints (load balancers, firewalls, web servers, Windows) with rollback
  • Post-quantum certificates (ML-DSA, SLH-DSA, hybrid/composite)
  • Code signing service
  • Approval workflow / M-of-N quorum for sensitive PKI operations
  • Context-based (IP, location, time) policy on CA / PKI operations
  • Tamper-evident (signed / hash-chained) audit log
  • 24/7 support with SLA response times
  • Vendor certifications (ISO 27001, SOC 2, WebTrust / eIDAS QTSP, Common Criteria)

Feature by feature

DuoKey and Microsoft AD CS, side by side

CapabilityDuoKeyMicrosoft AD CS

CA and issuance

1Private CA hierarchy

Run own root/intermediate CAs with lifecycle controls

YesRoot, intermediate, imported CAs; cascade revokeSource
YesRoot and subordinate CAsSource

2Public / external CA brokering

Order and renew public or cloud CA certificates (Let's Encrypt, DigiCert, Sectigo, AWS PCA, ADCS...) from one console

YesLet's Encrypt, DigiCert, Sectigo, AWS, Azure, GCP, ADCSSource
Not documentedNo public CA brokeringSource

3Revocation

CRL and OCSP for relying parties

YesPer-CA OCSP and CRLSource
YesCRL and Online Responder (OCSP)Source

4Adjacent PKI services

SSH CA and/or RFC 3161 timestamping

YesSSH CA, RFC 3161 timestampingSource
Not documented

Enrollment

5ACME (RFC 8555)

YesPer-CA ACME directorySource
Not documentedNo ACME for AD CS issuance

6EST (RFC 7030)

YesIncl. serverkeygen, csrattrsSource
Not documentedWeb enrollment uses WS-Trust, not ESTSource

7SCEP (RFC 8894)

YesConfigurable SCEP profilesSource
YesNDES (SCEP)Source

8CMPv2 (RFC 4210/9483)

YesCMP incl. lightweight profileSource
Not documentedCMC for key archival, no CMPv2Source

9Microsoft autoenrollment (GPO / WCCE / MS-XCEP)

PartialMS-XCEP / MS-WSTEP autoenrollment (preview)Source
YesGPO autoenrollment, CEP/CESSource

10Intune / MDM certificate delivery

PartialIntune SCEP and PKCS (preview); static SCEP for JamfSource
YesVia Intune Certificate ConnectorSource

11Kubernetes cert-manager issuer

YesVia ACME issuer, verified end to endSource
Not documented

Visibility and automation

12Certificate discovery (network scan and/or agents)

YesNetwork scanners and agentsSource
Not documentedNo network or agent discovery

13Central inventory with policy / compliance checks

YesMozilla/NIST/PCI checks, ServiceNow CMDBSource
Not documentedNo compliance engine

14Automated renewal and redeployment

YesServer-side renew and redeploy, retries, rollbackSource
PartialAutorenewal for domain clients onlySource

15Expiry alerting

YesE-mail, Teams, Slack, webhooks per thresholdSource
PartialClient-side expiry notificationSource

16Push deployment to endpoints (load balancers, firewalls, web servers, Windows) with rollback

YesF5, FortiGate, Azure, IIS, Nginx, JKS + rollbackSource
Not documentedNo push to appliances

17Short-lived certificates / 47-day TLS readiness at scale

PartialACME ARI and short validity; http-01 onlySource
Not documented

Key protection

18HSM-protected CA keys (non-exportable)

YesCA keys generated in HSM or KMS, never exportedSource
YesOptional HSM; else key on CA serverSource

19CA keys split with MPC / threshold (never whole in one place)

PartialMPC-held CA keys, ECDSA P-256 only (preview)Source
Not documentedMultiple KRAs are not a quorumSource

20Post-quantum certificates (ML-DSA, SLH-DSA, hybrid/composite)

YesML-DSA, SLH-DSA, ML-DSA-65+P256 compositeSource
PartialML-DSA on WS2025 (KB5087539); composite plannedSource

Use cases

21S/MIME with key escrow and recovery

YesEscrow and recovery, Intune deliverySource
YesKey archival with KRA recoverySource

22Code signing service

YesSignTool, JAR, Git, cosign; vault keys, M-of-NSource
PartialCode-signing certs, no signing serviceSource

23IoT / device identity at scale

PartialEST/CMP provisioning; no published throughputSource
PartialNDES for network devicesSource

Governance

24Granular RBAC

YesHierarchical PKI permissionsSource
YesCA admin, cert manager, auditor, KRA rolesSource

25Approval workflow / M-of-N quorum for sensitive PKI operations

YesM-of-N on CA revoke, archive, changes, issuanceSource
PartialSingle approver; dual control proceduralSource

