EJBCA Overview

Introduction

EJBCA (Enterprise Java Beans Certificate Authority) is an open-source, enterprise-grade PKI solution developed by Keyfactor. It provides a comprehensive CA solution for issuing, managing, and revoking X.509 certificates across large-scale environments.

Note

For the current release, EJBCA is not used for managing platform certificates. EJBCA is an optional system application that provides a PKI solution for managing certificates in non-platform trust chains, such as the certificate trust chains for hosted applications running on the platform.

EJBCA supports multiple interfaces for certificate enrollment and management:

  • CMP (CMP) — Automates certificate enrollment, renewal, and revocation.

  • REST API — Enables programmatic certificate lifecycle management over HTTP.

  • Admin GUI — Provides a browser-based interface for interactive CA administration.

  • CLI — Supports command-line administration and operational tasks within the EJBCA container.

Note

For the latest development of EJBCA Community Edition (CE), see: https://github.com/Keyfactor/ejbca-ce.

EJBCA Installed Resources

On StarlingX, EJBCA is deployed as the optional app-ejbca platform application and includes the following components:

  • EJBCA CE — the core PKI engine (LGPL-2.1+ licensed).

  • ejbca-cert-manager-issuer — cert-manager integration for Kubernetes-native certificate issuance (Apache 2.0).

  • cert-manager-approver-policy — policy controller for CertificateRequest approval (Apache 2.0). Provides integration with cert-manager together with ejbca-cert-manager-issuer.

  • CloudNativePG — PostgreSQL operator that manages database cluster lifecycle (Apache 2.0).

  • ejbca-pg-cluster — CloudNativePG database Cluster providing HA PostgreSQL persistence.

  • Apache httpd sidecar — reverse proxy providing mTLS termination for the EJBCA service.

  • A companion optional open source application, Stakater Reloader (app-reloader) is also introduced. When installed, it automatically restarts pods whenever cert-manager renews the EJBCA TLS certificate secret, allowing the httpd sidecar to load the updated certificate without requiring manual intervention. For more information about Stakater Reloader, see: https://github.com/stakater/Reloader.

Deploying app-ejbca also reconfigures the platform to allow external access to the EJBCA service:

  • HAProxy integration — SSL passthrough for external traffic to EJBCA.

  • OAM GlobalNetworkPolicy — opens port 7443 to allow ingress TCP traffic.

The application runs in the ejbca namespace and exposes services externally through the platform HAProxy load balancer on OAM port 7443.

EJBCA Procedures and Reference Topics

Task

Topic

Upload, configure, apply, update, and remove the app-ejbca platform application.

Deploy and Manage the EJBCA Application

Access the EJBCA Admin GUI and perform certificate operations through the browser interface.

EJBCA Admin GUI Access and Operations

Create and manage CAs, certificate profiles, and end entity profiles using the EJBCA CLI.

Configure EJBCA Using the CLI

Enroll, renew, revoke, and check certificate status using the CMP protocol.

EJBCA Certificate Lifecycle Management Using CMP

Enroll, renew, revoke, and check certificate status using the EJBCA REST API and curl.

EJBCA Certificate Lifecycle Management Using REST API

Automate certificate issuance and renewal for Kubernetes workloads using cert-manager and the EJBCA ClusterIssuer.

EJBCA Integration with Kubernetes cert-manager

Configure automatic renewal of the EJBCA server TLS certificate via cert-manager and Stakater Reloader.

Automatic EJBCA Server Certificate Renewal

Back up and restore EJBCA CA keys, certificates, profiles, and database content using Ansible playbooks.

Back Up and Restore EJBCA Data

Note

For detailed guidance on EJBCA functionality, administration, and configuration, see the official EJBCA documentation.