EJBCA Enterprise Cloud Validation Authority (VA) - Premium Support

My main use case for EJBCA Enterprise is setting up our internal certificate authority where all website certificates, specifically internal website certificates, are managed. Anybody in any business unit within our organization needing any SSL or TLS certificate for their web servers can do so by logging into Venafi or making API calls to get the certificate from our internal certificate authority. I have EJBCA Enterprise certificate authority set up behind Venafi, allowing anyone to request a certificate.

I decided on setting up EJBCA Enterprise as our internal certificate authority because it is open source and compared to Microsoft certificate authority, it has a cheaper licensing cost, particularly with Windows servers. Since EJBCA Enterprise is open source and Linux-based, the cost is lower and there are no licensing costs. In our use case, we use Microsoft certificate authority for user-based certificates because with the help of group policy, we can deploy a certificate to user laptops. For this scenario, Microsoft certificate authority is effective. However, for web server certificates which are generally not part of a domain, especially on many Linux servers that are not part of Active Directory, EJBCA Enterprise is the best choice due to lower costs and better fit.

I have additional thoughts about my main use case and how I'm using EJBCA Enterprise, especially since it has integration with Venafi which prevents direct exposure. Users feel they are using Venafi, and based on their certificate request type, the request is redirected to the best working certificate authority. This has worked well for us because EJBCA Enterprise supports API calls, allowing anyone needing a certificate to do so via API calls. Most users today request certificates via API calls due to the rise of DevOps practices. Moreover, EJBCA Enterprise works well with Docker containers or Kubernetes pods, and we have integrated cert-manager with Venafi. Now anybody needing a certificate for their pods or containers can request it, and EJBCA Enterprise is performing effectively for us.

EJBCA Enterprise positively impacts my organization by aligning with our initiative to promote open-source software. My culture encourages using open-source software, which has helped us significantly. While we still utilize Microsoft certificate authority in certain scenarios, such as user-based or laptop-based certificates, employing EJBCA Enterprise allows us to contribute to our organizational goals and KPIs, particularly because it is open source, which was a major goal for us.

EJBCA Enterprise has definitely resulted in cost savings for my organization. It has also saved us time.

EJBCA Enterprise offers several best features, particularly when compared with Microsoft certificate authority, which has its native database that restricts the use of third-party databases. EJBCA Enterprise allows the use of third-party databases, such as Microsoft SQL, enabling additional benefits in creating and running SQL queries that help in reporting and dashboard creation.

Using third-party databases with EJBCA Enterprise has significantly improved our reporting and dashboards. Most developers or operational engineers proficient in infrastructure are skilled with SQL and can run SQL queries effectively. When issues arise, I generally have read-only access or sometimes admin access, enabling me to remove stale entries or edit user details when necessary. For instance, I recall an occasion when a certificate name in Venafi was renamed, but the corresponding name in EJBCA Enterprise was unchanged. In such scenarios, I can rename the common name of the certificate, showcasing the advantages of using third-party databases, as 99% of users know how to execute SQL queries.

I would add that EJBCA Enterprise works effectively with API calls, offering capabilities for certificate requests, renewals, and revocations. We can create customized dashboards depending on our use case, though this does require some development effort. Notably, EJBCA Enterprise now supports post-quantum algorithms, which I appreciate as they keep their product up-to-date. Additionally, being Linux-based contributes to its security, and as an admin proficient in Linux, I favor Linux-based deployments. Given that EJBCA Enterprise and Microsoft are the two main vendors in this space, EJBCA Enterprise stands out as the best choice for a Linux-based deployment.

EJBCA Enterprise is performing very well overall. However, one area for improvement could be the addition of a native dashboard capability within EJBCA Enterprise to facilitate reporting. Currently, I rely on Venafi for reporting or have created a custom dashboard by establishing a read replica from the actual database, which requires running ETL jobs to pull new data every day for analytics, causing some headaches. Having native dashboard features directly in EJBCA Enterprise would be beneficial.

