EJBCA
What it is
EJBCA is open-source public key infrastructure and Certificate Authority software for managing certificate registration, enrollment, validation, and related workflows. A single installation can host multiple independent PKIs separated through CA, RA, and VA modules. Certificate validation uses OCSP and CRL, while enrollment support includes CMP, SCEP, EST, ACME, SOAP API, and REST APIs. Community Edition can be deployed with Helm, as a container, or from source, and Helm or Ansible playbooks can automate installation and configuration. Its stated use cases include internal PKIs, DevOps workflows, industrial environments, IoT devices, and national eIDs. Community Edition is released under LGPL version 2.1 or later and costs nothing. It is intended for learning, testing, and prototyping, not production workloads, because it lacks production capabilities including audit, compliance, SLA, high availability, and security features.
For and against
For
- Free Community Edition for learning and prototyping
- Supports multiple separated PKIs in one installation
- Enrollment options include ACME and REST APIs
- Helm and Ansible can automate deployment
Against
- Community Edition is not intended for production
- Community Edition lacks production audit and compliance capabilities
The verdict
EJBCA covers certificate management across several PKIs and offers multiple deployment and automation approaches. Community Edition is limited to non-production use; production workloads require consideration of Enterprise and its support terms.
Who it suits
EJBCA Community Edition suits people learning, testing, or prototyping PKI workflows, as well as teams exploring the listed use cases. Production users should consider Enterprise, which includes advanced PKI capabilities and SLA-backed professional support.
Plans and prices
EJBCA Community Edition
open-source · learning, testing and prototyping · non-production
Read 14 Oct 2026 · ejbca.org
EJBCA Enterprise Cloud trial
30 days · AWS or Azure Marketplace · usage-based charges after trial
Read 14 Oct 2026 · aws.amazon.com
EJBCA PKI SaaS
public cloud · ACME, SCEP, CMP and EST · 24x7x365 support
Read 14 Oct 2026 · applytosupply.digitalmarketplace.service.gov.uk
EJBCA Enterprise trial
Enterprise edition functionality
Read 8 Oct 2026 · ejbca.org
EJBCA Enterprise
advanced PKI · enterprise support and SLA · appliance, cloud and SaaS deployment options
Read 14 Oct 2026 · ejbca.org
On the record
- Algorithms
- Supported cryptography includes RSA, ECDSA, Ed25519, Ed448 and post-quantum ML-DSA, ML-KEM, SLH-DSA and composite algorithms.docs.keyfactor.com · read 14 Oct 2026
- API security
- The certificate-management REST service is disabled by default and uses client-certificate authentication when enabled.docs.keyfactor.com · read 14 Oct 2026
- Application servers
- EJBCA targets JEE 10 compliant servers, while the actively documented and supported platforms are WildFly and JBoss EAP.docs.keyfactor.com · read 14 Oct 2026
- Automation
- Official materials provide Helm charts and Ansible playbooks for automated deployment and configuration.ejbca.org · read 14 Oct 2026
- Certificate validation
- EJBCA supports certificate validation through OCSP and CRL functionality.ejbca.org · read 8 Oct 2026
- Company facts
- LinkedIn lists Keyfactor as privately held, founded in 2001, headquartered in Independence, Ohio, with 501–1,000 employees.linkedin.com · read 14 Oct 2026
- Company legal name
- Crunchbase lists Keyfactor's legal name as Certified Security Solutions Inc., also known as CSS.crunchbase.com · read 14 Oct 2026
- Company relationship
- EJBCA is a registered trademark owned by PrimeKey Solutions AB, a wholly owned subsidiary of Keyfactor Inc.ejbca.org · read 8 Oct 2026
- Deployment
- Community Edition can be deployed with Helm, as a container, or from source; the download page links Docker Hub, Artifact Hub, and GitHub.ejbca.org · read 8 Oct 2026
- Deployment choices
- Documented deployment types are SaaS, AWS and Azure cloud, software appliance, hardware appliance, container set and software stack.docs.keyfactor.com · read 14 Oct 2026
- Documentation
- The official documentation includes concepts, installation, operations, integration guides, tutorials, troubleshooting, release notes and supported-version information.docs.keyfactor.com · read 14 Oct 2026
- Enrollment protocols
- Documented enrollment protocols include ACME, EST, Microsoft auto-enrollment and SCEP.docs.keyfactor.com · read 14 Oct 2026
- Integrations
- The comparison lists HSM and crypto-token support, including PKCS#11-based and REST API-based key vault integration, AWS CloudHSM, and AWS KMS.ejbca.org · read 8 Oct 2026
- Intended users
- EJBCA is presented for securing industrial environments, IoT devices, national eIDs, DevOps workflows, and internal PKIs.ejbca.org · read 8 Oct 2026
- Kubernetes requirements
- The container deployment documentation requires Kubernetes 1.32 or newer and Helm 3 or newer, plus a supported database and HSM for non-ephemeral production instances.docs.keyfactor.com · read 14 Oct 2026
- Licence
- EJBCA Community is open source under LGPL version 2.1 or later; dependencies use licenses including Apache 2.0, BSD, MIT and EPL.ejbca.org · read 14 Oct 2026
- License
- EJBCA Community is released under LGPL version 2.1 or later.ejbca.org · read 8 Oct 2026
- Limit: administration
- G2 reviewers say initial configuration and administration can be difficult for organizations with limited PKI experience.g2.com · read 14 Oct 2026
