EJBCA (Keyfactor)

Overview

EJBCA is an enterprise certificate authority and PKI platform for issuing and managing X.509 certificates for people, servers, devices, and workloads. It was built by PrimeKey in Stockholm and has been part of Keyfactor since the two companies merged in 2021; Keyfactor itself is private-equity owned, which the consolidation report notes is the norm in PKI. EJBCA ships in two editions: an open-source Community Edition under LGPL-2.1, and the commercial EJBCA Enterprise, which also runs as EJBCA Cloud on AWS and Azure, as SaaS, and as software or hardware appliances.

What it is good at

Protocol and deployment breadth. Per Keyfactor's edition comparison, Enterprise supports ACME, EST, SCEP (client and RA mode), CMP including 3GPP vendor mode, Microsoft auto-enrollment, SOAP, and enrollment and management REST APIs, with OCSP and CRL through a separate validation authority. CA, registration authority, and validation authority roles can run on separate instances, which is how regulated PKI hierarchies are supposed to be built. HSM integration covers PKCS#11 devices plus cloud key services such as AWS CloudHSM and AWS KMS, and Enterprise carries Common Criteria certification.

That range covers use cases most CAs do not: public-trust TLS, ePassport (EAC) certificates, IEEE 802.1AR device birth identities, Matter device PKI, and 4G/LTE network certificates. Post-quantum algorithms are supported in both editions, with a PQC test lab on Azure, which matters for teams starting certificate lifecycle planning for quantum-safe migration.

Where it falls short

The free edition is not a production CA. Keyfactor says Community Edition is for learning, testing, and prototyping, receives security fixes on a delayed cycle, and lacks HSM support, CA/RA/VA separation, ACME, EST, SCEP RA mode, and the management REST API. Anyone planning to run EJBCA Community in production for cost reasons is running a CA without hardware key protection or timely patches.

Even Enterprise is real operational work. Designing a CA hierarchy, certificate profiles, and HSM key ceremonies takes PKI expertise, and the admin experience reflects two decades of accumulated options. EJBCA issues certificates; discovering and renewing certificates across an estate is a separate job, typically Keyfactor Command, at extra cost.

Pricing

Community Edition is free. Enterprise, Cloud, SaaS, and appliance editions are quote-based commercial licenses from Keyfactor, with a 30-day free trial of EJBCA Cloud on the AWS and Azure marketplaces. See how PKI vendors compare on disclosure in the pricing transparency index.

Best for, and who should look elsewhere

Choose EJBCA Enterprise when you need to own a governed CA hierarchy: regulated industries, device manufacturers, telecom, or government identity programs. Budget for a PKI architect, not just a license; the software is the easy part of running a CA. Look elsewhere for automated internal TLS with little PKI expertise (Smallstep), free public web certificates (Let's Encrypt), or a fully managed CA. Compare the broader market in Keyfactor vs Venafi, the certificate lifecycle management guide, and the best machine identity for enterprises ranking.

Bottom line

The most flexible enterprise CA you can deploy almost anywhere, provided you buy Enterprise and staff it with people who understand PKI.