Comparison
AD CS was built for domain-joined Windows. Your estate isn't only that.
CertOps covers what AD CS doesn't: public certificates, appliances, Linux and macOS, and deploying certificates to where they're used.
Where AD CS runs out
What CertOps adds.
AD CSAutoenrollment covers domain-joined Windows. Everything else needs extra role services, MDM, or a manual request.
CertOpsAgents for Windows and macOS; SCEP, EST and the REST API (Pro) for the rest.
AD CSIt runs your own CA, and its certificates are trusted only where you distribute its root, so public certificates come from somewhere else.
CertOpsPublic certificates from Let's Encrypt, ZeroSSL and Google Trust Services alongside your internal ones.
AD CSIt puts certificates into the Windows certificate store. It doesn't install them on firewalls, load balancers or Linux servers.
CertOpsBuilt-in deployment to 19 target types, including FortiGate, Kemp LoadMaster, Sophos Firewall and Linux file drops.
AD CSSCEP needs the separate NDES role service, and there's no EST role service.
CertOpsSCEP and EST built in (Pro), with an NDES-compatible SCEP URL for existing clients.
AD CSEach CA tracks the certificates it issued.
CertOpsEvery certificate it manages, public and private, in one list with one audit trail.
| Capability | AD CS | CertOps |
|---|---|---|
| CA topology | One forest per deployment; each subordinate CA is its own server role | Many issuing CAs (per use case), across forests, from one instance (Pro) |
| Automated enrolment | Group Policy autoenrollment (user & machine) for domain-joined Windows; other devices need the CEP/CES role services, MDM or a manual request | Lightweight agent, Windows & macOS; machine certificates, plus user certificates where enabled |
| Approval workflow | Manual approval or autoenroll; no rule engine | Auto-approval rules + manual review queue, per template |
| AD-aware lifecycle | Checks the account at issuance; no automatic revocation when it is later disabled | Validate the account at issuance; revoke + update the CRL when it is disabled |
| Script signing with review | Issues code-signing certificates from a template; no script review workflow | Upload PowerShell scripts; admin reviews before signing |
| REST API for automation | No REST API; programmatic access is over DCOM/RPC or the CES web service | Full REST API (Pro) |
| SCEP / EST | SCEP via NDES — one configuration per server; no EST | SCEP + EST; many SCEP templates, each with its own CA and static or dynamic challenge; NDES-compatible (Pro) |
| Non-domain-joined & macOS | Extra role services (CEP/CES), MDM for macOS, or a manual request | First-class agent; cert into the macOS System keychain |
| Public certificates | Runs your own CA only; its certificates are trusted where you distribute its root | ACME client for Let’s Encrypt, ZeroSSL and Google Trust Services, with automatic deployment |
| Console authentication | No console of its own — management is MMC/RSAT under your Windows logon | Its own identity layer: many OIDC providers at once, JIT accounts with group-to-role mapping, TOTP or passkeys, CLI break-glass |
| CRL / OCSP | Yes (OCSP via the Online Responder role service) | Yes (both editions) |
Facts about AD CS reflect the shipping Windows Server role, per Microsoft's documentation.
Platform
Both run on Windows Server.
CertOps runs on Windows Server, the same platform as AD CS, so replacing AD CS doesn't add a new operating system to your estate. What changes is what sits above the host: agents for Windows and macOS, SCEP, EST and a REST API, public certificates, and deployment to your servers and appliances.
Moving across
Run them side by side, then move services across.
- Stand up a fresh hierarchy. Create a CertOps root and issuing CA and distribute the new root to your fleet. CertOps doesn't import an existing CA key, so you roll trust forward rather than lift the old issuer across.
- Move the workloads AD CS served worst. Enrol non-domain-joined devices and Macs through the agent; the win there is immediate.
- Repoint SCEP clients. Existing NDES/SCEP clients can point at a CertOps SCEP endpoint using its NDES-compatible URL.
- Retire AD CS. Once nothing depends on it, decommission the role; keep the old root available until its long-lived certificates age out.
On cost: CertOps has a free edition that never expires, and it runs alongside AD CS while you move services across, so nothing has to switch over at once.
A step-by-step version is in the migration guide.