DigiCert Private CA

What DigiCert Private CA is

DigiCert Private CA builds and operates private public key infrastructure for an organization’s users, devices, applications, and digital assets across on-premises and cloud environments. Certificates from a private PKI are trusted only within the organization’s systems. Organizations can use DigiCert-hosted or customer-hosted deployments; customer-hosted installations can support offline or air-gapped certificate authorities. The service covers root and intermediate CA creation, HSM integration, CRL and OCSP configuration, enrollment protocols, and end-entity certificate issuance. DigiCert says Private CA can issue and manage billions of certificates. Its API can create, import, and recertify root and intermediate CAs, configure CRL and OCSP responders, manage templates, and monitor audit logs. API authentication supports service-user tokens and mutual TLS. Security controls include FIPS 140-2 Level 3 HSM key protection, role-based access, and full audit logging. Integrations include existing PKI tools and infrastructure, REST API workflows, and DigiCert Trust Lifecycle Manager. API-only service users can support automated workflows and integrations, but cannot sign in to the user interface. DigiCert provides PKI specialists for installation, migration, and other support, along with support documents and Monday-Friday 24/7 specialist availability. Pricing is available on request.

Who it suits

DigiCert Private CA suits organizations managing private certificates for users, devices, applications, and digital assets across cloud and on-premises environments. Its customer-hosted air-gapped option and automation API also fit teams with offline CA requirements or workflows that need to manage certificate authorities programmatically.

Limits

The subscription licensing model includes private root, intermediate CA, and end-entity certificate licenses. DigiCert-hosted deployments have soft limits with overages; on-premises deployments have hard limits.

Getting started

1. Visit the DigiCert Private CA website.
2. Contact DigiCert for pricing on request.
3. Choose DigiCert-hosted or customer-hosted deployment.
4. For customer-hosted use, consider whether an offline or air-gapped CA is needed.
5. Configure CA lifecycle and enrollment settings, with support from DigiCert PKI specialists if needed.

Verdict

Choose DigiCert Private CA if you need private PKI across on-premises or cloud environments, with hosted and customer-hosted deployment choices and API-based management. Check the subscription licensing limits for the deployment model you plan to use, and request pricing from DigiCert.