[{"data":1,"prerenderedAt":663},["ShallowReactive",2],{"sc:header-data-en":3,"sc:footer-data-en":102,"post-en--posts-private-ca-vs-public-ca-1bb9a0237a1a5":131,"content-en-list-7b291c2dd91a4":557,"authors_data:Kevin Vo":657},{"lang":4,"home":5,"navigation":14,"contact":95},"en",{"name":6,"imgLight":7,"img":8,"languages":9},"home","/products/scepman/scepman-logo-all-white.svg","/products/scepman/scepman-logo-rgb.svg",{"en":10},{"title":11,"url":12,"alt":13},"Home","/en","SCEPman",[15,19,25,31,83,89],{"name":16,"languages":17},"nav-home",{"en":18},{"title":11,"url":12},{"name":20,"languages":21},"pricing",{"en":22},{"title":23,"url":24},"Pricing","/en/pricing",{"name":26,"languages":27},"partner",{"en":28},{"title":29,"url":30},"Partner","/en/partner",{"name":32,"languages":33,"children":36},"support-hub",{"en":34},{"title":35},"Support Hub",[37,53,68],{"name":38,"children":39},"support-hub-group-1",[40,47],{"name":41,"target":42,"languages":43},"docs","_blank",{"en":44},{"title":45,"url":46},"Docs","https://docs.scepman.com/",{"name":48,"languages":49},"faq",{"en":50},{"title":51,"url":52},"FAQ","/en/faq",{"name":54,"children":55},"support-hub-group-2",[56,62],{"name":57,"target":42,"languages":58},"support-ticket",{"en":59},{"title":60,"url":61},"Support Ticket","https://support.scepman.com/support/tickets/new?ticket_form=technical_support_request_%28scepman%29",{"name":63,"target":42,"languages":64},"drop-a-question",{"en":65},{"title":66,"url":67},"Drop a Question","https://support.scepman.com/support/tickets/new?ticket_form=drop_a_question_%28scepman%29",{"name":69,"children":70},"support-hub-group-3",[71,77],{"name":72,"languages":73},"glossary",{"en":74},{"title":75,"url":76},"Glossary","/en/glossary",{"name":78,"languages":79},"blog",{"en":80},{"title":81,"url":82},"Blog","/en/blog",{"name":84,"languages":85},"events",{"en":86},{"title":87,"url":88},"Events","/en/events",{"name":90,"languages":91},"about",{"en":92},{"title":93,"url":94},"About us","/en/about-us",{"name":96,"languages":97},"contact",{"en":98},{"title":99,"url":100,"active":101},"support@scepman.com","mailto:support@scepman.com",false,{"data":103},{"mail":104,"logos":105,"socials":110,"links":123},"sales@SCEPman.com",[106],{"img":107,"alt":108,"url":109},"/products/scepman/scepman-logo-yellow.svg","SCEPman Logo","/",[111,115,119],{"icon":112,"url":113,"title":114},"fa-x-twitter","https://twitter.com/scepman_","X",{"icon":116,"url":117,"title":118},"fa-youtube","https://www.youtube.com/channel/UCKnLYxlQFhzdXkDADV_Unrg","Youtube",{"icon":120,"url":121,"title":122},"fa-linkedin","https://www.linkedin.com/showcase/scepman","LinkedIn",[124,127,129],{"title":125,"url":126},"Privacy","/enundefined",{"title":128,"url":126},"Imprint",{"title":130,"url":126},"Contact & Locations",{"id":132,"title":133,"author":134,"body":136,"cta":517,"description":142,"eventid":517,"extension":518,"hideInRecent":101,"layout":519,"meta":520,"moment":523,"navigation":547,"path":549,"seo":550,"stem":551,"tags":552,"webcast":101,"__hash__":556},"content_en/posts/private-ca-vs-public-ca.md","Private vs Public CAs: You Might Be Using the Wrong One",[135],"Kevin Vo",{"type":137,"value":138,"toc":500},"minimal",[139,143,148,151,157,173,176,180,183,188,205,208,212,305,309,313,316,321,324,328,343,346,350,353,367,370,374,383,386,394,398,417,426,430,433,436,453,459,497],[140,141,142],"p",{},"To an IT team under pressure, a public Certificate Authority (CA) often looks like a hammer, and every encryption requirement looks like a nail. But using a public CA for every job is one of the most common ways to quietly break production.",[144,145,147],"h2",{"id":146},"what-public-cas-are-built-for","What Public CAs Are Built For",[140,149,150],{},"A public CA (like DigiCert, Sectigo, or Let's Encrypt) is designed for one main scenario: when you need to establish trust with devices you don't control. The idea is that external users don't have to configure a thing on their end to trust your site or service.",[140,152,153],{},[154,155,156],"strong",{},"A public CA makes sense when:",[158,159,160,164,167,170],"ul",{},[161,162,163],"li",{},"You're running