9.6.2 9.6 9.5 9.4.2 9.3.6 9.3.5 9.3.4 9.3.3 9.3.2
9.6.2 9.6 9.5 9.4.2 9.3.6 9.3.5 9.3.4 9.3.3 9.3.2
Breadcrumbs

EJBCA Community 9.6 Release Notes

​​ COMMUNITY EDITION SEPT 2026

The EJBCA team is pleased to announce the latest release of our open-source PKI software EJBCA Community 9.6.

This latest community release brings several new features and improvements, including composite certificate support, REST API improvements, OAuth improvements, and user interface improvements.

These release notes cover new EJBCA Community features and improvements implemented between EJBCA Community 9.3 and EJBCA Community 9.6.

Announcing EJBCA Enterprise Edition Requirement for HSM Integration

EJBCA enables migration to post-quantum cryptography (PQC) for PKI. To support the use of HSM Crypto Tokens with PQC, the EJBCA HSM integration architecture has been enhanced and continues to evolve for both PKCS#11-based and REST API-based HSM integrations.

As announced in the EJBCA 9.4 Release Notes, the SunPKCS11 Crypto Token has been deprecated since December 2025 and will be removed in a future EJBCA release.

As of EJBCA Community 9.6, the use of HSM Crypto Tokens requires EJBCA Enterprise Edition.

If you are using an earlier version of EJBCA Community Edition with HSM Crypto Tokens configured, you need to either migrate to EJBCA Enterprise Edition or delete any HSM Crypto Tokens before upgrading to EJBCA Community 9.6.

Highlights

ML-DSA Composite Certificate Support

EJBCA 9.5 introduced support for issuing certificates based on composite keys. A composite key is constructed from the combination of a classical cryptographic key (RSA, ECDSA, or EdDSA) and a quantum-safe key (ML-DSA-44, ML-DSA-65, or ML-DSA-87).

This implementation is based on version 13 of the IETF Composite ML-DSA draft specification, as defined in Composite ML-DSA for use in X.509 Public Key Infrastructure, and the EJBCA implementation is expected to be compliant with the final RFC once published.

For more information on issuing composite certificates with EJBCA, see Issue Composite Certificates.

REST API Improvements

Approvals through REST API

Approval workflows are now available through the REST API, making it easier to automate and integrate approval processes into existing systems. Note that CA activation approval is not supported through the REST API. For more information, see EJBCA REST Interface.

Extract CA CSR through REST API

EJBCA 9.6 adds support for exporting a CA Certificate Signing Request (CSR) through the REST API, enabling it to be signed by an external CA. This functionality was previously only available through the EJBCA user interface. For more information, see EJBCA REST Interface.

OAuth Improvements

EJBCA’s OAuth implementation now supports defining a set of valid hostnames. This enables redirects and authentication across multiple hostnames. EJBCA now also has built-in support for Auth0 as a Trusted OAuth (OpenID Connect) provider.

For more information, see OAuth Providers and Setting up OAuth Using Auth0.

User Interface Improvements

Several administration pages have been improved to enhance layout, navigation, and consistency across the interface.

The recommended Java runtime environment for EJBCA 9.6 is Java 21 and the recommended application server is WildFly 39.

For more information on software requirements, see Installation Prerequisites.

Announcements

Bouncy Castle 1.84 Upgrade

Bouncy Castle has been upgraded to version 1.84. For information about the latest Bouncy Castle releases, refer to the Bouncy Castle Release Notes.

Configuration File Changes

Several properties have been moved from the static configuration under the conf directory into the database, where they can now be modified through the EJBCA user interface.

All migrated properties are automatically copied from the configuration files during the upgrade and can be removed from their respective configuration files afterward.

Subject Alternative Names column size increased

The default database column size for Subject Alternative Names (SANs) has been increased from 2000 to 8000 characters to prevent upgrade issues caused by schema handling changes in WildFly/Hibernate.

Downloads and Resources

There are several options available for downloading the latest EJBCA Community:

  • EJBCA Community is available for download from GitHub.

  • EJBCA Community container is available for download from Docker Hub.

Find links to downloads, how-to guides, video tutorials, and documentation at ejbca.org.

Want to learn more about our open-source software? Get in touch over at EJBCA Discussions on GitHub, a collective space where you can share feedback and contribute ideas to future releases. Thank you for your continued support and contributions to the EJBCA community.