Public Key Infrastructure (PKI) Companies

Public Key Infrastructure Market Opening Overview

Why the Public Key Infrastructure Market Is Expanding?

The Public Key Infrastructure (PKI) Market is at the most consequential inflection point in its 30-year history — simultaneously absorbing the largest regulatory compliance wave in enterprise cybersecurity (zero-trust mandates, eIDAS 2.0, PCI DSS 4.0), the fastest certificate-volume multiplication in history (IoT device identity proliferation, 90-day validity compression), and the most disruptive cryptographic transition since RSA was commercialized (NIST's August 2024 post-quantum standards). Per MRFR analysis, the PKI Market reached USD 8.10 Billion in 2025, opens the forecast period at USD 9.65 Billion in 2026, and is projected to reach USD 46.85 Billion by 2035 at a CAGR of 19.2%. Solutions — hardware security modules (22.3% share) and certificate lifecycle-management platforms (33.2% share) — account for 55.5% of 2025 revenue; Services grow fastest at 24.6% CAGR. Authentication and access control holds the largest application share at 34.8%; IoT identity management grows fastest at 24.9% CAGR. BFSI leads end-user adoption at 23.6% share; Healthcare and Life Sciences posts the highest sectoral CAGR to 2035. North America commands 37.4% regional share, anchored by OMB M-22-09 and DoD CMMC; Asia-Pacific is the fastest-growing region at 24.1% CAGR, driven by data-residency laws across India, Indonesia, and Vietnam; Europe holds 28.1% share under eIDAS 2.0 and PSD3 compliance timelines.

The demand structure is now multi-layered and compounding. NIST's August 2024 publication of FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) — the first finalized post-quantum cryptographic standards — triggered enterprise cryptographic-inventory assessments and hybrid PKI planning cycles that will sustain procurement activity through 2035. The migration cost for a Fortune 500 enterprise is estimated at USD 10–50 million over five to seven years, creating a multi-year revenue tailwind that no other PKI market driver matches in duration. The CA/Browser Forum's decision to reduce maximum TLS certificate validity to 90 days by 2028 — phased from 398 days — fundamentally reshapes certificate lifecycle economics: enterprises managing 50,000+ certificates will face renewal events four times more frequently, making automated certificate lifecycle management platforms (CLM) not an efficiency investment but an operational survival requirement. Venafi's 2024 Machine Identity Report found 83% of enterprises experienced at least one certificate-related outage in the prior year, with costs of USD 300,000–500,000 per incident — a risk quantification that converts PKI CLM from a security budget line to a business-continuity investment with a quantifiable ROI case that CFOs can evaluate independently of CISO advocacy. The EU's eIDAS 2.0 implementing acts, published November 2024, specified technical requirements for EU Digital Identity Wallet trust services backed by qualified PKI trust anchors, creating a compliance procurement wave across 27 member states and their private-sector digital-service providers.

What Structurally Separates Leaders from the Field?

