Sectigo Private PKI

Sectigo Private PKI (Sectigo Private CA) lets organizations run their own internal certificate authority without building and maintaining the infrastructure themselves. It issues private, non-publicly-trusted certificates for users, devices, servers, applications and workloads, and is often used to replace or modernize Microsoft Active Directory Certificate Services (AD CS).

The service is delivered mainly as hosted PKI-as-a-Service, with dedicated root and issuing CAs protected by hardware security modules in Sectigo's facilities, and it can also be deployed on-premises. It is managed through Sectigo Certificate Manager, so private and public certificates are discovered, issued, renewed and revoked from one place. Enrollment supports ACME, SCEP, EST, Active Directory auto-enrollment and REST APIs, and DevOps teams can connect it to Kubernetes cert-manager, HashiCorp Vault, Ansible and Terraform.

Common uses include user and device authentication, Wi-Fi and VPN access, S/MIME email, internal TLS for servers and microservices, and machine identities in CI/CD pipelines, all with less operational overhead than a self-built PKI.