public-facing services for external users, customers, or partners with no pre-existing trust relationship with your organization",[161,165,166],{},"External APIs or services connect to your infrastructure without custom client configuration",[161,168,169],{},"Certificate errors would show up as a browser warning to end users",[161,171,172],{},"You're signing emails and recipients need to verify the signature without any prior configuration",[140,174,175],{},"The CA/Browser Forum governs what public CAs can issue. You're subject to rules you don't control, which for many, is a reasonable trade-off for the scenarios above. Using a public CA may become a problem when you're using those same certificates for internal authentication.",[144,177,179],{"id":178},"what-private-cas-are-built-for","What Private CAs Are Built For",[140,181,182],{},"A private CA is one you run, or one your vendor runs on your behalf. You define the issuance policy. The certificates aren't trusted anywhere by default. You push your private CA's root certificate to your devices and users through Group Policy, Intune, or your MDM platform, and your managed endpoints trust certificates issued by your private CA.",[140,184,185],{},[154,186,187],{},"A private CA is the right fit for anything where only your own infrastructure needs to trust the certificate:",[158,189,190,193,196,199,202],{},[161,191,192],{},"Device authentication, proving a machine is managed and belongs to your organization",[161,194,195],{},"User certificate authentication, passwordless login, smart card equivalents or internal app access",[161,197,198],{},"Securing Wi-Fi (802.1X) and VPN connections",[161,200,201],{},"Setting up mutual TLS (mTLS) between backend microservices",[161,203,204],{},"Code signing for internal tools and scripts",[140,206,207],{},"You retain full control over the trust chain and issuance policy, with no dependency on external CA governance.",[144,209,211],{"id":210},"public-ca-or-private-ca-a-quick-comparison","Public CA or Private CA? A Quick Comparison",[213,214,218],"div",{"className":215,"style":217},[216],"ca-compare","grid-column: content; overflow-x: auto;",[219,220,221,222],"table",{},"\n  ",[223,224,225,221,238,221,250,221,261,221,272,221,283,221,294],"tbody",{},[226,227,228,229,228,232,228,235,221],"tr",{},"\n    ",[230,231],"th",{},[230,233,234],{},"Public CA",[230,236,237],{},"Private CA",[226,239,228,240,228,244,228,247,221],{},[241,242,243],"td",{},"Trusted by",[241,245,246],{},"Any device by default (browsers, OS root stores)",[241,248,249],{},"Only devices you've explicitly configured to trust it",[226,251,228,252,228,255,228,258,221],{},[241,253,254],{},"Best for",[241,256,257],{},"External-facing websites, customer-facing APIs, S/MIME email",[241,259,260],{},"Device auth, user auth, Wi-Fi/VPN (802.1X), mTLS, internal code signing",[226,262,228,263,228,266,228,269,221],{},[241,264,265],{},"Who sets the rules",[241,267,268],{},"CA/Browser Forum and root programs (Chrome, Mozilla, Apple, Microsoft)",[241,270,271],{},"You (or your PKI vendor)",[226,273,228,274,228,277,228,280,221],{},[241,275,276],{},"Certificate lifespan",[241,278,279],{},"Shrinking fast: 200 days (2026), 100 days (March 2027), 47 days (March 2029)",[241,281,282],{},"Whatever validity period makes sense for your environment",[226,284,228,285,228,288,228,291,221],{},[241,286,287],{},"Client authentication (clientAuth)",[241,289,290],{},"Being phased out entirely from public TLS certificates by March 2027",[241,292,293],{},"Fully supported, no restrictions",[226,295,228,296,228,299,228,302,221],{},[241,297,298],{},"Typical failure mode if misused",[241,300,301],{},"Browser warnings for external users",[241,303,304],{},"N/A, since it's never exposed to devices outside your control",[306,307,308],"style",{},"\n.ca-compare { margin-bottom: 3rem; }\n.ca-compare table { border-collapse: collapse; width: 100%; }\n.ca-compare th,\n.ca-compare td {\n  border: 1px solid rgba(0, 0, 0, 0.15);\n  padding: 0.65rem 1rem;\n  vertical-align: top;\n  text-align: left;\n}\n.ca-compare th { background: rgba(0, 0, 0, 0.03); font-weight: 