Competitive separation in the PKI Market is determined by four structural advantages: post-quantum cryptographic readiness (can the platform issue hybrid classical/PQ certificates today?), certificate automation depth (does the platform support ACME, EST, CMP, and SCEP enrollment protocols natively?), hardware security module integration breadth (does the platform work with Thales Luna, Entrust nShield, and AWS CloudHSM without custom integration?), and managed-service delivery scale (can the vendor operate a customer's complete CA hierarchy as a fully outsourced service?). DigiCert — the global PKI platform revenue leader (estimated 8–11% share, private, record FY2024 bookings per official press release) — leads through DigiCert ONE's full-stack coverage of TLS, IoT, document signing, software trust, and email security under a single trust platform, deepened by October 2024's launch of PQC-ready hybrid certificates supporting ML-DSA alongside RSA and ECDSA. Entrust Corporation (USD 916.7 million revenue, 2024) leads in identity-integrated PKI, though it sold its public certificate authority business to Sectigo in January 2025 to focus on enterprise identity and physical credential issuance. CyberArk (USD 1.001 billion total FY2024 revenue, NASDAQ: CYBR), which completed the USD 1.54 billion acquisition of Venafi on October 1, 2024, created the PKI market's most significant machine-identity management platform, with Venafi's TLS Protect and Machine Identity Management adding machine-identity governance to CyberArk's privileged access security portfolio — subsequently acquired by Palo Alto Networks in 2026. Thales Group (EUR 20.57 billion FY2024) leads in HSM hardware through Luna Network HSMs and CipherTrust Manager, providing the key-protection layer beneath every major PKI platform. Microsoft (USD 245.1 billion FY2024) and AWS (USD 107.6 billion AWS segment revenue FY2024, per Amazon annual report) provide cloud-native PKI infrastructure through Azure Key Vault/AD CS and AWS Private CA respectively, embedding PKI into the hyperscaler platforms where enterprises already operate. MRFR identifies post-quantum certificate automation and managed PKI-as-a-service delivery as the two structural moats that will define PKI category leadership through 2035.

Top 10 Global PKI Companies — MRFR Rankings (2026)

All revenue figures are validated from official company annual reports, SEC filings, or investor relations disclosures. PKI-specific revenue is not separately disclosed by any vendor; total company revenue is provided as validated scale context. MRFR estimated PKI Market revenue share ranges are from the competitive benchmarking table (MRFR report page).

* Private company revenues marked 'Undisclosed' where no official standalone financial data is publicly available. Entrust USD 916.7M revenue from Wikipedia-sourced financial disclosures (private company). CyberArk USD 1.001B FY2024 total revenue from SEC filing / Q4 2024 Earnings Release (NASDAQ: CYBR). Thales Group EUR 20.57B from official 2024 Annual Results (Euronext: HO, March 4, 2025). AWS USD 107.6B is the AWS segment revenue within Amazon's FY2024 Annual Report. CyberArk subsequently acquired by Palo Alto Networks (2026); Venafi now operates within that combined entity.

Detailed Company Profiles

1. DigiCert Inc. | Private (Thoma Bravo portfolio) | Lehi, UT, USA

DigiCert is the global PKI platform revenue leader — the only vendor whose product portfolio spans the full breadth of enterprise trust use cases within a single platform architecture: TLS/SSL certificates for public-facing services, IoT device identity for connected hardware, code signing for software supply chains, document signing for legally binding workflows, and email encryption (S/MIME) for regulated communications, all managed under the DigiCert ONE umbrella and accessible through a single CLM interface, Trust Lifecycle Manager. This platform breadth is DigiCert's most durable competitive moat: enterprise procurement teams increasingly mandate single-vendor CLM platforms that can manage all certificate types across all CAs, and DigiCert's multi-trust-domain coverage eliminates the integration overhead that point-solution competitors impose. DigiCert reported record bookings in Q4 of its fiscal year in March 2024 (official press release: 'DigiCert Achieves Record Growth in FY2024'), and subsequently closed FY26 (its internal fiscal year designator) with its largest quarterly ARR in company history (March 2026 press release). As a private company backed by Thoma Bravo, DigiCert does not publish standalone revenue; RocketReach industry estimates suggest approximately USD 331.8 million, while Growjo estimates approximately USD 440.8 million — neither figure is officially confirmed. The October 2024 launch of PQC-ready hybrid certificates supporting ML-DSA alongside RSA and ECDSA — enabling enterprises to begin dual-algorithm pilot deployments without replacing existing certificate infrastructure — gave DigiCert a first-mover advantage in the post-quantum migration market that will sustain procurement conversations through 2027 as enterprise cryptographic inventories complete and hybrid deployment phases begin. MRFR assesses DigiCert's primary competitive risk as valuation pressure: Thoma Bravo's investment horizon will eventually require an exit, and any IPO or strategic sale will introduce organizational disruption during the most consequential PKI market expansion in the category's history.

