EJBCA vs EZCA
EJBCA
ejbca.orgEZCA
keytos.ioSide by side
| Figure | EJBCA | EZCA |
|---|---|---|
| Price from | £5,172.08/mo | $200/mo |
| Free plan | Yes | — |
| Free trial | Yes | Yes |
| Open source | Yes | — |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| iOS | — | Yes |
| Android | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 5 | 4 |
| Spec score · Public Key Infrastructure Software | 9.2 (#1) | 8.4 (#4) |
| Founded | 2001 | 2021 |
| Support | Enterprise includes professional support with an SLA, while Community users can access GitHub Discussions on a best-effort basis. | Basic includes support within one business day, Premium includes 24/7 support within 24 hours, and Private Infrastructure includes 24/7 support within one hour. |
| What it does | EJBCA is a platform-independent public-key-infrastructure certificate authority supporting certificate management, registration, enrollment and validation. | EZCA is a cloud PKI service for running and scaling certificate authorities without operating the PKI infrastructure yourself. |
Plans
EJBCA
- EJBCA Community EditionFree
- EJBCA Enterprise Cloud trialFree
- EJBCA Enterprise trialFree
- EJBCA PKI SaaS£62,065 a year
- EJBCA EnterprisePriced on request
EZCA
- Basic$200 a month
- Premium$500 a month
- Self-Hosted Licensing$3,000 a month
- Private Infrastructure$6,000 a month
In their own words
EJBCA
EJBCA is open-source PKI and Certificate Authority software for managing certificates, registration, enrollment, and validation. A single installation can host multiple independent PKIs separated through CA, RA, and VA modules. Certificate validation uses OCSP and CRL, and enrollment options listed for Community and Enterprise include CMP, SCEP, EST, ACME, SOAP API, and REST APIs. Community Edition can be deployed with Helm, as a container, or from source, with Helm and Ansible playbooks available for automating setup and configuration. Its stated use cases include internal PKIs, DevOps workflows, industrial environments, IoT devices, and national eIDs. Community is free under LGPL version 2.1 or later for learning, testing, and prototyping, but is not intended for production because it lacks production audit, compliance, SLA, high-availability, and security capabilities. Enterprise adds advanced PKI functionality and professional support with an SLA; a 30-day trial is available through AWS or Azure marketplaces.
EZCA
EZCA is a cloud PKI service for running certificate authorities without operating the underlying PKI infrastructure yourself. It issues certificates through ACME, EST, and SCEP, and provides APIs for applications and workflows. Certificate uses include users, devices, applications, Wi-Fi, VPN, web services, and IoT, including device authentication for Azure IoT Hub and Azure IoT Central. Integrations include Azure, Entra ID, Intune, Azure Key Vault, and Azure applications; Intune and Jamf are supported for device certificates. EZCA can chain to an existing on-premises CA or bring an AD CS CA into a cloud setup. The maker says its CAs are HSM-backed, with Basic using FIPS 140-3 Level 2 and Premium Level 3. CA changes, requests, and approvals are logged for export to a preferred SIEM, and revocation checks use CRLs and OCSP. Basic costs $200 a month per CA, and a 30-day trial is available; there is no free plan. Plans differ in throughput, support, availability, and infrastructure options.