26Context-based (IP, location, time) policy on CA / PKI operations

YesUser, IP, country, time on issue and revokeSource
Not documented

27Tamper-evident (signed / hash-chained) audit log

YesHMAC-SHA256 plus hash chainSource
Not documentedWindows Security log; not signed or chainedSource

28SIEM integration

YesSplunk, syslog, ElasticSource
YesAudit events via Windows Event ForwardingSource

Deployment and vendor

29SaaS and on-premises options

YesDuoKey-hosted or on-premisesSource
YesAD CS on-prem; Cloud PKI SaaSSource

30High availability / disaster recovery

YesStateless API nodes, replicasSource
YesCA as failover cluster resourceSource

3124/7 support with SLA response times

Yes24/7 on Platinum, 1-hour criticalSource
Not documentedNo PKI-specific SLA found

32Vendor certifications (ISO 27001, SOC 2, WebTrust / eIDAS QTSP, Common Criteria)

YesISO 27001, SOC 2, TISAX AL3Source
PartialFIPS 140 Windows modules; no WebTrustSource

Why teams choose DuoKey

Key differences with Microsoft AD CS

01

Modern enrollment protocols

AD CS issues through autoenrollment, web enrollment (WS-Trust), NDES (SCEP) and CMC; Microsoft does not document ACME, EST or CMPv2 issuance. DuoKey serves ACME, EST, SCEP and CMP (including the lightweight profile) from every CA, and works with Kubernetes cert-manager.

02

Find, renew and deploy certificates

AD CS has no network or agent discovery and no push to load balancers or firewalls. DuoKey discovers certificates on the network and through agents, checks them against Mozilla, NIST and PCI rules, and deploys to F5, FortiGate, Azure, IIS, Nginx and Java keystores with rollback.

03

An audit trail that proves itself

AD CS writes to the Windows Security log; Microsoft notes that event forwarding does not prevent local overwrite. DuoKey signs every audit record with HMAC-SHA256 and links it into a SHA-256 hash chain.

04

Not exposed to AD CS template abuse

Microsoft documents certificate-based authentication fixes (Certifried, CVE-2022-26923, KB5014754) and tracks ESC1 to ESC15 template misconfigurations in Defender for Identity. DuoKey CAs are not AD-integrated templates, so these Active Directory abuse paths do not apply.

What Microsoft AD CS does well

AD CS is deeply integrated with Active Directory: Group Policy autoenrollment and renewal, CEP/CES for non-domain clients, NDES, key archival with separated roles and detailed audit events. It now supports ML-DSA on Windows Server 2025, and Microsoft Cloud PKI offers a SaaS option with Managed HSM for Intune.

FAQ

Is DuoKey an alternative to Microsoft AD CS for PKI and certificate lifecycle management?

Yes. DuoKey provides private CAs with keys kept in an HSM or KMS, brokering of public and cloud CAs, ACME, EST, SCEP and CMP, discovery, deployment and automated renewal with rollback, expiry alerts, a code signing service, M-of-N approval of sensitive operations and post-quantum certificates, operated by DuoKey or on your premises.

Can I keep Microsoft AD CS and add DuoKey?

Yes. DuoKey can front existing CAs as issuers (Microsoft AD CS through NDES, DigiCert, Sectigo, Let's Encrypt, AWS, Azure, Google) while centralising inventory and deployment.

How were these criteria chosen?

They follow the sections of a PKI and certificate lifecycle RFP: issuance, enrollment protocols, visibility and automation, key protection, use cases, governance and deployment. Every cell links to the public document it is based on.

Evidence

Every claim on this page, sourced

Microsoft AD CS

  1. [1]learn.microsoft.comcriteria 1, 3, 23https://learn.microsoft.com/windows-server/identity/ad-cs/active-directory-certificate-services-overview
  2. [2]learn.microsoft.comcriteria 2https://learn.microsoft.com/intune/cloud-pki/
  3. [3]learn.microsoft.comcriteria 6https://learn.microsoft.com/windows-server/identity/ad-cs/certificate-enrollment-policy-web-service-overview
  4. [4]learn.microsoft.comcriteria 7https://learn.microsoft.com/windows-server/identity/ad-cs/network-device-enrollment-service-overview
  5. [5]learn.microsoft.comcriteria 8, 19, 21, 25https://learn.microsoft.com/windows-server/identity/ad-cs/configure-key-archival-recover-private-keys
  6. [6]learn.microsoft.comcriteria 9https://learn.microsoft.com/windows-server/identity/ad-cs/configure-certificate-enrollment-web-service
  7. [7]learn.microsoft.comcriteria 10https://learn.microsoft.com/intune/fundamentals/certificates/connector/setup-connector
  8. [8]learn.microsoft.comcriteria 14https://learn.microsoft.com/windows-server/networking/core-network-guide/cncg/server-certs/configure-server-certificate-auto-enrollment
  9. [9]learn.microsoft.comcriteria 15https://learn.microsoft.com/powershell/module/pki/set-certificateautoenrollmentpolicy
  10. [10]learn.microsoft.comcriteria 18https://learn.microsoft.com/windows-server/identity/ad-cs/certification-authority-role
  11. [11]learn.microsoft.comcriteria 20, 22https://learn.microsoft.com/windows-server/identity/ad-cs/post-quantum-cryptography-overview
  12. [12]learn.microsoft.comcriteria 24, 27, 28https://learn.microsoft.com/windows-server/identity/ad-cs/secure-delegate-audit-certification-authority
  13. [13]learn.microsoft.comcriteria 29https://learn.microsoft.com/intune/cloud-pki/deployment-models
  14. [14]learn.microsoft.comcriteria 30https://learn.microsoft.com/windows-server/identity/ad-cs/migrate-certification-authority
  15. [15]learn.microsoft.comcriteria 32https://learn.microsoft.com/windows/security/security-foundations/certification/fips-140-validation