2. Entrust Corporation | Private | Shakopee, MN, USA

Entrust’s January 2025 sale of its publicly trusted certificate authority business to Sectigo is the biggest PKI market business-model pivot since Entrust Datacard rebranded as Entrust in 2020 — a conscious retreat from the commoditizing public CA market and a complete focus of resources on enterprise identity, HSMs, and physical credential issuance where Entrust’s margins and moats are structurally better. Entrust announced revenue of USD 916.7 million for 2024, from a diversified business that includes enterprise CLM (Certificate Hub), hardware security modules (nShield series), digital identity verification (Onfido, acquired 2024), and physical credentialing (identity cards, passports, banknotes) – the last being a unique attribute among PKI competitors and providing Entrust government credentialing relationships that are decades deep. The nShield HSM line, which is FIPS 140-3 validated and Common Criteria EAL4+ certified, directly competes with Thales Luna HSMs for the hardware root-of-trust segment, giving Entrust an integrated HSM-to-CLM sales motion that Thales (primarily HSM) and DigiCert (primarily software CLM) can’t match without partnering. The acquisition of Onfido adds AI-powered biometric identity verification, enabling Entrust to provide a physical-to-digital identity assurance chain from document verification through certificate issuance that no other PKI vendor can. MRFR says Entrust’s positioning post-public-CA-sale is strategically cleaner but narrower commercially: by exiting public TLS certificate issuance, Entrust has cut off the DevOps and cloud-native enterprise buyer segments that have been the engine of CA industry volume growth from 2020–2024, focusing on the regulated-enterprise and government segments where its identity-plus-HSM positioning is strongest.

3. Keyfactor | Private (KKR-backed) | Cleveland, OH, USA

Keyfactor has built the most technically credible PKI platform on the market for enterprises that desire open-source architectural transparency combined with enterprise-grade automation, a positioning that has earned significant market share from financial institutions, defense contractors, and healthcare organizations whose security teams refuse to accept black-box CA implementations without source code to audit in plain sight. EJBCA—the open-source enterprise certificate authority at the heart of Keyfactor—has been running in production in critical infrastructure environments for more than two decades, and has a record of cryptographic correctness and protocol compliance that newer platforms can’t match. With the January 2025 release of EJBCA 9.0, Keyfactor became the first enterprise CA platform with production-ready PQC issuing capability deployable in cloud-native environments without legacy infrastructure dependencies, with native post-quantum certificate template support for ML-KEM and ML-DSA algorithms, Kubernetes-native deployment for cloud-native DevSecOps environments, and ACME/EST/CMP multi-enrollment-protocol support. Keyfactor is a private company backed by KKR (Series B USD 125 million, 2022) and does not report revenue. MRFR identifies the main growth path of Keyfactor through 2030 in the DevSecOps pipeline signing market: EJBCA’s Kubernetes-native architecture and Signum code-signing platform are native to the GitOps and CI/CD pipeline signing workflows mandated by CISA’s Secure Software Development Framework — a compliance-driven market that needs a CA that is as cloud-native as the pipelines it signs.

