ADCS vs AWS Private CA vs TigerTrust: Which Internal CA Should You Run?

The Three-Way Decision

Teams migrating off Microsoft ADCS land in one of three places:

1. Another Windows-domain CA (back to ADCS on a newer OS, or a competitor like EJBCA). Rare in 2026 - the architecture problems that drove the migration don't go away.
2. A cloud-native private CA (AWS Private CA, Azure Key Vault with Managed HSM, Google Cloud CAS). Rare for multi-cloud teams because of the lock-in.
3. A multi-cloud CLM-plus-CA (TigerTrust, Venafi, Keyfactor). The platform category that exists specifically to be the ADCS successor.

The usual shortlist in 2026 is ADCS (staying put), AWS Private CA (if the team is AWS-dominant), and TigerTrust (if the team wants multi-cloud + CLM in one place). This post compares those three honestly.

The One-Line Positioning

• ADCS - the Windows-domain CA you already have. Free with Windows Server. Works well for domain-joined machine certs. Everything else requires bolt-ons.
• AWS Private CA - a managed private CA inside AWS. $400/month per CA, $0.75 per cert for the first 1,000, $0.35 per cert thereafter. Works well for AWS-native workloads. Not designed to live outside AWS.
• TigerTrust - a managed private CA plus full CLM across every cloud and on-prem. Replaces ADCS, discovers certs it didn't issue, and ships compliance evidence packs. Not free.

Where Each One Wins

ADCS wins when:

• Your estate is 100% Windows-domain-joined machines
• Nobody is asking for ACME, EST, or SCEP outside NDES
• You already have an operations team that owns Windows Server, AD, and HSM integrations
• Your renewal cadence is annual (not weeks)
• Your audit framework accepts Windows event log as issuance evidence

This describes approximately zero of the enterprises standing up a new CA in 2026. It describes a lot of enterprises still running ADCS from 2015.

AWS Private CA wins when:

• Your workloads are overwhelmingly inside AWS
• Your issuance protocols are ACM / cert-manager / API-driven; devices are not in scope
• You are willing to accept per-CA + per-cert pricing that scales linearly
• Multi-cloud is not on your 3-year roadmap
• Your audit framework is covered by AWS compliance attestations plus your own evidence on top

AWS Private CA is a well-built product. It is also deliberately scoped to AWS. If your fleet is AWS Fargate, EKS, Lambda, and ACM, it is a clean fit. If you have a factory in Germany running IEC 62443-regulated OT gear, it is the wrong tool.

TigerTrust wins when:

• You have more than one cloud, or any on-prem footprint
• You have device fleets (iOS, Android, Windows, Linux, IoT) that need SCEP / EST
• Your renewal cadence is weeks, not years
• Compliance evidence needs to export to a SIEM in a structured format
• You want the CA and the CLM in the same platform, with the same audit trail

The common story: team starts on ADCS, acquires an AWS-heavy subsidiary, now has to issue to both and discovers neither covers the other. TigerTrust is the platform category that assumes this is the starting state.

Capability Comparison

The pattern is visible: ADCS and AWS PCA are CAs. TigerTrust is a CA plus everything around it.

Pricing (Honest)

ADCS

Nominally free (bundled with Windows Server). Real cost:

• Windows Server licenses: $3-10K per instance per year
• HSM integration: $50K-150K per module
• Operations: 0.25-0.5 FTE
• Audit prep: 0.5-1.0 FTE during audit periods

Total realistic cost for a production ADCS deployment with HSM and compliance: $200K-500K per year.

AWS Private CA

Published pricing:

• $400/month per general-purpose CA ($4,800/year)
• $0.75 per issued cert (first 1,000/month)
• $0.35 per cert (thereafter)

Realistic cost for a mid-market deployment (3 CAs, 50,000 certs/year):

• 3 CAs × $4,800 = $14,400
• First 36,000 certs × $0.75 = $27,000 (12 months × 1,000 × 3 CAs)
• Remaining 14,000 certs × $0.35 = $4,900
• Total: ~$46,000/year

Plus the ancillary costs of AWS-only scope: a separate CLM for non-AWS certs, separate operations for the Jamf / Intune integration, separate pathways for on-prem.

TigerTrust

Transparent per-cert pricing with no per-CA fees. The managed service tier is in the mid-5-figures to low-6-figures range for most mid-market enterprises, which is comparable to the AWS Private CA + ancillary-CLM total.

The pricing differentiator isn't the sticker number - it's that TigerTrust includes the CLM, the device-fleet integrations, and the compliance evidence pack. For teams that would otherwise license Venafi or Keyfactor on top of their chosen CA, TigerTrust collapses two line items into one.

When ADCS Still Makes Sense (The Honest Version)

Keep ADCS if:

• Your entire PKI use case is Windows domain-joined machine certs for Kerberos and 802.1X
• You have zero compliance pressure asking for structured issuance evidence
• You have an operations team that genuinely enjoys running the ADCS stack
• You have no roadmap item that requires ACME, EST, or non-Windows SCEP
• You are not currently feeling pain

For teams that fit all five, migration is a cost without a benefit. For teams that fit three or four, the migration ROI is high. For teams that fit zero to two, migration is overdue.

When AWS Private CA Still Makes Sense

Choose AWS Private CA if:

• 95%+ of your issuance is to AWS-hosted workloads
• Your relying parties are inside AWS (ACM, ELB, CloudFront, API Gateway)
• You have no device fleet
• Your compliance program is already AWS-centric and accepts AWS attestations as evidence
• You do not need CLM for non-AWS certs

For teams that fit this profile, AWS Private CA is a clean, well-run product with no reason to look elsewhere.

The Multi-Cloud Trap

The pattern we see most often: team migrates ADCS to AWS Private CA because the engineering org is AWS-dominant. Six months later, an acquisition brings Azure into scope. Twelve months later, a greenfield project uses GCP. The AWS-only private CA is now one of three CAs the team runs - and the CLM problem that ADCS had is back, just distributed across three clouds instead of one on-prem forest.

The multi-cloud trap is why most teams in that migration end up choosing a cloud-agnostic CA like TigerTrust after the fact. The pragmatic path is to choose the cloud-agnostic option from day one if there is any possibility of multi-cloud in your future.

Related Reading

• Migrating off Microsoft ADCS - the pillar guide
• TigerTrust vs Microsoft ADCS - the ADCS comparison in detail
• TigerTrust vs AWS Private CA - the AWS PCA comparison in detail
• TigerTrust vs HashiCorp Vault - the other common ADCS successor