Side by side
EJBCA vs step-ca
Both stand on public key infrastructure software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Choose EJBCA Community for free PKI learning, testing, and prototyping, especially when its deployment and enrollment options fit your setup. For production needs requiring advanced PKI capabilities, compliance, high availability, or SLA-backed support, consider Enterprise; its price is available by contacting Keyfactor.
Visit EJBCAstep-ca offers a free, open-source route to automated private certificate issuance, with integrations for multiple identity and key-protection systems. Teams should assess its documented revocation and monitoring gaps before adopting it.
Visit step-caThe facts
| EJBCA | step-ca | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Yes | Yes |
| Runs on | API, Linux, Mac, Self-hosted, Web, Windows | API, Linux, Mac, Self-hosted, Windows |
| Lowest paid plan | EJBCA PKI SaaS: £62,065 a year | Free or on request |
| Plans published | 5 | 3 |
| Maker | Not published | Not published |
| Website | ejbca.org | smallstep.com |
| On public key infrastructure software | #1 of 26 | #4 of 26 |
EJBCA: what it does well
- One installation can host multiple independent PKIs.
- Supports certificate validation through OCSP and CRL.
- Enrollment options include CMP, SCEP, EST, ACME, SOAP, and REST APIs.
- Community supports Helm, container, or source deployment.
- Helm and Ansible playbooks can automate installation and configuration.
What to know first
- Community Edition is not intended for production use.
- Community lacks audit, compliance, SLA, high availability, and required security capabilities.
- Enterprise pricing requires contacting Keyfactor.
- Community support through GitHub Discussions is best-effort.
step-ca: what it does well
- Automates certificate issuance and renewal.
- Supports X.509 and SSH certificates.
- Integrates with cloud key-management services and HSMs.
- Installation options include Linux, Kubernetes, and Docker.
What to know first
- Active revocation is limited.
- No certificate history or metrics.
- No ACME External Account Binding.
Alternatives to EJBCA Alternatives to step-ca The whole list