EJBCA

EJBCA is open-source PKI and Certificate Authority software for organizations that need to issue, manage, and validate certificates across distinct environments. It is best suited to teams building internal PKIs, industrial or IoT security, national eID systems, or DevOps certificate workflows. Community Edition is a flexible learning and prototyping platform; production users should look to Enterprise.

Overview

EJBCA combines certificate authority (CA), registration authority (RA), and validation authority (VA) modules in one installation. It can host multiple secure, independent PKIs, which is useful when an organization needs separate trust domains without running a distinct installation for each. OCSP and certificate revocation lists (CRLs) support certificate-status checks, alongside revocation workflows.

The project dates to 2001, and Community Edition is released under LGPL version 2.1 or later. EJBCA is a registered trademark owned by PrimeKey Solutions AB, a wholly owned subsidiary of Keyfactor Inc.

Key features

Enrollment and certificate validation

Community and Enterprise support enrollment through CMP, SCEP, EST, ACME, SOAP API, and REST APIs. That range gives teams options for different certificate-provisioning workflows, while OCSP and CRL support extends EJBCA beyond issuance to certificate validation. Organizations with varied enrollment needs can work with a broad protocol set; those seeking only a narrow, defined certificate use case may not need this breadth.

Deployment and automation

Community Edition can be deployed with Helm, as a container, or from source. Installations and configurations can also be automated with Helm or Ansible playbooks, giving teams several ways to fit PKI into existing deployment processes. These options reward familiarity with those tools; the deployment flexibility does not remove the operational demands of running PKI software.

Integrations and security

EJBCA supports HSMs and crypto tokens, including PKCS#11- and REST API-based key-vault integration, AWS CloudHSM, and AWS KMS. The Community and Enterprise comparison also includes Common Criteria certification and audit logging to file, database, or syslog, while several advanced security and compliance capabilities are Enterprise features. That distinction matters: organizations with production compliance or security requirements should assess Enterprise rather than assume Community covers them.

Pricing

Community is the practical choice for evaluation and prototypes, but it lacks the audit, compliance, SLA, high-availability, and security capabilities required for production workloads. Enterprise is aimed at organizations that need those production capabilities and professional SLA-backed support. Community users can access GitHub Discussions on a best-effort basis. The Enterprise trial offers a time-limited route to evaluate its functionality; the stated trial term is 30 days.

Platforms

EJBCA is available for API, Linux, self-hosted, and web environments. Community deployment options include Helm, containers, and source, with deployment automation through Helm or Ansible playbooks. This makes it a fit for teams prepared to operate PKI within their own environment rather than looking for a simple hosted certificate service.

Who it's for

EJBCA suits organizations that need configurable certificate infrastructure for internal PKIs, industrial environments, IoT devices, national eIDs, or DevOps workflows. Its multiple-PKI architecture, broad enrollment protocols, and deployment automation are most valuable when certificate issuance and trust need to span several systems or separated environments. It is not the right Community Edition choice for production workloads that require high availability, compliance controls, advanced security, or SLA support.

Pros and cons

• Pros: One installation can support multiple independent PKIs, helping preserve distinct trust domains.
• Pros: CMP, SCEP, EST, ACME, SOAP, and REST enrollment support accommodates a range of provisioning workflows.
• Pros: Helm, container, and source deployment options, plus Helm and Ansible automation, offer flexibility for self-hosted environments.
• Cons: Community Edition is explicitly not intended for production and lacks capabilities required for production workloads.
• Cons: Advanced security and compliance capabilities, high availability, and SLA-backed support are Enterprise considerations, with custom pricing.

Alternatives

Choose Let's Encrypt if you need free Domain Validation certificates rather than a broader PKI platform. OpenCA PKI is another free, open-source PKI management option, with Linux, macOS, self-hosted, and web platform support. Consider step-ca for its free open-source plan, which provides a single configured intermediate CA, an offline root CA, and authority-wide issuance policies.

OpenXPKI offers a free Community Edition with a fully functional code base, Debian packages, example configuration, online documentation, and mailing-list support. XiPKI is another free open-source option. Boulder is a free, MPL-2.0-licensed option whose production deployment requires separate implementation and security work. For certificate management specifically for Kubernetes and OpenShift workloads, consider free cert-manager; Dogtag Certificate System is a free open-source CA option that requires access to 389 Directory Server.

Browse more options in Public Key Infrastructure Software and Certificate Management Software.

Verdict

Choose EJBCA Community if you need a free way to learn, test, or prototype PKI and its deployment and enrollment options suit your environment. Its strongest case is the combination of multiple independent PKIs, varied enrollment protocols, and self-hosted automation. Look to Enterprise for production workloads that need advanced security, compliance, high availability, or SLA-backed support; if the goal is only free Domain Validation certificates or Kubernetes certificate management, a narrower alternative may be a better fit.