Secardeo makes PKI software that automates how enterprises issue, distribute and manage digital certificates (X.509) and private keys. It is built for organisations that run their own certificate infrastructure and want to stop handling enrolment, renewal and revocation by hand.
All of its products sit on one platform, TOPKI, so certificates for users, devices, servers and email end up under the same control and audit trail whichever way they were issued.
At A Glance
| Vendor | Secardeo |
|---|---|
| Category | PKI and certificate lifecycle management |
| Identities covered | X.509 user, device and server certificates, S/MIME certificates, SSH keys |
| Deployment | On premises as Windows services and IIS web applications; Azure App Service in the customer tenant for certEntra |
| Customers | Luzerner Kantonalbank AG, Drägerwerk AG & Co. KGaA, STIHL, KV-Hessen |
| Founded | 2001 |
| Market classification | Identity Verification |
What Secardeo Does
Manual certificate handling causes outages when certificates expire and leaves keys scattered across clients and servers. TOPKI is a modular platform that automates each stage of the certificate lifecycle: enrolment, provisioning, retrieval, recovery, revocation, expiration and renewal. Its modules work with the CAs an organisation already runs rather than replacing them, obtaining certificates from those CAs and delivering them to the clients, users, servers and devices that need them. Issued certificates land in a central TOPKI database for control and auditing, so administrators have one inventory regardless of the enrolment route.
Products
CertEP
certEP lets organisations that use a non-Microsoft CA keep Windows autoenrolment. It acts as a Windows enterprise CA towards Windows 10 and 11 clients with no client software, using AD certificate templates and adding the attributes each request needs. It also archives keys, mainly for S/MIME, and serves mobile and network devices through SCEP via NDES and MDM integration.
CertEntra
certEntra is for organisations that have moved users to Entra ID and still need user certificates. It enrols certificates centrally for S/MIME encryption and signing and for certificate-based authentication to logins, VPN and 802.1x, and pushes certificates and private keys to every Intune-managed device a user has. Certificates renew automatically and are revoked when a user leaves the enrolment group. Keys can be archived with RSA or hybrid ML-KEM/RSA Key Recovery Agent certificates.
CertACME
certACME acts as an ACME server for standard ACME clients, so public web servers, internal Windows and Linux servers and clients can get certificates the same way. It also issues Apple device certificates using Apple Device Attestation and MDM lookup, supports HTTP, DNS and TLS-ALPN challenges, and applies a configurable crypto policy.
CertLife
Administrators who need to know which certificates exist and when they expire use certLife. It manages all X.509 certificates based on AD certificate templates, plus SSH keys, scans the network for TLS certificates and SSH keys, sends notifications before expiry, and offers role-based control from a browser.
Other Modules
| certPush | Distributes archived S/MIME certificates and keys to mobile devices |
|---|---|
| certBox | Provides partner S/MIME certificates for end-to-end encryption |
How It Works
| Component | What it does |
|---|---|
| certEP | Sits between Windows clients and the issuing CA, forwards requests and returns issued certificates. One instance can connect to several CAs, with MS SQL, MySQL or SQLite storage and HSM support. |
| certLife | Runs as a Windows service with a central SQL certificate database and an IIS web interface. |
| certACME | Runs as a Microsoft IIS web application and writes certificates to the central TOPKI database. |
| certEntra | Runs as a Web App service in the customer’s Azure cloud or on an on-premises virtual machine, with a customer-owned Azure Key Vault and an SQL database such as Azure SQL. |
Identities And Systems Covered
| Certificates | X.509 user, computer, SSL/TLS, VPN and S/MIME certificates |
|---|---|
| Keys | SSH public and private keys, archived S/MIME private keys |
| Users | Active Directory users, Entra ID users and groups |
| Devices | Windows 10/11, Linux, Apple, iOS and Android devices, network devices |
| Systems | Microsoft ADCS, Active Directory, Entra ID, Intune, Azure Key Vault |
Integrations
| Area | Integrations |
|---|---|
| Private and open source CAs | EJBCA, OpenXPKI, Dogtag, Red Hat, MTG |
| Public and cloud CAs | SwissSign, DigiCert, GlobalSign, AWS, Let’s Encrypt, ZeroSSL |
| Microsoft services | NDES, Group Policy, Azure SQL |
| Mail clients | Outlook, native mobile mail apps, Apple Mail |
Company Background
| Founded | 2001 |
|---|---|
| Headquarters | Ismaning near Munich, Germany |
| Leadership | Dr. Gunnar Jacobson, CEO since the company was founded |
Note: This overview is compiled from Secardeo’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.