4. GlobalSign (GMO Internet Group) | Private (GMO subsidiary) | Portsmouth, NH, USA / Tokyo, Japan

GlobalSign has built the highest-throughput certificate issuance architecture in the commercial PKI market — Atlas, its automated certificate issuance platform, processes millions of certificates per day through a high-availability, globally distributed CA infrastructure optimized for the API-driven, machine-speed issuance patterns that IoT device identity and DevOps pipeline signing require. This throughput architecture is GlobalSign's most differentiated competitive advantage: enterprises deploying millions of IoT devices or running hundreds of daily CI/CD pipeline builds require a CA whose API response times and uptime SLAs are engineered for machine-speed consumption, not human-administered enrollment workflows. GlobalSign operates as a subsidiary of GMO Internet Group — Japan's largest domain registrar and internet services company — with GMO Group consolidated revenue of approximately JPY 228 Billion in FY2024. This parentage provides GlobalSign with APAC distribution advantages and Japanese enterprise market access that Western-headquartered PKI vendors cannot match without equivalent regional relationships. MRFR identifies GlobalSign's Atlas platform as the most technically suitable architecture for the IoT identity management segment (24.9% CAGR) and DevSecOps code-signing segment (18.5% CAGR) — the two fastest-growing PKI application categories — positioning GlobalSign for above-market growth in the highest-trajectory sub-markets even if its overall PKI revenue share remains below DigiCert and Entrust in absolute terms.

5. Sectigo Limited | Private (Francisco Partners) | Scottsdale, AZ, USA

Sectigo's January 2025 acquisition of Entrust's publicly trusted certificate authority business — including Entrust's browser-trusted root infrastructure — is the most consequential CA consolidation since DigiCert acquired Symantec's website security and related PKI solutions in 2017. The acquisition instantly gave Sectigo one of the five most browser-trusted CA root programs globally, transforming Sectigo from a cost-competitive challenger into one of the structural pillars of the public internet's trust architecture. Combined with Sectigo's existing SCM Enterprise CLM platform and Certificate Manager automation tools, the Entrust public CA assets provide Sectigo with the enterprise sales channel relationships and government procurement credentials that its own organic business had not accumulated at equivalent scale. Sectigo operates as a portfolio company of Francisco Partners, a technology-focused private equity firm. As a private company, Sectigo does not publish standalone revenue. MRFR assesses Sectigo's post-acquisition strategic position as significantly strengthened for the mid-market and public-sector PKI segments: the Entrust CA roots' browser trust status removes the technical barrier that had limited Sectigo's enterprise TLS market penetration, while Sectigo's existing cost-competitive CLM platform gives Entrust public CA customers a migration path without the premium pricing that DigiCert or GlobalSign would require for equivalent certificate volumes.

6. Venafi (CyberArk / Palo Alto Networks) | NASDAQ: PANW (ultimate parent) | Salt Lake City, UT, USA

Venafi pioneered the machine identity management category — a discipline that treats TLS certificates, SSH keys, code-signing certificates, and cloud access credentials as a unified machine-identity asset class requiring governance, lifecycle automation, and policy enforcement equivalent to what PAM tools apply to human privileged accounts. CyberArk completed the USD 1.54 billion acquisition of Venafi on October 1, 2024 — the single largest PKI-adjacent acquisition of the forecast period — integrating Venafi's TLS Protect and Machine Identity Management platform with CyberArk's privileged access security portfolio to create a combined identity security platform spanning human and machine credential governance. CyberArk reported record total revenue of USD 1.001 billion for FY2024 (NASDAQ: CYBR SEC filing, Q4 2024 Earnings Release), with Total ARR reaching USD 1.169 billion including Venafi's outperformance. The subsequent acquisition of CyberArk by Palo Alto Networks in 2026 embeds Venafi's machine-identity management capability within the world's largest cybersecurity platform — a distribution channel expansion that could accelerate Venafi's enterprise PKI market penetration by 2–3× relative to its standalone trajectory. MRFR assesses Venafi's machine-identity governance platform as the most strategically important product in the PKI market for the 2025–2030 period: as enterprise certificate estates grow from hundreds of thousands to tens of millions of identities (IoT devices, microservices, containers, cloud workloads), the Venafi governance layer becomes the only operationally viable management architecture at that scale.

