Skip to content
SPECIFICTION
Get listed

EJBCA

ejbca.org

From £5,172.08/mo Free plan Open source WebWindowsmacOSLinuxAPISelf-hosted
Visit ejbca.org
Spec score 9.2 #1 of 26 in Public Key Infrastructure Software

What it is

EJBCA is open-source PKI and Certificate Authority software for managing certificates, registration, enrollment, and validation. A single installation can host multiple independent PKIs separated through CA, RA, and VA modules. Certificate validation uses OCSP and CRL, and enrollment options listed for Community and Enterprise include CMP, SCEP, EST, ACME, SOAP API, and REST APIs. Community Edition can be deployed with Helm, as a container, or from source, with Helm and Ansible playbooks available for automating setup and configuration. Its stated use cases include internal PKIs, DevOps workflows, industrial environments, IoT devices, and national eIDs. Community is free under LGPL version 2.1 or later for learning, testing, and prototyping, but is not intended for production because it lacks production audit, compliance, SLA, high-availability, and security capabilities. Enterprise adds advanced PKI functionality and professional support with an SLA; a 30-day trial is available through AWS or Azure marketplaces.

Spec sheet

What it does
EJBCA is a platform-independent public-key-infrastructure certificate authority supporting certificate management, registration, enrollment and validation.Read 14 Oct 2026 · ejbca.org
Purpose
EJBCA is open-source PKI and Certificate Authority software for certificate management, registration, enrollment, and validation.Read 8 Oct 2026 · ejbca.org
Intended users
EJBCA is presented for securing industrial environments, IoT devices, national eIDs, DevOps workflows, and internal PKIs.Read 8 Oct 2026 · ejbca.org
Deployment
Community Edition can be deployed with Helm, as a container, or from source; the download page links Docker Hub, Artifact Hub, and GitHub.Read 8 Oct 2026 · ejbca.org
Integrations
The comparison lists HSM and crypto-token support, including PKCS#11-based and REST API-based key vault integration, AWS CloudHSM, and AWS KMS.Read 8 Oct 2026 · ejbca.org
Support
Enterprise includes professional support with an SLA, while Community users can access GitHub Discussions on a best-effort basis.Read 8 Oct 2026 · ejbca.org
License
EJBCA Community is released under LGPL version 2.1 or later.Read 8 Oct 2026 · ejbca.org
Founded
2001Read 23 Sep 2026 · ejbca.org
Algorithms
Supported cryptography includes RSA, ECDSA, Ed25519, Ed448 and post-quantum ML-DSA, ML-KEM, SLH-DSA and composite algorithms.Read 14 Oct 2026 · docs.keyfactor.com
API security
The certificate-management REST service is disabled by default and uses client-certificate authentication when enabled.Read 14 Oct 2026 · docs.keyfactor.com
Application servers
EJBCA targets JEE 10 compliant servers, while the actively documented and supported platforms are WildFly and JBoss EAP.Read 14 Oct 2026 · docs.keyfactor.com
Automation
Official materials provide Helm charts and Ansible playbooks for automated deployment and configuration.Read 14 Oct 2026 · ejbca.org
Certificate validation
EJBCA supports certificate validation through OCSP and CRL functionality.Read 8 Oct 2026 · ejbca.org
Company facts
LinkedIn lists Keyfactor as privately held, founded in 2001, headquartered in Independence, Ohio, with 501–1,000 employees.Read 14 Oct 2026 · linkedin.com
Company legal name
Crunchbase lists Keyfactor's legal name as Certified Security Solutions Inc., also known as CSS.Read 14 Oct 2026 · crunchbase.com
Company relationship
EJBCA is a registered trademark owned by PrimeKey Solutions AB, a wholly owned subsidiary of Keyfactor Inc.Read 8 Oct 2026 · ejbca.org
Deployment choices
Documented deployment types are SaaS, AWS and Azure cloud, software appliance, hardware appliance, container set and software stack.Read 14 Oct 2026 · docs.keyfactor.com
Documentation
The official documentation includes concepts, installation, operations, integration guides, tutorials, troubleshooting, release notes and supported-version information.Read 14 Oct 2026 · docs.keyfactor.com
Enrollment protocols
Documented enrollment protocols include ACME, EST, Microsoft auto-enrollment and SCEP.Read 14 Oct 2026 · docs.keyfactor.com
Kubernetes requirements
The container deployment documentation requires Kubernetes 1.32 or newer and Helm 3 or newer, plus a supported database and HSM for non-ephemeral production instances.Read 14 Oct 2026 · docs.keyfactor.com
Licence
