This is a continuation of the blog post EJBCA will always be Open Source.
Here we will describe the feature difference between EJBCA 5 (Enterprise) and EJBCA 4 (Community). For a high level overview you should first read EJBCA will always be Open Source.
For a list of all the features in EJBCA, visit EJBCA.org.
EJBCA Enterprise Edition vs CommunityEJBCA 5 has features required for high trust environments:
- Common Criteria EAL4+ and CWA 14167 certified.
- Certified access control and authorization module, for assurance and high trust role separation.
- Integrity protected security audit log, with digital signature or HMAC protection.
- Improved security audit log messages, complete information that is auditable.
- Full database integrity protection of all tables, to detect database manipulation.
- Authentication of local CLI users enabling role separation also for local CLI.
- Penetration tested with improved security.
In addition to that there are other minor changes that are unique to EJBCA 5. These changes are the result of the majority of development resources now focusing on future versions of EJBCA, and will eventually water down to Community EJBCA.
- Smaller release ZIP file.
- Minor CLI improvements with new methods and parameters.
- New database CLI for database export, import and verification.
- Support for Permanent Identifiers (RFC 4043) and authorityInformationAccess in CRLs.
- Support for SIP and Kerberos extended key usages.
- Improved memory efficiency in certain use cases.
- Optimized database usage.
- Other minor improvements and bugfixes.
Normal users will be satisfied with the feature set, and the record breaking performance, of EJBCA 4.
Feature comparison table
|License||Open Source LGPL v2.1 or later||Open Source LGPL v2.1 or later|
|PKI features||Full, including all protocols||Full, including all protocols|
|Recommended for||EJBCA Enterprise is recommended for Corporations, Governments and other organizations looking for an enterprise scale, production-ready, certified, open source PKI solution without any upfront license fees.||EJBCA Community is recommended for developers and technical PKI users in non-mission critical environments. As this version is unsupported it is intended to be used by those prepared to spend time and resource solving issues independently.|
|Suitable for||EJBCA is suitable for small to huge scale PKI deployments ranging from 1000 to over 100 million issued certificates.||EJBCA is suitable for small to huge scale PKI deployments ranging from 1000 to over 100 million issued certificates.|
|Security Certifications||EJBCA Enterprise has been certified under Common Criteria EAL 4+ (CIMC Protection Profile) and CWA 14167-1 (at customer locations).||None|
|Commercial support||PrimeKey provides commercial support with Service Level Agreements (SLA) for issue tracking, problem resolution, patches and fixes.||None provided, community support through forums and mailing lists.|
|Integrity protected security audit||EJBCA Enterprise features a Common Criteria certified security audit mechanism using HMAC or digital signatures for integrity protection.||No|
|Database integrity protection||EJBCA Enterprise features a Common Criteria certified database protection protecting the database from malicious DBAs.||No|
|Penetration tested||EJBCA Enterprise has been penetration tested as part of Common Criteria evaluation, and by independent security testers.||No|
|Role separation||Full role separation including local command line interface.||Role separation for remote access users.|
|Security flaw remediation process||PrimeKey have a Common Criteria evaluated tracking process for security, and other, bug reports.||EJBCA Community follows an open development and issue tracking process, without guaranteed response times.|
|License Price / Subscription||No software license fee – Provided as part of an annual subscription for commercial level support.||No software license fee – free to download, free to use.|
|Additional features||Emergency hot fixes, security alerts, best practice advice, private issue tracking portal.||Most feature complete and most flexible PKI, with highest performance, compared to most open source and commercial PKIs.|
|Training||Customers and Partners get training on latest certified PKI from PrimeKey.||Training available from PrimeKey also for EJBCA Community.|