7. Microsoft Corporation | NASDAQ: MSFT | Redmond, WA, USA

Microsoft’s PKI market strategy is architecturally embedded, not explicitly positioned: its PKI capabilities are part of the larger Microsoft 365, Azure and Windows ecosystem that 85%+ of Fortune 500 companies already operate, making PKI services a natural extension of procurement for existing Microsoft enterprise accounts and not a standalone security platform decision. Active Directory Certificate Services (AD CS) remains the world’s most widely deployed enterprise private CA—not because it is the most capable PKI platform, but because it shipped with Windows Server, allowing enterprises to deploy internal CAs without additional licensing or procurement. Microsoft’s total revenue in FY2024 was USD 245.1 billion (SEC 10-K FY2024). Microsoft Cloud PKI (January 2025) is a fully managed PKI-as-a-service built into Microsoft Intune. This is a major strategic escalation that allows Microsoft 365 enterprise accounts to deploy certificates with zero infrastructure, issuing device and user certificates from a managed cloud CA without any on-premises AD CS infrastructure. Microsoft Entra Verified ID, its decentralized identity (DID/W3C Verifiable Credentials) offering, extends PKI trust anchors into the emerging verifiable-credential ecosystem that eIDAS 2.0 Digital Identity Wallets will depend on. MRFR’s key competitive advantage for Microsoft in the PKI space is procurement inertia. For the 1.4 billion Microsoft 365 commercial seats worldwide, Cloud PKI’s zero-additional-infrastructure model converts an existing enterprise agreement into a PKI deployment without a separate vendor evaluation – a procurement efficiency that no specialized PKI vendor can match.

8. Amazon Web Services (Amazon) | NASDAQ: AMZN | Seattle, WA, USA

AWS participates in the PKI market through a consumption-economics strategy that systematically lowers the capital barrier to PKI adoption — AWS Private CA's pay-per-certificate pricing eliminates the USD 20,000–80,000 HSM hardware procurement that on-premises private CA deployments require, reducing the total 5-year PKI cost for a mid-size enterprise by 50–60% compared to on-premises alternatives. AWS reported total FY2024 revenue of USD 590.7 Billion (Amazon Annual Report FY2024), with the AWS segment generating USD 107.6 Billion — a segment revenue that dwarfs any specialized PKI vendor's total business, giving AWS the R&D investment capacity to continuously lower AWS Private CA service costs without margin pressure. The September 2024 expansion of AWS Private CA to support sub-24-hour short-lived certificate issuance — enabling sub-daily certificate lifetimes for containerized microservices workloads — addresses the zero-standing-privilege mTLS architectures that AWS-native application teams require to eliminate long-lived credential risk in multi-tenant cloud environments. AWS Certificate Manager (ACM), which provisions TLS certificates for load balancers and CloudFront distributions at no additional cost, has normalized free TLS provisioning for cloud-native applications — a pricing precedent that is structurally compressing public TLS certificate revenue across the entire industry and accelerating the market's shift toward managed private CA and machine-identity management as the primary revenue drivers. MRFR identifies AWS Private CA's primary limitation as ecosystem scope: it is architected for AWS-native workloads and operates best within the AWS control plane, limiting its attractiveness for enterprises managing multi-cloud certificate estates across Azure, GCP, and on-premises environments simultaneously.

9. Thales Group | Euronext: HO | Paris, France

Thales Group occupies the foundational infrastructure layer of the PKI market — its Luna Network HSMs and CipherTrust Manager platform serve as the hardware root-of-trust beneath the majority of major PKI platform deployments globally, making Thales a critical dependency for DigiCert, Entrust, Keyfactor, and most enterprise private CA deployments simultaneously. This infrastructure-layer position gives Thales a PKI market participation that is paradoxically both pervasive and commercially underrepresented: HSM revenue is counted in Thales's cybersecurity segment rather than in PKI-specific analyst revenue estimates, despite being the physical security foundation without which PKI cryptographic integrity guarantees cannot be made. Thales reported total FY2024 revenue of EUR 20.57 Billion (Thales Group 2024 Annual Results, Euronext: HO, published March 4, 2025), with its Cybersecurity products and services as a defined revenue segment within the Digital Identity & Security global business unit. Luna Network HSM 7 — FIPS 140-3 Level 3 validated and Common Criteria EAL4+ certified — provides the physical key storage that regulated industries (banking, defense, healthcare, nuclear) require for root CA key material. Luna Cloud HSM extends the same validated key protection to cloud-hosted PKI deployments through HSM-as-a-service, addressing the FIPS 140-3 validation requirement that AWS CloudHSM and Azure Dedicated HSM also serve. MRFR identifies Thales's most consequential PKI market opportunity as post-quantum HSM hardware: the NIST post-quantum algorithms (ML-KEM, ML-DSA) require different mathematical operations than RSA and ECC, and HSMs must be updated or replaced to perform PQC operations at the throughput levels that enterprise CA issuance rates require — a hardware replacement cycle that will generate significant Thales Luna HSM revenue through 2030.