EJBCA Community is open source under LGPL version 2.1 or later; dependencies use licenses including Apache 2.0, BSD, MIT and EPL.Read 14 Oct 2026 · ejbca.org
Limit: administration
G2 reviewers say initial configuration and administration can be difficult for organizations with limited PKI experience.Read 14 Oct 2026 · g2.com
Limit: installation
A SourceForge reviewer reported installation errors while deploying EJBCA 6 with Ant.Read 14 Oct 2026 · sourceforge.net
Limit: operations and reporting
G2 reviewers cite weak log visualization, cumbersome OCSP configuration, limited reporting and insufficient troubleshooting or training material.Read 14 Oct 2026 · g2.com
Limit: user interface
G2 reviewers report a complicated, inconsistent and user-unfriendly interface despite extensive configuration options.Read 14 Oct 2026 · g2.com
Management protocols
EJBCA provides CMP, a certificate-management REST interface and SOAP web services for certificate administration.Read 14 Oct 2026 · docs.keyfactor.com
Notable news: investment
Keyfactor announced a strategic growth investment of more than $1 billion led by Summit Partners on 6 July 2026.Read 14 Oct 2026 · keyfactor.com
Notable news: release
EJBCA Community Edition 9.6 was announced on 16 September 2026.Read 14 Oct 2026 · ejbca.org
Ownership
EJBCA's site states that PrimeKey became part of Keyfactor in June 2021 and that the EJBCA trademark is owned by PrimeKey Solutions AB, a Keyfactor subsidiary.Read 14 Oct 2026 · ejbca.org
PKI architecture
A single installation can run multiple separated PKIs with modular CA, registration-authority and validation-authority components, including OCSP and CRL functions.Read 14 Oct 2026 · ejbca.org
Praise: breadth and flexibility
G2 reviewers repeatedly praise EJBCA's broad feature set, flexibility, scalability, standards support and integration options.Read 14 Oct 2026 · g2.com
Praise: open source
SourceForge reviewers describe EJBCA as one of the best open-source certificate-authority and PKI-management tools.Read 14 Oct 2026 · sourceforge.net
Praise: support and setup
Gartner reviewers mention helpful initial setup assistance, flexibility and an API that supports automation.Read 14 Oct 2026 · gartner.com
Production limitation
Community Edition is not intended for production because it lacks audit, compliance, SLA, high availability, and security capabilities required for production workloads.Read 8 Oct 2026 · ejbca.org
Protocols and APIs
The Community and Enterprise comparison lists enrollment support including CMP, SCEP, EST, ACME, SOAP API, and REST APIs.Read 8 Oct 2026 · ejbca.org
Rating on G2
4.5 out of 5 from 38 reviewsRead 14 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.5 out of 5 from 15 reviewsRead 14 Oct 2026 · gartner.com
Rating on SourceForge
4.9 out of 5 from 21 ratingsRead 14 Oct 2026 · sourceforge.net
REST API
The REST interface covers CA, crypto-token, certificate-management and configuration-dump operations and is documented with an OpenAPI specification.Read 14 Oct 2026 · docs.keyfactor.com
SaaS security
EJBCA SaaS documentation states that it uses AWS Shield and Azure DDoS protection, quarterly Qualys penetration scans, encryption in transit and at rest, and immutable signed audit logs.Read 14 Oct 2026 · docs.keyfactor.com
Security and compliance
The comparison lists Common Criteria certification and audit logging to file, database, or syslog; several advanced security and compliance capabilities are Enterprise features.Read 8 Oct 2026 · ejbca.org
Security certification
EJBCA Enterprise 9.3.3 is listed as Common Criteria certified against the Protection Profile for Certification Authorities version 2.1.Read 14 Oct 2026 · docs.keyfactor.com
Self-hosting complexity
Software-stack deployments leave customers responsible for the operating system, application server, database, HSMs, networking and hardening.Read 14 Oct 2026 · docs.keyfactor.com
Standards
The interoperability documentation lists X.509/PKIX, CVC passports and eIDs, eIDAS, ETSI EN 319 411/412, PSD2, FIPS 201-2 and Matter certificate formats.Read 14 Oct 2026 · docs.keyfactor.com
Status protocols
EJBCA supports OCSP for revocation-status checking and HTTP access to CA certificates and CRLs.Read 14 Oct 2026 · docs.keyfactor.com
System requirements
The documented stack uses OpenJDK 17 or 21, WildFly or JBoss EAP, MariaDB, MySQL, PostgreSQL, Oracle or Microsoft SQL Server, and Apache Ant 1.9.8 or later.Read 14 Oct 2026 · docs.keyfactor.com
Use cases
The project documents use in industrial environments, IoT, national electronic IDs, DevOps workflows and internal PKIs.Read 14 Oct 2026 · ejbca.org

