Skip to content

PKIFactor

PKIFactor is a certificate lifecycle management (CLM) platform. It gives a single place to request, approve, issue, deploy, renew, revoke and monitor X.509 certificates, whatever the certification authority that issues them and whatever the device that serves them.

It is built for organizations that run several authorities at once (an internal Microsoft AD CS, a HashiCorp Vault, EJBCA, ZetaCA, public authorities such as DigiCert or Sectigo) and many TLS endpoints (load balancers, firewalls, web application firewalls, web servers), and that need governance: who may request what, who approves, where each certificate lives, and proof of every action.

What PKIFactor does

Area What it covers
Issuance from any authority One request flow for every connected authority: Vault, Microsoft AD CS, EJBCA, ZetaCA, DigiCert CertCentral and DigiCert ONE, Sectigo, any ACME authority (Let's Encrypt, Google, Sectigo ACME), generic REST and CMP authorities.
Governance Certificate profiles that fix what may be requested, approval queues per organization, issuance policies, organizations and teams that bound who sees and who acts.
Automation protocols Built-in ACME (RFC 8555, with EAB, CAA and ARI), EST (RFC 7030), SCEP (RFC 8894) and CMP (RFC 4210) servers, so servers and devices enrol and renew without a human.
Deployment to devices Agentless push and rotation of certificates onto F5 BIG-IP, Fortinet FortiWeb, Palo Alto Networks PAN-OS, Check Point, Progress Kemp LoadMaster, Windows IIS and Linux servers over SSH, with intervention windows, a human veto and verification that the device serves the expected certificate.
Discovery TLS scanning of networks (including STARTTLS and implicit-TLS ports), absorption of the certificates already issued by your authorities, and the Discovery page (Oversight workspace) to qualify what was found.
Integrations Directory sources (LDAP and Active Directory, Microsoft Entra ID, Keycloak, Okta, Google Workspace, SCIM), single sign-on (OIDC), ServiceNow (inventory, incidents, changes and catalogue requests), SIEM (syslog and CEF), e-mail.
Post-quantum readiness Pure post-quantum (ML-DSA, SLH-DSA), hybrid and composite certificates, and crypto-agile profiles that issue several independent certificates (for example a classical and a post-quantum one) for the same entity.
Security Encryption at rest with a key hierarchy protected by a KMS (Vault Transit) or an HSM (PKCS#11), strict content security policy, signed and verified releases, structured audit trail.

Architecture

PKIFactor is a set of containers. The same images run on the virtual appliance (Docker Compose) and on Kubernetes or OpenShift (Helm chart).

          Browsers, API clients, ACME / EST / SCEP / CMP clients
                                   |
                            +------v------+
                            |    nginx    |  TLS termination, routing, rate limiting
                            +--+---+---+--+
                               |   |   |
         +---------------------+   |   +----------------------+
         |                         |                          |
  +------v------+          +-------v-------+     +------------v------------+
  |  Frontend   |          |   Backend API  |     |  Protocol gateways       |
  |  (web UI)   +--------->+  (business     +<----+  ACME, EST, SCEP, CMP    |
  +-------------+          |   logic)       |     +--------------------------+
                           +-------+--------+
                                   |   Background worker (renewals, deployment,
                                   |   verification, scans, notifications)
                           +-------v--------+
                           |  PostgreSQL 16  |  (single node, or Patroni cluster)
                           +-------+--------+
                                   |
     +-----------------------------+------------------------------+
     |                             |                              |
 Certification authorities     Devices (deployment)          Platforms
 Vault, AD CS, EJBCA, ZetaCA,  F5, FortiWeb, PAN-OS,          KMS / HSM, directories,
 DigiCert, Sectigo, ACME, CMP  Check Point, Kemp, IIS, SSH    SSO, ServiceNow, SIEM, SMTP
Component Role
nginx TLS termination, routing to the services, rate limiting, security headers
Frontend Web interface (server-rendered), in five languages (English, French, German, Spanish, Portuguese)
Backend API REST API and all business logic: profiles, approvals, issuance, connectors
Worker Background jobs: renewal engine, deployment and verification, scans, e-mail queue, directory synchronisation
ACME, EST, SCEP, CMP gateways Protocol servers; each one is a client of the backend with its own service account
PostgreSQL 16 Single database; in high availability, a Patroni cluster with synchronous replication behind PgBouncer

Licensing

PKIFactor has a single edition: every function is included. The license states how many managed certificates the contract covers. PKIFactor first warns the administrators; then, once the volume is reached, a new name is refused, and above the volume or after the end date issuance and renewal are refused. Revocation always remains possible. A managed certificate is a distinct common name among the active certificates that PKIFactor issued or renewed; renewals and the members of a crypto-agile family count once, discovered certificates do not count. A new installation runs for 30 days without a license. See License.

Roles

Role Scope Main rights
Administrator Global Users, organizations, authorities, profiles, devices, integrations, security settings, license. Sees the whole estate but cannot export another user's private key. PKIFactor keeps at least two active administrators
Operator The organizations the user belongs to; only the devices entrusted to the user A delegated administrator: certificate operations and deployment within those organizations, with a set of permissions the administrator adjusts per operator. Never edits certificate profiles
Approver (validator) Bounded to the organizations where the user is an approver Approve or reject requests in the approval queue of those organizations, and delegate this right
Auditor The whole estate, or only the auditor's own organizations (audit scope set by the administrator); read only Certificates, audit trail and reports, without any change
User Own certificates and those of the user's teams within the organization Request, download, renew and revoke

Roles are held by PKIFactor itself, and a user can hold several of them. Single sign-on proves who the user is; membership of organizations can follow directory groups (see Directory sources), but the role is never taken from the identity provider.

The role also decides what the interface shows. The interface has three workspaces, chosen at the top of the sidebar: RA for daily certificate work (every user), Oversight for fleet monitoring and compliance (administrators and auditors) and Administration for configuration (administrators). See Find your way in the interface.

Where to start