600; }\n",[144,310,312],{"id":311},"where-things-go-wrong","Where Things Go Wrong",[140,314,315],{},"The most common mistake IT teams make is using public CA certificates for internal authentication. Public CAs were never meant for internal workloads, and two shifts happening right now are making that gap impossible to ignore.",[317,318,320],"h3",{"id":319},"_1-no-more-client-authentication-ekus-on-public-tls","1. No more Client Authentication EKUs on public TLS",[140,322,323],{},"Publicly trusted TLS certificates are no longer allowed to carry the Client Authentication EKU. Driven by CA/Browser Forum Ballot SC-081 and major root program updates, public CAs are phasing out clientAuth ahead of the March 2027 hard cutoff. If your internal device or user authentication relies on public certificates, those setups will no longer function upon your next renewal.",[317,325,327],{"id":326},"_2-rapidly-shrinking-lifespan","2. Rapidly shrinking lifespan",[140,329,330,331,334,335,338,339,342],{},"Public CAs are constantly cutting certificate validity windows. Under SC-081v3, public validity limits are capped at ",[154,332,333],{},"200 days"," (2026), dropping to ",[154,336,337],{},"100 days"," in March 2027, and ",[154,340,341],{},"47 days"," by March 2029. Automated tools handle 90-day renewals fine on public web servers, but re-enrolling thousands of internal laptops or devices every six weeks is an administrative nightmare.",[140,344,345],{},"A private CA sits outside these constraints. Because you handle revocation directly inside your environment, you do not need artificially short lifetimes or external validation checks. You set the validity periods and rules that make sense for your team.",[144,347,349],{"id":348},"how-to-decide-which-one-to-use","How to Decide Which One to Use",[140,351,352],{},"For each certificate in your environment, ask: do you control every device or client that needs to validate this certificate?",[158,354,355,361],{},[161,356,357,360],{},[154,358,359],{},"If yes:"," Use a private CA. You push the root CA certificate, control what gets issued, and stop being subject to external rule changes.",[161,362,363,366],{},[154,364,365],{},"If no:"," You need a public CA. Someone connecting from outside without prior configuration needs a CA their device already trusts.",[140,368,369],{},"Most IT departments end up needing both: public certificates for external-facing services, private certificates for devices, users, and internal services.",[144,371,373],{"id":372},"how-scepman-fits-in","How SCEPman Fits In",[140,375,376,377,382],{},"SCEPman is a cloud-native private CA that integrates with Microsoft Intune and Entra ID, as well as other MDM platforms through SCEP and EST. It ",[378,379,381],"a",{"href":380},"/mdms/pki-certificate-management-microsoft-intune-mdm","handles automatic certificate issuance"," for managed devices and users.",[140,384,385],{},"For Intune environments, SCEPman ties certificate validity to device compliance status. A device that gets wiped or falls out of compliance loses its certificate, automatically cutting off access to Wi-Fi, VPN, and internal applications.",[140,387,388,389,393],{},"SCEPman can also ",[378,390,392],{"href":391},"microsoft-cloud-pki-manually-issuing-certificates","manually issue certificates"," using Certificate Master. This allows IT departments to replace public CA certificates across internal systems like web portals, apps, and device management interfaces.",[144,395,397],{"id":396},"where-to-start","Where to Start",[213,399,403,406],{"className":400,"style":402},[401],"tight-list","grid-column: content;",[140,404,405],{},"If you're not sure where your environment stands, start with a certificate inventory:",[158,407,408,411,414],{},[161,409,410],{},"Look at your active certificates and their issuing CAs.",[161,412,413],{},"Flag any certificates carrying the Client Authentication EKU from a public CA.",[161,415,416],{},"Plan to migrate the certificates before their next renewal.",[140,418,419,420,425],{},"If you don't have a private CA or you're looking to move off legacy on-premises Active Directory Certificate Services (ADCS), that's a