The arithmetic
SanctiKey vs AWS Private CA
AWS Private CA is a good product priced for a buyer with an enterprise budget. It bills per certificate authority per month whether or not you issue a single certificate, and a conventional two-tier hierarchy needs two of them, so the meter starts at $800 before anything useful happens.
| Line item | AWS Private CA | SanctiKey |
|---|---|---|
| Offline root CA | $400/mo | included in base |
| One issuing intermediate | $400/mo | $12/mo |
| Two-tier hierarchy, monthly | $800/mo | $61/mo |
| Two-tier hierarchy, first year | $9,600/yr | $671/yr |
| Certificates, first 1,000 | $0.75 each | from bundled ops |
| Managed CRL distribution | included | included |
| Managed OCSP responder | $0.06/cert/mo + queries | included |
| Enrollment protocols | SCEP + AD connectors; no ACME | none. REST API + console |
| Short-lived certificate mode | $50/CA/mo + $0.058/cert | no separate mode |
AWS figures are list price from aws.amazon.com/private-ca/pricing, checked 25 July 2026. SanctiKey figures are computed from the same constants that drive the estimator, so they cannot drift. Each SanctiKey key bundles 100K crypto operations a month and a certificate signature counts as two, so a bundled key covers 50,000 certificate signatures before a single extra block is billed.
Two rows need more than a cell. Revocation: CRL distribution carries no line item on either side; Private CA bills its OCSP responder only once you switch the feature on, at $0.06 per certificate per month plus $0.20 per 100,000 queries, while ours is on by default at no separate charge. Enrollment: neither product speaks ACME, and neither speaks EST. Private CA closes the gap with connectors for SCEP, Active Directory and Kubernetes, all offered at no additional charge, so Intune and Jamf fleets, domain joined Windows machines and cert-manager in a cluster can enroll themselves. We ship no enrollment protocol, which is the honest limit described below.
The number that matters
$8,929 a year, for the same two-tier private hierarchy, before you issue a certificate.
Your root key also sits in an AWS account outside your organization, which is the one thing a CA living inside your own account can’t do for you no matter what you pay for it.
Four places AWS Private CA is the better buy.
A comparison page that can’t find anything good to say about the alternative is an advertisement, so here are the cases where we’d tell you to buy theirs.
Native AWS certificate consumption
Private CA issues into ACM, so private certificates land straight onto load balancers, CloudFront distributions, API Gateway and EKS without you writing any plumbing. If AWS services consume nearly all of your certificates, that integration is worth real money and we have nothing equivalent.
Device fleets and Windows estates
Their SCEP, Active Directory and Kubernetes connectors come at no additional charge, which means Intune and Jamf fleets, domain-joined Windows machines and cert-manager in a cluster can all enroll themselves without anyone writing the enrollment path. We ship no enrollment protocol at all, so if your fleet expects to enroll itself, that gap is the entire decision and you should buy Private CA.
The CA under your own organization
Some architectures genuinely want the CA governed by the same org, the same SCPs and the same audit posture as everything else, which is the exact opposite of how we built this. For those architectures theirs is the right call.
High certificate volume
Past ten thousand certificates their per-certificate price drops to a tenth of a cent, and once your issuance rate is high enough the monthly CA fee stops being the term that matters.
Where our certificate authority stops
We run a real CA, which means you create roots and intermediates, chain them, sign CSRs, issue and revoke certificates, and relying parties check revocation against public CRL and OCSP endpoints we operate. What you don’t get is an enrollment ecosystem, so there’s no ACME, no SCEP, no EST, no auto-enrollment, and nothing watching an expiry date on your behalf. Integration is your pipeline calling the REST API, plus the console for the people who’d rather click.
Renewal automation is your pipeline’s job. Signing, revocation, and revocation truth are ours.
If your build pipeline already issues on a schedule, closing that gap is a REST call and a cron entry. If you’re provisioning a fleet that expects to enroll itself, it’s a project, and you should price the project into this comparison now rather than find it during integration.
Publicly trusted certificates: neither product belongs there
Browser-trusted TLS and publicly trusted code signing need a CA that’s been admitted to a root program and audited under WebTrust, which is a different business with different politics. Both products here are private trust, so neither substitutes for a public CA, and we’re not applying to become one. Private trust still covers firmware signing, device identity, internal service mTLS, and code signing against a root you control and embed yourself.