Each external subordinate CA issued by a PKIaaS root CA consumes only one Entrust PKIaaS Certificate license. Entrust does not charge for certificates issued by external subordinate CAs because Entrust classifies those certificates as external and they do not use the Entrust PKIaaS infrastructure.