good starting point for a ",[378,421,424],{"href":67,"rel":422},[423],"nofollow","SCEPman conversation",".",[144,427,429],{"id":428},"try-scepman-for-yourself","Try SCEPman for Yourself",[140,431,432],{},"Start a 30-day trial to see how SCEPman issues and manages private CA certificates for your devices, users, and internal services, without the overhead of running your own PKI.",[306,434,435],{},".trial-cta { display: inline-block; margin-bottom: 3.5rem; } .trial-cta:hover { --cta-copy-color: white !important; }",[140,437,438],{},[378,439,448],{"role":440,"className":441,"dataText":446,"href":447,"target":42},"button",[442,443,444,445],"cta","btn","btn-primary","trial-cta","Start SCEPman 30-day trial","https://support.scepman.com/support/tickets/new?ticket_form=trial_request_%28scepman%29",[449,450,446],"span",{"className":451},[452],"cta__text",[144,454,458],{"id":455,"className":456},"frequently-asked-questions",[457],"faq-heading","Frequently Asked Questions",[213,460,463,473,481,489],{"className":461,"style":402},[462],"faq-foldable",[464,465,466,470],"details",{},[467,468,469],"summary",{},"Can I still use a public CA certificate for internal device authentication after 2027?",[140,471,472],{},"Not for client authentication. Once your public CA removes the clientAuth EKU (most are targeting late 2026 through March 2027), certificates it issues will only support server authentication. Internal auth use cases need to move to a private CA before that renewal cycle hits.",[464,474,475,478],{},[467,476,477],{},"Do I need to replace certificates that already have clientAuth today?",[140,479,480],{},"Not immediately. Certificates issued before your CA's cutoff date remain valid until they expire. The break happens on renewal, when the reissued certificate no longer includes clientAuth. Plan the migration before that renewal, not after it fails.",[464,482,483,486],{},[467,484,485],{},"Is this the same change as the shorter certificate lifespans?",[140,487,488],{},"No. The clientAuth removal comes from the Chrome Root Program's root store policy. The shrinking validity periods (200 days, then 100, then 47) come from a separate CA/Browser Forum ballot, SC-081v3. Both push in the same direction, away from public certificates for internal use, but they're two different mandates with two different timelines.",[464,490,491,494],{},[467,492,493],{},"What's the fastest way to check if this affects me?",[140,495,496],{},"Inventory your active certificates and flag any that carry the Client Authentication EKU and come from a public CA. Those are the ones that need a migration plan before their next renewal.",[306,498,499],{},"\n.faq-heading {\n  margin-top: 4rem;\n  white-space: nowrap;\n}\n.tight-list p { margin-bottom: 0.25rem !important; }\n.tight-list ul { margin-top: 0 !important; }\n.faq-foldable {\n  margin-bottom: 4rem;\n}\n.faq-foldable details {\n  border-top: 1px solid rgba(0, 0, 0, 0.12);\n  padding: 0;\n}\n.faq-foldable details:last-of-type {\n  border-bottom: 1px solid rgba(0, 0, 0, 0.12);\n}\n.faq-foldable summary {\n  list-style: none;\n  cursor: pointer;\n  display: flex;\n  justify-content: space-between;\n  align-items: center;\n  gap: 1rem;\n  padding: 1rem 0;\n  font-weight: 600;\n}\n.faq-foldable summary::-webkit-details-marker {\n  display: none;\n}\n.faq-foldable summary::after {\n  content: \"+\";\n  flex: 0 0 auto;\n  font-weight: 400;\n  font-size: 1.5em;\n  line-height: 1;\n  transition: transform 0.2s ease;\n}\n.faq-foldable details[open] summary::after {\n  content: \"\\2212\";\n}\n.faq-foldable details > *:not(summary) {\n  margin-bottom: 1rem;\n}\n.faq-foldable details[open] summary {\n  padding-bottom: 0.5rem;\n}\n",{"title":501,"searchDepth":502,"depth":502,"links":503},"",2,[504,505,506,507,512,513,514,515,516],{"id":146,"depth":502,"text":147},{"id":178,"depth":502,"text":179},{"id":210,"depth":502,"text":211},{"id":311,"depth":502,"text":312,"children":508},[509,511],{"id":319,"depth":510,"text":320},3,{"id":326,"depth":510,"text":327},{"id":348,"depth":502,"text":349},{"id":372,"depth":502,"text":373},{"id":396,"depth":502,"text":397},{"id":428,"depth":502,"text":429},{"id":455,"depth":502,"text":458},null,"md","post",{"lang":4,"seoTitle":521,"titleClass":522,"date":523,"categories":524,"blogtitlepic":525,"socialimg":526,"customExcerpt":527,"keywords":528,"asideNav":529,"maxContent":547,"footer":548},"Private