Side by side
EJBCA vs Let's Encrypt
Both stand on certificate management software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Choose EJBCA Community for free PKI learning, testing, and prototyping, especially when its deployment and enrollment options fit your setup. For production needs requiring advanced PKI capabilities, compliance, high availability, or SLA-backed support, consider Enterprise; its price is available by contacting Keyfactor.
Visit EJBCALet’s Encrypt offers free DV certificates with automation options and a broad directory of client environments. Its fixed certificate lifetimes, DNS-01 requirement for wildcards, and lack of direct subscriber support are important constraints.
Visit Let's EncryptThe facts
| EJBCA | Let's Encrypt | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Yes | Yes |
| Runs on | API, Linux, Mac, Self-hosted, Web, Windows | API, Linux, Mac, Self-hosted, Web, Windows |
| Lowest paid plan | EJBCA PKI SaaS: £62,065 a year | Free or on request |
| Plans published | 5 | 2 |
| Maker | Not published | Not published |
| Website | ejbca.org | letsencrypt.org |
| On certificate management software | #1 of 31 | #2 of 31 |
EJBCA: what it does well
- One installation can host multiple independent PKIs.
- Supports certificate validation through OCSP and CRL.
- Enrollment options include CMP, SCEP, EST, ACME, SOAP, and REST APIs.
- Community supports Helm, container, or source deployment.
- Helm and Ansible playbooks can automate installation and configuration.
What to know first
- Community Edition is not intended for production use.
- Community lacks audit, compliance, SLA, high availability, and required security capabilities.
- Enterprise pricing requires contacting Keyfactor.
- Community support through GitHub Discussions is best-effort.
Let's Encrypt: what it does well
- Free certificates at no cost plan
- Clients can automate certificate management and renewal
- Wildcard certificates are available
- Private keys stay on subscribers’ servers
- Works with listed server and platform integrations
What to know first
- DV certificates only; no OV or EV plans
- Certificate lifetimes cannot be adjusted
- Wildcards require the DNS-01 challenge
- No direct subscriber support
Alternatives to EJBCA Alternatives to Let's Encrypt The whole list