10. AppViewX | Private (Brighton Park Capital) | New York, NY, USA

AppViewX has positioned itself as the PKI market's multi-CA orchestration specialist — a platform that sits above individual certificate authorities (DigiCert, Entrust, Microsoft AD CS, AWS Private CA, Keyfactor) and provides a unified CLM interface for enterprises whose certificate estates span multiple CAs, multiple cloud environments, and multiple certificate types that no single CA vendor's native tooling can manage coherently. This orchestration positioning addresses the most painful operational challenge in enterprise PKI: the reality that most large organizations have accumulated five to ten different CA sources through organic growth, mergers, and cloud migration, creating fragmented certificate inventories where certificates expiring in legacy environments are invisible to modern CLM dashboards. AppViewX CERT+ provides agentless certificate discovery — scanning network infrastructure without requiring agent deployment on managed systems — and integrates with ServiceNow, Jira, and BMC Remedy to route certificate renewal workflows through existing ITSM ticket systems rather than requiring PKI administrators to learn new workflow tools. As a private company backed by Brighton Park Capital, AppViewX does not publish revenue. MRFR identifies AppViewX's primary growth opportunity as the enterprise migration market: as organizations undertaking post-quantum certificate migration discover that their full certificate inventory is unknown and unmanaged in existing CA-native CLM tools, multi-CA orchestration with comprehensive discovery becomes a prerequisite for PQC migration planning — a market trigger that will drive AppViewX's most significant demand expansion in the 2026–2029 period.

M&A Activity Tracker

Key verified transactions shaping the PKI Market consolidation landscape (2024–2026):

Key Trend: PKI Market M&A in 2024–2026 is defined by machine-identity consolidation (CyberArk/Venafi, Palo Alto/CyberArk), public CA consolidation through asset sale (Entrust public CA → Sectigo), and hyperscaler embedded-PKI product launches (Microsoft Cloud PKI) — all reflecting the market's convergence toward three structural outcomes: machine-identity platforms that govern all certificate types, CA consolidation around fewer but larger trust anchors, and hyperscaler-embedded PKI that eliminates standalone PKI vendor decisions for cloud-committed enterprise accounts.

R&D Investment & Innovation Signals

Leading vendors are investing across six innovation dimensions: post-quantum hybrid certificate infrastructure, AI-driven certificate lifecycle automation, short-lived certificate architecture, decentralized identity integration, automotive V2X PKI, and sovereign PKI for data-residency compliance:

• Post-quantum hybrid certificate R&D is the most consequential active investment across the entire PKI market: DigiCert (October 2024 hybrid ML-DSA/RSA certificates), Keyfactor (EJBCA 9.0 PQC templates, January 2025), Entrust (PQC migration services), and Thales (Luna HSM firmware updates for ML-KEM/ML-DSA operations) are all racing to establish PQC-ready platform credentials before enterprise cryptographic inventory assessments complete and migration RFPs begin in 2026–2027. The NSA's 2035 deadline for national-security system migration and the White House NSM-10 requirement for federal agency cryptographic inventory by 2027 are creating a government procurement trigger that will pull commercial enterprise migration planning forward — vendors with certified hybrid certificate platforms in 2025–2026 will capture first-mover procurement advantages that laggards cannot recover within the migration window.