CA vs Public CA: When to use each","h2-font-size","2026-08-24",[13],"header-scepman-private-vs-public-ca.png","/blog/heads/header-scepman-private-vs-public-ca.png","Public CA certificates lose client authentication support by March 2027. See when a private CA is required, and how SCEPman automates issuance.","private CA vs public CA, client authentication EKU deprecation, certificate authority for internal authentication, SC-081 clientAuth removal, public CA certificate lifespan 2027, when to use a private certificate authority, SCEPman private CA, mTLS certificate authority, 802.1X device authentication certificates, migrate from ADCS to cloud PKI",{"menuItems":530},[531,533,535,537,539,541,543,545],{"href":532,"text":147},"#what-public-cas-are-built-for",{"href":534,"text":179},"#what-private-cas-are-built-for",{"href":536,"text":211},"#public-ca-or-private-ca-a-quick-comparison",{"href":538,"text":312},"#where-things-go-wrong",{"href":540,"text":349},"#how-to-decide-which-one-to-use",{"href":542,"text":373},"#how-scepman-fits-in",{"href":544,"text":397},"#where-to-start",{"href":546,"text":458},"#frequently-asked-questions",true,{"noMargin":547},"/posts/private-ca-vs-public-ca",{"title":133,"description":142},"posts/private-ca-vs-public-ca",[237,234,553,554,555],"PKI","Client Authentication","Certificate Authority","eSk6S5ekZhVNkERr9gyIqOe0J8kb17YJUNPU7O3EEnw",{"list":558,"authors":656},[559,564,581,595,608,620,632,644],{"id":132,"title":133,"author":560,"cta":517,"description":142,"hideInRecent":101,"layout":519,"meta":561,"moment":523,"path":549,"stem":551,"tags":563,"webcast":101},[135],{"lang":4,"date":523,"categories":562,"blogtitlepic":525,"customExcerpt":527},[13],[237,234,553,554,555],{"id":565,"title":566,"author":567,"cta":517,"description":569,"hideInRecent":101,"layout":519,"meta":570,"moment":571,"path":575,"stem":576,"tags":577,"webcast":101},"content_en/posts/adcs-alternatives.md","Microsoft ADCS Alternatives in 2026",[568],"SCEPman Team","Microsoft Active Directory Certificate Services — also known as ADCS, ADCA, or Microsoft CA — has been the default PKI for Windows environments for years. Many organizations still rely on it for certificate issuance across users, devices, and servers.",{"lang":4,"date":571,"categories":572,"blogtitlepic":573,"customExcerpt":574},"2026-05-01",[13],"header-scepman-adcs-alternatives.png","Looking for ADCS, ADCA, or Microsoft CA alternatives? Active Directory Certificate Services adds complexity modern environments don't need. Here's what to look for in a replacement.","/posts/adcs-alternatives","posts/adcs-alternatives",[578,579,553,580],"ADCS","Alternatives","Active Directory Certificate Services",{"id":582,"title":583,"author":584,"cta":517,"description":585,"hideInRecent":101,"layout":519,"meta":586,"moment":571,"path":590,"stem":591,"tags":592,"webcast":101},"content_en/posts/microsoft-cloud-pki-alternatives.md","Microsoft Cloud PKI Alternatives in 2026",[568],"Microsoft Cloud PKI is designed for issuing certificates to Intune-managed devices. It works well for mobile and endpoint management in Microsoft-centric environments.",{"lang":4,"date":571,"categories":587,"blogtitlepic":588,"customExcerpt":589},[13],"header-scepman-cloud-pki-alternatives.png","Looking for Microsoft Cloud PKI alternatives? Cloud PKI only covers Intune-managed devices — no Linux, no servers, no IoT. Here's where it falls short and what to look for in a replacement.","/posts/microsoft-cloud-pki-alternatives","posts/microsoft-cloud-pki-alternatives",[593,579,594,553],"Microsoft Cloud PKI","Microsoft Intune",{"id":596,"title":597,"author":598,"cta":517,"description":501,"hideInRecent":101,"layout":519,"meta":599,"moment":600,"path":604,"stem":605,"tags":606,"webcast":101},"content_en/posts/microsoft-cloud-pki-iot-certificates.md","Creating IoT Certificates with Microsoft Cloud PKI: Your Alternatives