EJBCA vs OpenCA PKI
EJBCA
ejbca.orgOpenCA PKI
openca.orgSide by side
| Figure | EJBCA | OpenCA PKI |
|---|---|---|
| Price from | £5,172.08/mo | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | Yes | Yes |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 5 | 1 |
| Spec score · Public Key Infrastructure Software | 9.2 (#1) | 8.4 (#5) |
| Founded | 2001 | 1998 |
| Integrations | The comparison lists HSM and crypto-token support, including PKCS#11-based and REST API-based key vault integration, AWS CloudHSM, and AWS KMS. | Official dependencies and integrations include OpenLDAP, OpenSSL, Apache HTTP Server and Apache mod_ssl. |
| License | EJBCA Community is released under LGPL version 2.1 or later. | The OpenCA source license is an Apache-style permissive license with attribution and trademark conditions. |
| Purpose | EJBCA is open-source PKI and Certificate Authority software for certificate management, registration, enrollment, and validation. | OpenCA PKI is an open source, out-of-the-box Certification Authority for setting up and managing a PKI. |
| Support | Enterprise includes professional support with an SLA, while Community users can access GitHub Discussions on a best-effort basis. | The project describes community support through mailing lists, forums, and online chat, and mentions paid support from independent third parties. |
| What it does | EJBCA is a platform-independent public-key-infrastructure certificate authority supporting certificate management, registration, enrollment and validation. | OpenCA PKI is open-source software for setting up and administering certification authorities and public-key infrastructures. |
Plans
EJBCA
- EJBCA Community EditionFree
- EJBCA Enterprise Cloud trialFree
- EJBCA Enterprise trialFree
- EJBCA PKI SaaS£62,065 a year
- EJBCA EnterprisePriced on request
In their own words
EJBCA
EJBCA is open-source PKI and Certificate Authority software for managing certificates, registration, enrollment, and validation. A single installation can host multiple independent PKIs separated through CA, RA, and VA modules. Certificate validation uses OCSP and CRL, and enrollment options listed for Community and Enterprise include CMP, SCEP, EST, ACME, SOAP API, and REST APIs. Community Edition can be deployed with Helm, as a container, or from source, with Helm and Ansible playbooks available for automating setup and configuration. Its stated use cases include internal PKIs, DevOps workflows, industrial environments, IoT devices, and national eIDs. Community is free under LGPL version 2.1 or later for learning, testing, and prototyping, but is not intended for production because it lacks production audit, compliance, SLA, high-availability, and security capabilities. Enterprise adds advanced PKI functionality and professional support with an SLA; a 30-day trial is available through AWS or Azure marketplaces.
OpenCA PKI
OpenCA PKI is free, open-source software for establishing and managing a public key infrastructure, with an out-of-the-box Certification Authority. It is intended for on-premises deployment and is listed for Linux, macOS, self-hosted, and web environments. The project says it implements commonly used protocols with full-strength cryptography; listed capabilities include SCEP support, HSM integration, and certificate profiles. The download page lists OpenCA PKI (SpecialK) version 1.5.1. Installation requires other software, including OpenLDAP, OpenSSL, Apache, and Apache mod_ssl, and OpenCA Tools version 1.3.0 is listed as a prerequisite to install first. The project dates to 1998 and describes its work as volunteer-driven and managed through collaboration and consensus. Community support is available through mailing lists, forums, and online chat; independent third parties offer paid support. Security concerns can be reported privately by email or publicly through the project issue trackers. The documentation page says downloadable documentation is unavailable and notes that the OpenCA Guide for version 0.9.2 is outdated in some parts.