I think EJBCA Enterprise is good as it currently stands. They are doing very well, but perhaps future improvements related to AI could be beneficial, although I'm unsure of specifics at this moment.

I have been using EJBCA Enterprise for seven years.

EJBCA Enterprise is very reliable, thanks to its deployment model. During upgrades, I have had nearly zero outages; when upgrading a number of servers, I upgrade them one by one and disable them from the load balancer to ensure the other servers can manage user requests. Once I upgrade a portion, I test it and re-enable them before proceeding with the remaining servers. This architecture ensures reliability and user satisfaction during upgrades, which is why I appreciate this product.

EJBCA Enterprise is stable.

EJBCA Enterprise scales very well; autoscaling is part of the cloud EC2 setup without vendor reliance. On-premises, EJBCA Enterprise creates a cluster; in my cluster, I had eight to ten servers. I initially started with four servers, and as traffic increased, I deployed additional servers and easily added them to the cluster based on demand, providing options for scalability.

Customer support has been good; it's a mixed experience. For critical incidents, knowledgeable experts provide support, but for minor issues, my experience has been that inexperienced support agents may struggle. EJBCA Enterprise is complex, and support effectiveness often hinges on the experience level of the agent.

I would rate customer support a seven out of ten.

I have used Microsoft certificate authority in a previous organization, but not in this one. The choice depends on the organization; EJBCA Enterprise's setup complexity requires someone with significant Linux experience, while Microsoft certificate authority is generally easier to deploy due to its UI-based setup, which many prefer.

I consider EJBCA Enterprise a good product given my seven years of experience using it. The product is very secure; however, I believe that deploying EJBCA Enterprise can be challenging for someone with only a Microsoft Windows-based deployment background. I struggled initially, but once I understood the full architecture and deployment process, it became easier, and I now enjoy deploying EJBCA Enterprise. It remains a complex product that is not easy to grasp at first. I know it is secure because I use it, and EJBCA Enterprise has excelled in essential aspects such as post-quantum cryptography, particularly with the release of EJBCA Enterprise 9.3, which supports post-quantum cryptography algorithms.

I have deployed EJBCA Enterprise on-premises thus far, but I have also conducted a proof of concept on cloud, which worked as well.

For my proof of concept, I used AWS.

As mentioned, EJBCA Enterprise is open-source software, so I conducted the proof of concept and procured the software from the vendor. If you have an EC2 instance with RHEL, deploying it is straightforward.

I have absolutely seen a return on investment with EJBCA Enterprise. I have managed around 500,000 certificates in my organization; users can request certificates easily. Licensing is not based on the number of certificates; once setup is complete, the majority of costs are just server-related, making it less expensive compared to Microsoft solutions. This has greatly saved me money.

My experience with pricing, setup costs, and licensing indicates EJBCA Enterprise is comparatively cheaper than Microsoft. The licensing costs are lower, and another notable aspect is the flexibility to choose databases, including MariaDB, SQL, or PostgreSQL, which is advantageous.

Before choosing EJBCA Enterprise, I evaluated Microsoft certificate authority. There are limited options in this area, mainly Microsoft and EJBCA Enterprise.

I would rate EJBCA Enterprise a nine out of ten.

I choose nine out of ten for EJBCA Enterprise because it performs very well, but the only area needing improvement is the dashboard functionality; if that is added, it would be a perfect ten out of ten.

My advice for those considering EJBCA Enterprise is to use Microsoft-based deployment for small use cases since EJBCA Enterprise is complex to set up. It is essential to have a very experienced individual for EJBCA Enterprise deployment, ideally with eight to ten years of experience and some architectural background. In contrast, someone with just three to five years of experience can install and configure Microsoft certificate authority more easily. For large enterprises with significant certificate needs, open-source EJBCA Enterprise can provide substantial savings, but expert help is necessary.