AWS Certificate Manager vs EJBCA
AWS Certificate Manager
aws.amazon.com
EJBCA
ejbca.orgSide by side
| Figure | AWS Certificate Manager | EJBCA |
|---|---|---|
| Price from | Free | £5,172.08/mo |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 3 | 5 |
| Spec score · Certificate Management Software | 7.7 (#16) | 9.2 (#2) |
| Integrations | ACM integrates with Elastic Load Balancing, Amazon CloudFront, Amazon API Gateway, AWS Elastic Beanstalk, and AWS CloudFormation for public certificates. | The comparison lists HSM and crypto-token support, including PKCS#11-based and REST API-based key vault integration, AWS CloudHSM, and AWS KMS. |
| Purpose | AWS Certificate Manager provisions, manages, and deploys public and private SSL/TLS certificates for AWS, hybrid, and multicloud workloads. | EJBCA is open-source PKI and Certificate Authority software for certificate management, registration, enrollment, and validation. |
Plans
AWS Certificate Manager
- Public certificate for integrated AWS servicesFree
- ACME public certificatesPrice not published
- Exportable public certificatesPrice not published
EJBCA
- EJBCA Community EditionFree
- EJBCA Enterprise Cloud trialFree
- EJBCA Enterprise trialFree
- EJBCA PKI SaaS£62,065 a year
- EJBCA EnterprisePriced on request
In their own words
AWS Certificate Manager
AWS Certificate Manager (ACM) provisions, manages and deploys public and private SSL/TLS certificates for AWS, hybrid and multicloud workloads. Certificates may cover one domain, multiple named domains, wildcard domains or combinations. Management is available through the AWS Management Console, AWS CLI and ACM APIs, with usage auditable in AWS CloudTrail logs. Amazon-issued certificates can renew automatically when DNS validation is used; otherwise ACM sends notices as expiration approaches. Public-certificate integrations include Elastic Load Balancing, Amazon CloudFront, Amazon API Gateway, AWS Elastic Beanstalk and AWS CloudFormation. AWS Key Management Service helps protect stored private keys. Customers can import third-party CA certificates and deploy them with Elastic Load Balancers, CloudFront and API Gateway; importing costs nothing. The default quota is 10 domain names per certificate, with requests up to 100. The integrated-services public-certificate plan is free and non-exportable. ACM is available on web and API platforms.
EJBCA
EJBCA is open-source PKI and Certificate Authority software for managing certificates, registration, enrollment, and validation. A single installation can host multiple independent PKIs separated through CA, RA, and VA modules. Certificate validation uses OCSP and CRL, and enrollment options listed for Community and Enterprise include CMP, SCEP, EST, ACME, SOAP API, and REST APIs. Community Edition can be deployed with Helm, as a container, or from source, with Helm and Ansible playbooks available for automating setup and configuration. Its stated use cases include internal PKIs, DevOps workflows, industrial environments, IoT devices, and national eIDs. Community is free under LGPL version 2.1 or later for learning, testing, and prototyping, but is not intended for production because it lacks production audit, compliance, SLA, high-availability, and security capabilities. Enterprise adds advanced PKI functionality and professional support with an SLA; a 30-day trial is available through AWS or Azure marketplaces.