[cyphrs] Trust CA vs.
AWS Private CA.
If you inherited a single-tier ADCS and AWS Private CA looks like the obvious next step, this is the comparison you didn't get from either vendor. Pricing at 47-day cadence, compliance posture, operational model, and post-quantum readiness, side by side.
You inherited a CA that isn't viable, and AWS PCA is the obvious-looking next step.
Maybe it's a single-tier Microsoft ADCS where the Root and Issuing CA are on the same server. Maybe it's a Vault PKI engine that grew without an owner. Maybe it's an EJBCA install nobody on the current team set up. AWS Private CA appears as the managed alternative.
"We currently have an on-prem Microsoft Tier 1 CA setup where a single server is acting as both Root CA and Issuing CA (yeah, not ideal, inherited setup). We're planning to migrate this CA infrastructure to AWS."
r/PKI, April 2026
Before you commit to AWS PCA, here are the four dimensions the procurement evaluator should compare.
The renewal-volume math.
By March 2029, public TLS certificates renew on a 47-day cycle. The mandate doesn't apply to private CAs directly, but the operational expectations do – customers automating their public renewals will hold their internal CA to the same cadence. Worked example below: a mid-market customer with 200 certificates, renewing every 47 days, issuing ~1,600 certs per year.
| Pricing model | Annual cost at 1,600 issuances |
|---|---|
| AWS Private CA $400 / month base + per-private-cert above first 1,000 | ~$4,800 + per-cert overage |
| Venafi / Keyfactor / AppViewX Enterprise annual license | $50,000+ |
| DigiCert TLM Enterprise tier | $20,000 – $50,000+ |
| [cyphrs] Trust CA Fixed annual, no per-cert fees | £999 |
AWS PCA pricing is based on public list pricing as of 2026. Per-cert overage increases at higher volumes. The Cyphrs price covers the entire platform – not just the CA.
FIPS 140-3 is table stakes. Forward compatibility is the differentiator.
Both products meet the baseline. Where they diverge is what they ship today against the 2030 algorithm deprecation timeline.
- FIPS 140-2 / 140-3 validated cryptographic modules (CloudHSM-backed)
- No ML-DSA or ML-KEM issuance announced for the private CA
- Algorithm options: RSA 2048 / 4096, ECDSA P256 / P384 / P521
- FIPS 140-3 compliant cryptography (OpenSSL 3.0 Provider API)
- ML-DSA-65 / ML-DSA-87 native signing for root and intermediate today (NIST FIPS 204)
- Or stay classical (RSA / ECDSA) with a Catalyst hybrid extension carrying an ML-DSA signature alongside – backward compatible with every legacy verifier
- On-premises deployment – the root key never leaves your infrastructure
Built for teams without a PKI specialist.
AWS PCA exposes the full template / IAM / KMS surface. Powerful if you have a dedicated PKI engineer. Overhead if you don't. Cyphrs takes a different default: operators select who, the system determines what.
- Templates configured per certificate type, in IAM policy
- Algorithm selection per template; operator picks key size, hash, extensions
- Integration with AWS Certificate Manager and Route 53 for ACME flows
- Operational expertise required to avoid mis-issuance and over-broad templates
- System-determined certificate profiles – not arbitrary templates
- Operators bind an identity to a resource; algorithm and extensions are policy-controlled
- Public ACME and private issuance in the same product – one tool, both lanes
- Approval gates and immutable audit log built in. No bolt-on compliance
Don't pick a CA in 2026 you have to replace in 2030.
NIST has finalised ML-DSA. Industry guidance points to RSA and ECDSA deprecation by 2030, with hard cutover by 2035. The question for any private CA decision today is: can the CA you pick now also be the CA you run after 2030?
Cyphrs Trust CA's offline ceremony issues ML-DSA-65 / ML-DSA-87 native signed roots and intermediates today, or classical-with-Catalyst hybrid extensions. The choice happens at the ceremony – not as a retrofit project four years from now.
AWS Private CA hasn't announced ML-DSA issuance. Picking AWS PCA today is a decision to revisit the CA choice when AWS adds PQC, or when the algorithm deprecation deadline forces a migration.
When AWS Private CA is the right call.
We sell against alternatives where we have real advantages. We don't pretend we win every comparison. AWS PCA is the right choice when:
- 01 Your infrastructure is fully AWS-native and your security model treats AWS as the trust boundary. Adding an on-premises CA expands your attack surface in ways AWS PCA does not.
- 02 You have a dedicated PKI engineer who wants full template control and IAM-driven issuance authority, and the operational overhead is acceptable.
- 03 Your forward-compatibility horizon is short. You expect to revisit the CA decision when AWS adds PQC, not before.
- 04 Your private cert volume is low enough that the $400 / month base plus per-cert overage doesn't dominate your TCO.
For the mid-market customer with a non-AWS-native stack, no dedicated PKI engineer, a forward-compatibility requirement, and 200+ private certs renewing every 47 days – Cyphrs Trust CA is the more direct answer.
See the comparison against your real numbers.
Cert count, renewal cadence, compliance posture, forward-compatibility horizon. We'll walk you through the comparison for your specific shape and tell you honestly when AWS PCA is the better fit.