Plans and prices

EJBCA Community Edition Free open-source · learning, testing and prototyping · non-production Read 14 Oct 2026 · ejbca.org
EJBCA Enterprise Cloud trial Free 30 days · AWS or Azure Marketplace · usage-based charges after trial Read 14 Oct 2026 · aws.amazon.com
EJBCA Enterprise trial Free 30-day free trial on AWS or Azure marketplaces Enterprise edition functionality Read 8 Oct 2026 · ejbca.org
EJBCA PKI SaaS £62,065 a year £62,065 a licence a year public cloud · ACME, SCEP, CMP and EST · 24x7x365 support Read 14 Oct 2026 · applytosupply.digitalmarketplace.service.gov.uk
EJBCA Enterprise Priced on request advanced PKI · enterprise support and SLA · appliance, cloud and SaaS deployment options Read 14 Oct 2026 · ejbca.org

Every EJBCA plan and price →

Strong points and limits

Strong points

  • Supports multiple separated PKIs in one installation
  • OCSP and CRL certificate validation
  • Helm and Ansible deployment automation
  • Enrollment includes CMP, SCEP, EST, and ACME

Limits

  • Community Edition is not intended for production
  • Community lacks production audit and compliance capabilities

Who it suits

EJBCA suits organizations managing internal PKIs or securing industrial, IoT, DevOps, or national eID environments. Community is for learning, testing, and prototyping rather than production workloads.

EJBCA in depth

Read the full write-up

EJBCA is an open-source certificate authority and PKI platform for organizations managing trust across devices, teams, or environments. It is best suited to technical teams that can run and configure their own infrastructure. Community is a free way to learn and prototype; production users should look to Enterprise.

Overview

A single installation can host multiple secure, independent PKIs through its certificate authority (CA), registration authority (RA), and validation authority (VA) modules. That makes EJBCA a practical fit when one deployment must keep trust domains separate. OCSP and certificate revocation list (CRL) support handle certificate-status validation, alongside revocation workflows.

The project dates to 2001. Community Edition is licensed under LGPL version 2.1 or later. EJBCA is a registered trademark of PrimeKey Solutions AB, a wholly owned subsidiary of Keyfactor Inc.

Key features

Enrollment and validation

Community and Enterprise support enrollment through CMP, SCEP, EST, ACME, SOAP API, and REST APIs. That protocol range accommodates varied issuance workflows, including automated enrollment, while OCSP and CRLs cover validation after issuance.

Deployment and automation

Community Edition can be deployed with Helm, as a container, or from source. Helm and Ansible playbooks can automate installations and configuration, giving infrastructure teams options to fit EJBCA into their existing deployment practices. HSM and crypto-token integrations include PKCS#11- and REST API-based key vault integration, AWS CloudHSM, and AWS KMS.