DuoKey

  1. [1]docs.duokey.comcriteria 1, 2, 3, 8, 13, 16, 20https://docs.duokey.com/docs/pki-ssl/overview#core-capabilities
  2. [2]docs.duokey.comcriteria 4https://docs.duokey.com/docs/cockpit/ssh-certificate-authority#what-is-an-ssh-certificate-authority
  3. [3]docs.duokey.comcriteria 5https://docs.duokey.com/docs/developer/pki-api#acme-rfc-8555
  4. [4]docs.duokey.comcriteria 6https://docs.duokey.com/docs/pki-ssl/enrollment-protocols#est-rfc-7030
  5. [5]docs.duokey.comcriteria 7https://docs.duokey.com/docs/pki-ssl/enrollment-protocols#scep-rfc-8894
  6. [6]docs.duokey.comcriteria 9https://docs.duokey.com/docs/pki-ssl/windows-autoenrollment#overview
  7. [7]docs.duokey.comcriteria 10https://docs.duokey.com/docs/pki-ssl/intune-mdm#overview
  8. [8]docs.duokey.comcriteria 11https://docs.duokey.com/docs/pki-ssl/enrollment-protocols#using-acme-with-kubernetes-cert-manager
  9. [9]docs.duokey.comcriteria 12https://docs.duokey.com/docs/developer/pki-api#discovery-compliance
  10. [10]docs.duokey.comcriteria 14https://docs.duokey.com/docs/pki-ssl/renewal-and-alerts#renewal-policies
  11. [11]docs.duokey.comcriteria 15https://docs.duokey.com/docs/pki-ssl/renewal-and-alerts#expiry-alerts
  12. [12]docs.duokey.comcriteria 17https://docs.duokey.com/docs/pki-ssl/short-lived-certificates#readiness
  13. [13]docs.duokey.comcriteria 18https://docs.duokey.com/docs/pki-ssl/ca-key-protection#supported-back-ends
  14. [14]docs.duokey.comcriteria 19https://docs.duokey.com/docs/pki-ssl/ca-key-protection#mpc-ca-keys
  15. [15]docs.duokey.comcriteria 21https://docs.duokey.com/docs/cockpit/release-notes#205-206
  16. [16]docs.duokey.comcriteria 22https://docs.duokey.com/docs/pki-ssl/code-signing#overview
  17. [17]docs.duokey.comcriteria 23https://docs.duokey.com/docs/pki-ssl/device-identity#building-blocks
  18. [18]docs.duokey.comcriteria 24https://docs.duokey.com/docs/developer/pki-api#certificates-requests
  19. [19]docs.duokey.comcriteria 25https://docs.duokey.com/docs/pki-ssl/governance#quorum
  20. [20]docs.duokey.comcriteria 26https://docs.duokey.com/docs/pki-ssl/governance#access-policies
  21. [21]docs.duokey.comcriteria 27https://docs.duokey.com/docs/cockpit/security#tamper-evident-audit
  22. [22]docs.duokey.comcriteria 28https://docs.duokey.com/docs/cockpit/deployment#observability
  23. [23]docs.duokey.comcriteria 29https://docs.duokey.com/docs/openshift-on-prem/vm-deployment
  24. [24]docs.duokey.comcriteria 30https://docs.duokey.com/docs/cockpit/deployment#high-availability-and-resilience
  25. [25]docs.duokey.comcriteria 31https://docs.duokey.com/docs/why-mpc
  26. [26]duokey.comcriteria 32https://duokey.com/en/compliance/iso-27001

Discuss the decisions that matter most to your security programme.

Tell us where control is difficult today. We will help you identify a practical next step.

Book a callSee the platform