EJBCA

EJBCA is open-source PKI and Certificate Authority software for organizations that need to issue, manage, and validate certificates across separate trust domains. It is best suited to infrastructure, IoT, industrial, identity, and DevOps teams comfortable operating self-hosted security services. Community Edition is a strong learning and prototyping platform, while production deployments call for the Enterprise edition and its accompanying safeguards and support.

Overview

One EJBCA installation can contain multiple secure, independent PKIs built from certificate authority (CA), registration authority (RA), and validation authority (VA) modules. That arrangement is valuable when business units, device fleets, or environments must keep their trust relationships separate without maintaining entirely unrelated installations. OCSP and certificate revocation lists (CRLs) provide status checking, and revocation workflows are part of the platform.

The project has existed since 2001. EJBCA Community is released under LGPL version 2.1 or later. The EJBCA trademark belongs to PrimeKey Solutions AB, a wholly owned subsidiary of Keyfactor Inc.

Key features

Enrollment and validation

Community and Enterprise support enrollment through CMP, SCEP, EST, ACME, SOAP API, and REST APIs. The protocol range makes EJBCA adaptable to device provisioning, infrastructure automation, and application-led issuance instead of forcing every workflow through one interface. OCSP and CRL support means the system also handles post-issuance status validation, not merely certificate creation.

Deployment and automation

Community Edition can run through Helm, as a container, or from source. Helm and Ansible playbooks can automate installation and configuration, which suits teams integrating PKI into repeatable infrastructure processes. Linux, web, API, and self-hosted operation are supported; this is infrastructure software rather than a desktop certificate manager.

Keys, integrations, and audit

The Enterprise and Community comparison includes HSM and crypto-token integrations, PKCS#11 and REST API key-vault integration, AWS CloudHSM, and AWS KMS. The comparison also identifies Common Criteria certification and audit logging to file, database, or syslog, while several advanced security and compliance capabilities are Enterprise features. That distinction matters for regulated or externally audited deployments.

Pricing

Community is the sensible starting point for students, developers, and teams proving a PKI design, but its lack of production-grade audit, compliance, SLA, high availability, and security capabilities rules it out for critical live workloads. The 30-day marketplace trial is a practical way to assess Enterprise features before requesting a commercial quote. Enterprise is the appropriate purchase when availability commitments, professional support, or stronger compliance controls are requirements. Plans indicate automatic renewal, so trial and subscription terms should be checked before committing.

Platforms

EJBCA supports API, Linux, web, and self-hosted operation. Community deployment is available through Helm, containers, or source, with Docker Hub, Artifact Hub, and GitHub distribution paths. This breadth favors platform and security engineers managing their own runtime; readers seeking a turnkey hosted certificate service should look elsewhere.

Who it's for

Choose EJBCA Community for PKI education, lab environments, architecture work, and prototypes involving internal certificates, IoT devices, industrial systems, national eID concepts, or DevOps workflows. Choose Enterprise when those workloads move into production and require SLA-backed support, high availability, audit and compliance capabilities, or the advanced security functions reserved for that edition. It is a poor fit for users who need a simple consumer-facing certificate purchase or a fully managed service with no PKI operations burden.

Pros and cons

Pros

• Multiple independent PKIs in one installation help separate trust domains cleanly.
• CMP, SCEP, EST, ACME, SOAP, and REST enrollment cover a broad mix of device and automation workflows.
• Helm, containers, source deployment, and Ansible automation fit established infrastructure practices.
• OCSP, CRLs, and revocation workflows cover certificate lifecycle operations beyond issuance.
• The free LGPL Community edition provides a substantial environment for learning and prototyping.

Cons

• Community is explicitly unsuitable for production because key audit, compliance, SLA, availability, and security capabilities are absent.
• Community support is limited to best-effort GitHub Discussions, unlike Enterprise's professional SLA-backed support.
• Self-hosting places deployment and operational responsibility on the adopting team.
• Advanced compliance and security features require moving to custom-priced Enterprise.

Alternatives

Public Key Infrastructure Software and Certificate Management Software provide broader category comparisons.

• OpenCA PKI is another free, open-source PKI management option for Linux, macOS, self-hosted, and web environments.
• step-ca suits teams wanting a free, focused open-source authority with a single configured intermediate CA and offline root CA.
• Let's Encrypt is the better choice when free, publicly trusted Domain Validation certificates are the goal rather than operating an internal PKI.
• OpenXPKI offers a fully functional free Community Edition with Debian packages, example configuration, documentation, and mailing-list support.
• SecureW2 Cloud NAC is a paid, quote-based alternative for organizations seeking a broad device and network-access platform.
• XiPKI is a free open-source option for Linux, macOS, self-hosted, and API deployments.
• EZCA targets buyers who prefer a paid service with a free trial and a $200-per-CA monthly Basic plan.
• Boulder is free open source, but production use requires separate implementation and security work.

Verdict

EJBCA Community is a compelling free route for teams learning PKI or building a serious prototype, especially when multiple PKIs and varied enrollment protocols matter. Select Enterprise for production systems that need support, availability, auditability, and advanced security controls. Look elsewhere if you want a managed certificate service or a lightweight authority without the responsibility of self-hosting.