Security and operations

The Community and Enterprise comparison includes Common Criteria certification and audit logging to file, database, or syslog, while several advanced security and compliance capabilities are Enterprise features. That distinction matters for organizations with formal production controls: Community lacks audit, compliance, SLA, high-availability, and security capabilities required for production workloads.

Pricing

EJBCA Community Edition — free. The free open-source edition provides basic PKI functionality for learning, testing, and prototyping. Its production limitation makes it a poor fit for organizations relying on it for live workloads, regardless of its zero price.

EJBCA Enterprise trial — free. This is a 30-day trial of Enterprise edition functionality through AWS or Azure marketplaces. It gives teams a time-limited way to assess the Enterprise offering before choosing a paid deployment.

EJBCA Enterprise — custom pricing. Enterprise provides advanced PKI functionality, multiple deployment options, and professional support with an SLA. It is the relevant plan for production users who need those capabilities and an agreed support arrangement; pricing requires contacting Keyfactor.

Community users can turn to GitHub Discussions on a best-effort basis, rather than receiving Enterprise's SLA-backed professional support.

Platforms

EJBCA supports API, Linux, self-hosted, and web platforms. Community's Helm, container, and source deployment choices suit teams prepared to manage their own infrastructure; the listed platforms do not make it a hosted service.

Who it's for

EJBCA is aimed at organizations securing industrial environments, IoT devices, national eIDs, DevOps workflows, and internal PKIs. Its separated-PKI architecture and range of enrollment protocols make it especially relevant when certificate issuance spans different trust domains or provisioning methods. It is less suitable for teams that need production-grade PKI but cannot take on Enterprise pricing and deployment decisions.

Pros and cons

Multiple independent PKIs in one installation: CA, RA, and VA modules let organizations keep trust domains separate without treating each as a distinct installation.

Broad enrollment coverage: CMP, SCEP, EST, ACME, SOAP, and REST support accommodates varied issuance workflows.

Flexible deployment and automation: Helm, containers, source deployment, and Helm or Ansible automation offer infrastructure teams several ways to operate it.

Community is not production-ready: Its stated gaps in audit, compliance, SLA, high availability, and security rule it out for production workloads.

Enterprise pricing requires a sales conversation: Teams cannot compare a published Enterprise price before contacting Keyfactor.

Alternatives

For a free, open-source PKI option, step-ca is a more focused alternative: its listed plan covers a single configured intermediate CA and offline root CA, with authority-wide issuance policies, but no Certificate Transparency integration. Choose it when that narrower CA setup is sufficient.

OpenCA PKI is another free PKI management option for teams looking for a Linux, macOS, self-hosted, or web platform. OpenXPKI offers a free Community Edition with Debian packages, example configuration, online documentation, and mailing-list support. XiPKI is a free open-source option under Apache License 2.0 for teams considering another self-hosted PKI.

For a paid CA alternative with FIPS 140-3 Level 2 HSM-backed CAs, EZCA charges $200 a month per CA for its Basic plan, which includes one certificate created or OCSP response. Choose it when that defined CA-based offering matches the requirement. KeyTalk CKMS offers S/MIME on-premise at €5 a month per user for up to 250 participants and multiple devices, making it a more targeted alternative for S/MIME deployments.

SecureW2 Cloud NAC is a paid option with quote-based pricing. Entrust Certificate Manager is another paid alternative, with pricing discussed through Entrust.

Browse more options in Public Key Infrastructure Software or Certificate Management Software.

Verdict

EJBCA is a strong fit for technical organizations that need separated PKIs, broad enrollment support, and control over deployment. Community makes learning and prototyping accessible at no cost, but its production gaps are decisive; choose Enterprise for production support and capabilities, or look elsewhere if its custom pricing and operating requirements do not fit.

Verdict

EJBCA Community provides a free route to basic PKI functionality and several deployment options. Production users should note its stated limitations and consider Enterprise, whose price is available only by contacting Keyfactor.

Where Specifiction places it

Alternatives to EJBCAAll alternatives →