EJBCA vs Let's Encrypt
EJBCA
ejbca.orgLet's Encrypt
letsencrypt.orgSide by side
| Figure | EJBCA | Let's Encrypt |
|---|---|---|
| Price from | £5,172.08/mo | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | Yes | Yes |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 5 | 3 |
| Spec score · Public Key Infrastructure Software | 9.2 (#1) | 8.6 (#3) |
| Spec score · Certificate Management Software | 9.2 (#2) | 8.6 (#5) |
| Automation | Official materials provide Helm charts and Ansible playbooks for automated deployment and configuration. | The ACME protocol verifies control of a domain and is used to issue certificates; clients can automate certificate management and renewal. |
| Documentation | The official documentation includes concepts, installation, operations, integration guides, tutorials, troubleshooting, release notes and supported-version information. | The official documentation covers onboarding, ACME clients, rate limits, staging, certificate policy, challenge types, profiles, revocation, compatibility and integration guidance. |
| Integrations | The comparison lists HSM and crypto-token support, including PKCS#11-based and REST API-based key vault integration, AWS CloudHSM, and AWS KMS. | Hosting providers can obtain and manage certificates for customers through their own ACME clients. |
| Intended users | EJBCA is presented for securing industrial environments, IoT devices, national eIDs, DevOps workflows, and internal PKIs. | The service is available to people and organizations worldwide that need certificates for domain-named servers, including web, mail, and FTP servers. |
| License | EJBCA Community is released under LGPL version 2.1 or later. | Boulder is open source under the Mozilla Public License 2.0. |
| Rating on G2 | 4.5 out of 5 from 38 reviews | 4.8 out of 5 from 22 reviews. |
| Support | Enterprise includes professional support with an SLA, while Community users can access GitHub Discussions on a best-effort basis. | Let’s Encrypt does not offer direct subscriber support and points users to its documentation and community support forums. |
| What it does | EJBCA is a platform-independent public-key-infrastructure certificate authority supporting certificate management, registration, enrollment and validation. | Let's Encrypt is a free, automated, open certificate authority that provides TLS certificates for websites. |
Plans
EJBCA
- EJBCA Community EditionFree
- EJBCA Enterprise Cloud trialFree
- EJBCA Enterprise trialFree
- EJBCA PKI SaaS£62,065 a year
- EJBCA EnterprisePriced on request
Let's Encrypt
- Let's Encrypt certificatesFree
- Let's Encrypt certificatesFree
- Short-lived certificatesFree
In their own words
EJBCA
EJBCA is open-source PKI and Certificate Authority software for managing certificates, registration, enrollment, and validation. A single installation can host multiple independent PKIs separated through CA, RA, and VA modules. Certificate validation uses OCSP and CRL, and enrollment options listed for Community and Enterprise include CMP, SCEP, EST, ACME, SOAP API, and REST APIs. Community Edition can be deployed with Helm, as a container, or from source, with Helm and Ansible playbooks available for automating setup and configuration. Its stated use cases include internal PKIs, DevOps workflows, industrial environments, IoT devices, and national eIDs. Community is free under LGPL version 2.1 or later for learning, testing, and prototyping, but is not intended for production because it lacks production audit, compliance, SLA, high-availability, and security capabilities. Enterprise adds advanced PKI functionality and professional support with an SLA; a 30-day trial is available through AWS or Azure marketplaces.
Let's Encrypt
Let’s Encrypt is a global Certificate Authority that provides SSL/TLS certificates for HTTPS connections. The ACME protocol verifies control of a domain, and compatible clients can automate issuance, management, and renewal. Its client directory includes Apache HTTP Server, Caddy, nginx, Kubernetes, Docker, and Windows/IIS environments. Certificates are Domain Validation only; Let’s Encrypt says it does not plan to issue Organization Validation or Extended Validation certificates. Wildcard certificates are available through the DNS-01 challenge. Standard certificates last 90 days, with an optional six-day lifetime; these periods cannot be adjusted. Subscribers generate and manage private keys on their own servers. Issued and revoked certificates are publicly recorded, and the service says its certificates are trusted by most browsers and operating systems. Certificates cost nothing. A registered domain can receive up to 50 certificates every seven days under published rate limits. Direct subscriber support is not offered.