• AI-driven certificate lifecycle automation is shifting from a differentiating feature to a procurement baseline as certificate expiration outage rates remain stubbornly high: Venafi's 2024 Machine Identity Report showed 83% of enterprises experienced certificate-related outages despite existing CLM tooling. ML models that predict expiration risk from certificate metadata, detect misconfigured SANs or weak key lengths, and autonomously trigger ACME-protocol renewals without human review are becoming the standard expectation in enterprise CLM RFPs. By 2030, MRFR projects autonomous certificate orchestration platforms will manage the majority of enterprise machine identities without human intervention — a milestone that will compress the professional-services revenue associated with PKI operations while expanding the software-subscription ARR that automated platforms command.

• Short-lived certificate architecture — enabled by AWS Private CA's sub-24-hour validity support (September 2024) and the CA/Browser Forum's roadmap toward 90-day validity for all TLS certificates by 2028 — is fundamentally reshaping the economics of the PKI market: as certificate lifetimes compress, the volume of certificate renewal events multiplies, making ACME automation protocol support a non-negotiable requirement and driving both CLM platform revenue (more managed renewals) and PKI-as-a-service revenue (infrastructure to support higher issuance rates). Short-lived certificates for containerized microservices — where each pod receives a unique certificate valid for hours or minutes — are a qualitatively different scale challenge than traditional server certificates, requiring PKI platforms to handle issuance rates 100–1,000× higher than legacy enterprise volumes without per-certificate cost models that would be economically prohibitive.

• W3C Decentralized Identifier (DID) and Verifiable Credential (VC) integration with traditional PKI trust anchors is the most strategically consequential long-horizon R&D investment: the EU Digital Identity Wallet (eIDAS 2.0, targeting 80% citizen adoption by 2030) will rely on PKI trust anchors for credential verification while enabling citizens to hold and present credentials without centralized CA issuance. Microsoft Entra Verified ID, DigiCert's document trust platform, and Entrust's identity-as-a-service portfolio are all investing in the PKI-to-DID bridge architecture that will allow traditional enterprise CAs to issue verifiable credentials compatible with emerging self-sovereign identity wallets — a market that blends centralized CA economics with decentralized identity distribution and could represent 10–15% of total PKI market revenue by 2033.

• The UNECE WP. Automotive V2X PKI is the highest volume emerging application segment.The 29 cybersecurity standard and the U.S. Department of Transportation’s V2X implementation plan require PKI-backed digital certificates for vehicle-to-everything communications and project 500 million V2X-capable vehicles on the global roadways by 2035. Hundreds of rotating pseudonym certificates are needed for each vehicle (some implementations use thousands of short-lived pseudonym certificates per vehicle per year), which leads to certificate issuance volumes far greater than all current enterprise PKI deployments combined. The two players most technically well-positioned for V2X PKI at scale are GlobalSign’s Atlas platform, designed for machine-speed high-volume issuance, and Entrust’s automotive credential management heritage (through its physical credential business).

• Sovereign PKI R&D — building locally operated certificate authority infrastructure that meets data-residency requirements for digital signatures and identity verification in India (DPDP Act), Indonesia (Government Regulation 71/2019), Vietnam, and Saudi Arabia (NCSA cybersecurity framework) — is creating a new market segment where global PKI vendors must establish in-country infrastructure or partner with local operators to serve regulated-sector customers. CertCentral Europe (DigiCert, launched to support EU data residency) and AWS Private CA's regional deployment options represent early investments in this multi-jurisdiction compliance architecture — investments that MRFR projects will become a standard feature requirement for enterprise PKI platform procurement by 2027 as APAC and MEA data-sovereignty regulations expand and enforcement intensifies.

References

Validated source URLs grouped by category: