Side by side
acme.sh vs EJBCA
Both stand on certificate management software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
acme.sh combines certificate issuance, installation, and renewal with multiple validation methods and certificate authorities. Automatic renewal has a stated exception: manual DNS validation requires a new TXT record for each renewal.
Visit acme.sh
Choose EJBCA Community for free PKI learning, testing, and prototyping, especially when its deployment and enrollment options fit your setup. For production needs requiring advanced PKI capabilities, compliance, high availability, or SLA-backed support, consider Enterprise; its price is available by contacting Keyfactor.
Visit EJBCAThe facts
| acme.sh | EJBCA | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Yes |
| Runs on | Linux, Mac, Self-hosted, Windows | API, Linux, Mac, Self-hosted, Web, Windows |
| Lowest paid plan | Free or on request | EJBCA PKI SaaS: £62,065 a year |
| Plans published | 1 | 5 |
| Maker | Not published | Not published |
| Website | github.com | ejbca.org |
| On certificate management software | #3 of 31 | #1 of 31 |
acme.sh: what it does well
- Works with Bash, dash, and sh.
- General use does not require Python, root, or sudo.
- Supports multiple certificate types and validation modes.
- Automatic renewal includes a 30-day fallback rule.
- DNS provider APIs cover most providers, according to the project.
What to know first
- Manual DNS mode cannot renew automatically.
- Windows is listed as tested through Cygwin.
- Release tags through version 3.1.5 are unsigned.
EJBCA: what it does well
- One installation can host multiple independent PKIs.
- Supports certificate validation through OCSP and CRL.
- Enrollment options include CMP, SCEP, EST, ACME, SOAP, and REST APIs.
- Community supports Helm, container, or source deployment.
- Helm and Ansible playbooks can automate installation and configuration.
What to know first
- Community Edition is not intended for production use.
- Community lacks audit, compliance, SLA, high availability, and required security capabilities.
- Enterprise pricing requires contacting Keyfactor.
- Community support through GitHub Discussions is best-effort.
Alternatives to acme.sh Alternatives to EJBCA The whole list