and Solutions",[568],{"lang":4,"date":600,"categories":601,"blogtitlepic":602,"customExcerpt":603},"2026-03-25",[13],"header-scepman-iot-certificates.png","Are you looking for a way to create and manage certificates for IoT devices using Microsoft Cloud PKI? Unfortunately, Microsoft Cloud PKI does not support IoT certificates. By design it only supports Intune managed devices.","/posts/microsoft-cloud-pki-iot-certificates","posts/microsoft-cloud-pki-iot-certificates",[593,607,594],"IoT Certificates",{"id":609,"title":610,"author":611,"cta":517,"description":501,"hideInRecent":101,"layout":519,"meta":612,"moment":600,"path":616,"stem":617,"tags":618,"webcast":101},"content_en/posts/microsoft-cloud-pki-linux-certificates.md","Creating Linux Endpoint Certificates with Microsoft Cloud PKI: Your Alternatives and Solutions",[568],{"lang":4,"date":600,"categories":613,"blogtitlepic":614,"customExcerpt":615},[13],"header-scepman-linux-endpoint-certificates.png","Are you searching for a solution to create and manage certificates for Linux endpoints with Microsoft Cloud PKI? Unfortunately, Microsoft Cloud PKI does not support Linux endpoint certificates.","/posts/microsoft-cloud-pki-linux-certificates","posts/microsoft-cloud-pki-linux-certificates",[593,619,594],"Linux Endpoint Certificates",{"id":621,"title":622,"author":623,"cta":517,"description":501,"hideInRecent":101,"layout":519,"meta":624,"moment":600,"path":628,"stem":629,"tags":630,"webcast":101},"content_en/posts/microsoft-cloud-pki-manually-issuing-certificates.md","Manually Issuing Certificates with Microsoft Cloud PKI: Your Alternatives and Solutions",[568],{"lang":4,"date":600,"categories":625,"blogtitlepic":626,"customExcerpt":627},[13],"header-scepman-manual-certificates.png","Do you need to manually issue certificates for specific scenarios, such as securing web servers, signing code, or other use cases? Unfortunately, Microsoft Cloud PKI does not support manual certificate issuance. By design, it only supports Intune managed devices.","/posts/microsoft-cloud-pki-manually-issuing-certificates","posts/microsoft-cloud-pki-manually-issuing-certificates",[593,631,594],"Manually Issued Certificates",{"id":633,"title":634,"author":635,"cta":517,"description":501,"hideInRecent":101,"layout":519,"meta":636,"moment":600,"path":640,"stem":641,"tags":642,"webcast":101},"content_en/posts/microsoft-cloud-pki-network-device-certificates.md","Creating Certificates for Network Devices with Microsoft Cloud PKI: Your Alternatives and Solutions",[568],{"lang":4,"date":600,"categories":637,"blogtitlepic":638,"customExcerpt":639},[13],"header-scepman-certificates-network-devices.png","Are you searching for a solution to create and manage certificates for network devices with Microsoft Cloud PKI? Unfortunately, Microsoft Cloud PKI does not support network devices certificates. By design it only supports Intune managed devices, only.","/posts/microsoft-cloud-pki-network-device-certificates","posts/microsoft-cloud-pki-network-device-certificates",[593,643,594],"Network Device Certificates",{"id":645,"title":646,"author":647,"cta":517,"description":501,"hideInRecent":101,"layout":519,"meta":648,"moment":600,"path":652,"stem":653,"tags":654,"webcast":101},"content_en/posts/microsoft-cloud-pki-server-certificates.md","Creating Server Certificates with Microsoft Cloud PKI: Alternatives and Solutions",[568],{"lang":4,"date":600,"categories":649,"blogtitlepic":650,"customExcerpt":651},[13],"header-scepman-server-certificates.png","Are you looking for a way to create server certificates using Microsoft Cloud PKI? Many organizations rely on Microsoft's PKI solutions for certificate management, but there’s a significant limitation: Microsoft Cloud PKI does not support server certificates. By design it only supports Intune managed devices, only.","/posts/microsoft-cloud-pki-server-certificates","posts/microsoft-cloud-pki-server-certificates",[593,655,594],"Server Certificates",{},{"id":658,"extension":659,"meta":660,"stem":661,"__hash__":662},"authors_data/authors.json","json",{},"authors","PIJJchcHqfzD5YPmn4V8YLxY6gtySOfBG5u8lTczi2w",1790429702140]