||This article appears to be written like an advertisement. (October 2008)|
|Developer(s)||PrimeKey Solutions AB|
|Initial release||December 5, 2001|
|Stable release||6.2.0 / June 19, 2014|
|Written in||Java on Java EE|
|Available in||Chinese, English, French, German, Italian, Portuguese, Spanish, Swedish|
Enterprise Java Bean Certificate Authority, or EJBCA, is a free software public key infrastructure (PKI) certificate authority software package maintained and sponsored by the Swedish for-profit company PrimeKey Solutions AB, which holds the copyright to most of the codebase. The project's source code is available under terms of the Lesser GNU General Public License.
The system is implemented in Java EE and designed to be platform independent and fully clusterable, to permit a greater degree of scalability than is typical of similar software packages. Multiple instances of EJBCA are run simultaneously, sharing a database containing the current certificate authorities (CAs). This permits each instance of the software to access any CA. The software also supports the use of a Hardware Security Module (HSM), which provides additional security. Larger-scale installations would use multiple instances of EJBCA running on a cluster, a fully distributed database on a separate cluster and a third cluster with HSMs keeping the different CA keys.
EJBCA follows the major standards in the PKI area, such as X.509, OCSP, CMP, XKMS, SCEP, and Elliptic curves, including the new Card Verifiable Certificate (CVC) EU standard for machine readable passports containing fingerprints, which will be mandatory as of June 26, 2009.
EJBCA supports all common asymmetric encryption algorithms, RSA, DSA and ECC, as well as the modern hash algorithms, SHA1, SHA256, SHA384, SHA512.
Apart from the features would expect from a Certificate Authority. EJBCA includes a few interesting features from a PKI point of view. In normal operation everything is stored and audit logged, including user entries in the built in RA. In the normal mode all properties that you would expect from a Certificate Authority applies, transactional behaviour, audit, revocation and CRL issuance. You can however also configure EJBCA in a "throw away CA" mode, where nothing is stored in the database, but instead certificates are simply issued, to an RA, very fast. This is convenient if you don't need to store revocation information on the CA, and you need to issue huge volumes of certificates fast. In "throw away CA" mode EJBCA can issue hundreds of certificates per second from a single server.
Enterprise and Community
In order to be able to support the development costs of EJBCA, including the costly Common Criteria certification (see below), there is now a Community version and an Enterprise version. The Enterprise version contains additional features for specific use cases and is only available from PrimeKey (also the sponsor of the Common Criteria certification). The differences between Community and Enterprise is outlined in the features list.
Common Criteria Certification
During 2011 a project ran to Common Criteria Certify EJBCA. EJBCA was delivered for evaluation in January 2012, evaluation was completed in March 2012, and the final certificate was delivered in October 2012. EJBCA is certified under the CIMC Protection Profile, under Common Criteria v3.1. The Evaluation Assurance Level selected is EAL4+. The certified version of EJBCA is EJBCA 5.0.4, and the Sponsor of the certification is PrimeKey Solutions AB. Some of the features required for running a Common Criteria certified installation is only available in EJBCA Enterprise.
EJBCA is licensed under the standard GNU Lesser General Public License (LGPL v2.1). The source code repository is, due to Common Criteria requirements, hosted by PrimeKey. It was first posted there in November 2001. At that time the amount of source code was around 6,000 lines of code including test code. As of October 2012, it contains about 260,000 lines of code (sloccount). EJBCA has been downloaded over 200,000 times at www.ejbca.org
- Research and application of EJBCA based on J2EE; Liyi Zhang, Qihua Liu and Min Xu; IFIP International Federation for Information Processing Volume 251/2008; ISBN 978-0-387-75465-9
- Chapter "Securing Connections and Remote Administration" in Hardening Linux; James Turnbull; ISBN 978-1-59059-444-5
- Exception-Handling Bugs in Java and a Language Extension to Avoid Them; Westley Weimer; Advanced Topics in Exception Handling Techniques Volume 4119/2006; ISBN 978-3-540-37443-5
- A workflow based architecture for Public Key Infrastructure; Johan Eklund; TRITA-CSC-E 2010:047