EJBCA

EJBCA
David CARELLA · CC BY-SA 4.0 · source
Name	EJBCA
Developer	PrimeKey Solutions AB
Released	1999
Programming language	Java
Operating system	Cross-platform
License	Open-source / Commercial

EJBCA EJBCA is an enterprise-grade Certificate Authority and Public Key Infrastructure platform implemented in Java. It provides certificate lifecycle management, enrollment, revocation, and validation services for large-scale deployments used by organizations across sectors. The platform integrates with hardware security modules, directory services, and network appliances to deliver scalable trust services.

Overview

EJBCA operates as a scalable Public Key Infrastructure product offering automated certificate issuance, X.509 certificate management, and Online Certificate Status Protocol responders. It is used alongside Hardware Security Module vendors, integrates with Lightweight Directory Access Protocol servers, and interoperates with Secure Sockets Layer and Transport Layer Security endpoints. Typical deployments connect to enterprise systems such as Microsoft Active Directory, Red Hat Enterprise Linux, Oracle Database, and cloud providers including Amazon Web Services, Microsoft Azure, and Google Cloud Platform.

Architecture and Components

EJBCA’s core is built on the Java Platform, Enterprise Edition stack with containerization options on Docker (software) and orchestration on Kubernetes. Components include the Certificate Authority engine, enrollment web services, database backends (for example PostgreSQL, MySQL, Oracle Database), and management GUIs. Integration points include Hardware Security Module interfaces using PKCS#11, OCSP responders, SCEP gateways compatible with network device vendors like Cisco Systems, and RESTful APIs for DevOps toolchains. For high availability, it supports clustering via load balancers such as HAProxy and NGINX (web server), and backups to storage solutions like NetApp or Amazon S3.

Features and Functionality

Features include certificate templates, profile-based issuance, support for enrollment protocols such as Simple Certificate Enrollment Protocol and Certificate Management over CMS, offline and online CA hierarchies, and automated key archival/recovery. It supports cryptographic algorithms standardized by bodies such as NIST and implements certificate revocation via CRL and OCSP services. Management workflows can be integrated with identity providers like Okta and Keycloak, and audited by SIEM systems from vendors including Splunk and IBM QRadar. The platform supports smart card issuance for Common Access Card-style deployments and integrates with Mozilla Firefox and Google Chrome for client certificate authentication.

Deployment and Configuration

Deployment scenarios range from single-node installations on Ubuntu and CentOS to distributed clusters spanning data centers controlled by VMware ESXi or public clouds like Amazon Web Services. Configuration commonly involves configuring database connections, TLS termination via Let’s Encrypt or enterprise PKI roots, HSM setup with vendors such as Thales Group or Entrust, and directory synchronization with Microsoft Active Directory. Automation uses Ansible (software), Terraform, and CI/CD pipelines with Jenkins. Monitoring uses standards like Prometheus and Grafana for metrics and alerting, while log aggregation uses Elasticsearch, Logstash, and Kibana.

Security and Compliance

Security features follow guidance from National Institute of Standards and Technology publications and implement FIPS-compliant cryptography when paired with appropriate HSMs from vendors such as SafeNet. It supports audit logging to meet standards like ISO/IEC 27001 and regulatory frameworks including General Data Protection Regulation and sector-specific regimes like Payment Card Industry Data Security Standard. Role-based access control integrates with directory services from Microsoft and federated identity systems, while secure key management practices align with recommendations from ENISA and IETF working groups.

History and Development

Originating in the late 1990s, the project evolved through contributions from European academic and commercial actors and commercial stewardship by companies in the Sweden-based cybersecurity sector. Development has tracked major shifts in internet security such as the adoption of TLS 1.3, the deprecation of SHA-1 per CA/Browser Forum guidelines, and the rise of automated certificate issuance influenced by initiatives like Let’s Encrypt. The codebase has incorporated enterprise Java trends emerging from Apache Tomcat and WildFly (application server) ecosystems, and development workflows mirror practices popularized by projects hosted on platforms like GitHub and GitLab.

Use Cases and Adoption

Common use cases include enterprise internal PKI for device authentication in Internet of Things, code signing for software vendors such as Red Hat, secure email (S/MIME) for organizations like European Commission institutions, and mutual TLS for APIs in financial services complying with PSD2. Telecommunications operators deploy it for subscriber certificates in environments involving GSMA specifications, while government agencies use it for eID schemes comparable to eIDAS frameworks. Adoption spans sectors including healthcare organizations like NHS (England), utilities managing critical infrastructure, and academic institutions such as Karolinska Institute and ETH Zurich for research-grade secure communications.

Category:Public key infrastructure