How-to Guides

Documentation

• Quick Start EJBCA Container with Client Certificate Authenticated Access

  Start an EJBCA Community Docker container with client certificate authenticated access.

• Quick Start EJBCA Container with Unauthenticated Network Access

  Learn how to start an ephemeral instance to quickly spin up a PKI for testing EJBCA or trying out new features in an updated version of EJBCA.

• Quick Start - Issue Client Authentication Certificate using EJBCA

  Learn how to issue a client authentication certificate using the EJBCA Community container.

• Quick Start SignServer Container with Client Certificate Authenticated Access

  Learn how to get started with SignServer Community as a Docker container.

• Deploy EJBCA using a Helm chart

  Add an EJBCA Community Helm repository and configure deployments by customizing the Helm chart configuration file.

• Deploy EJBCA Enterprise CA with Helm chart

  Set up a near-production-ready Public Key Infrastructure (PKI) using EJBCA Enterprise, Helm, and Kubernetes.

• Deploy SignServer using a Helm chart

  Add a SignServer Community Helm repository and configure deployments by customizing the Helm chart configuration file.

• Start out with EJBCA Docker container

  Run the EJBCA Community container on Docker with Docker Compose and with a MariaDB database.

• Create your first Root CA using EJBCA

  The recommended setup is to create a multi-tier CA hierarchy. With this setup, the root CA is used only to issue certificates for a number of sub CAs, giving them authority to issue new certificates. You may for example have one CA for internal entities and one for external, different CAs across regions, different CAs for different purposes, and so on. Once you have decided on your hierarchy of CAs, you need to decide how long each certificate should be valid. A rule of thumb is that a sub CA should have half the validity period of its issuing CA. A typical setup for this example two-tier hierarchy would be to set the root CA to 20 years, the second level CAs to 10 years, and the End Entity certificates issued to 5 years.

• Create a PKI Hierarchy in EJBCA

  Learn how to create a multi-tier Certificate Authority (CA) hierarchy in EJBCA.

• Issue TLS server certificates with EJBCA

  Learn how to issue TLS server certificates using the EJBCA RA client.

• Issue TLS client certificates with EJBCA

  Learn how to issue TLS client certificates using the EJBCA RA client.

• Configure EJBCA to issue short-lived (ephemeral) certificates

  Learn how to configure short-lived certificates, also known as ephemeral certificates, in EJBCA.

• Create roles in EJBCA

  Learn how to create roles with different permissions in EJBCA.

• Install MicroK8s to run EJBCA

  Install and configure the MicroK8s Kubernetes runtime on Alma Linux to deploy the EJBCA container for testing.

• Deploy EJBCA container in MicroK8s

  Deploy the EJBCA container in the Kubernetes distribution MicroK8s.

• Deploy EJBCA container to issue certificates to an Istio service mesh

  Learn how to use EJBCA and the EJBCA CSR Signer to issue mutual TLS certificates to a service mesh such as Istio.

• Upgrade your EJBCA Docker container to the latest version

  Upgrade your EJBCA container installation in a few minutes without worrying about complex update procedures or dependencies.

• Get started with EJBCA Community container on AWS

  Learn how to start the EJBCA Community container on the AWS Marketplace.

• Set up a Free Trial Version of EJBCA on AWS

  This video walks you through the steps of setting up a free trial version of EJBCA Enterprise on AWS.

• Create an Ansible AWS Instance for EJBCA

  This video walks you through the steps of creating an Ansible AWS instance to be used with EJBCA.

• Sign Container Images with Cosign and SignServer

  Use SignServer to sign a payload generated by Cosign, and use Cosign to verify the signed container image.

• Set up Code Signing with OpenPGP Signatures

  Learn how to set up code and package signing using the OpenPGP message format with SignServer.

• Sign Code in GitHub Workflows with GitHub Actions and SignServer

  Secure your pipeline by signing code in GitHub Workflows with GitHub Actions and SignServer.

• Create a Post-Quantum PKI using EJBCA

  Learn how to create Certificate Authorities (CAs) using a quantum-safe algorithm.

• Sign Data Using Post-Quantum Algorithm ML-DSA with SignServer

  Try out signing data using SignServer with the NIST-approved quantum-safe algorithm ML-DSA.

• Build a Post-Quantum Ready PKI with Chimera CAs using PQC Lab Test Drive

  Configure hybrid (Chimera) post-quantum certificate authorities (CAs) using EJBCA Enterprise and then issue certificates with the ML-DSA and ML-KEM algorithms.

• Create Post-Quantum Cryptography Chimera CA Chain

  Create a post-quantum cryptography (PQC) Chimera Certificate Authority (CA) chain, using RSA for the traditional key and ML-DSA for the PQC key.

• Issue a PQC Chimera End Entity Certificate with ML-KEM

  Use a PQC Chimera PKI to issue an ML-KEM end entity certificate.

• Issue Matter IoT-compliant certificates with EJBCA

  Set up a Matter IoT-compliant PKI and issue certificates for your devices.

• Set up EJBCA to issue device identities based on IEEE 802.1AR

  Configure EJBCA to generate device identities and test the mechanisms described in the IEEE standard 802.1 AR.

• Implement Secure Boot V2 for Espressif ESP32 with SignServer

  A tool that generates a PKCS#10 request with the existing key pair in the first step and creates a PKCS#12 token with the certificate in the second step can be found here.

• Use an ephemeral CA and revoke ephemeral certificates

  Set up an ephemeral Certificate Authority (CA) to issue ephemeral certificates from EJBCA, and revoke a certificate using the EJBCA REST API.

• Lift & Shift Your EJBCA Setup: Automate with ConfigDump

  Learn how to export, adjust, and redeploy EJBCA configurations across environments using the EJBCA ConfigDump tool in combination with Kubernetes and Helm.

• Automate EJBCA RA Deployment with Helm and ConfigDump

  Set up an EJBCA RA connected to an EJBCA CA in Kubernetes, and automate the deployment using EJBCA Enterprise, ConfigDump, and Helm charts.

• Use EJBCA with cert-manager

  Set up EJBCA to issue certificates with the cert-manager using the EJBCA cert-manager external issuer.

• Use EJBCA with HashiCorp Vault

  Deploy a three-node Vault cluster and configure the EJBCA PKI Secrets Engine for HashiCorp Vault plugin to issue certificates from EJBCA through Vault.

• Automate certificate issuing via EJBCA REST API

  Automate your certificate issuance, using the EJBCA REST API CLI with Python or the EJBCA REST API with Postman.

• Deploy EJBCA and SignServer with Ansible playbooks

  Automate the installation and configuration of EJBCA or SignServer using the open-source Ansible playbook for a zero-touch PKI or signing experience.

• Integrate EJBCA with SPIFFE SPIRE Server

  Set up SPIFFE SPIRE to use the EJBCA UpstreamAuthority Plugin, enabling it to issue workload identities as part of a trusted EJBCA PKI.

• Deploy Istio Service Mesh in a Multi-Cluster Kubernetes Environment Using EJBCA as an External PKI provider

  Set up Istio in a multi-cluster Kubernetes environment with EJBCA as external CA, allowing for scalabillity, high availability, and full PKI functionality.

• Deploy Istio and cert-manager with Helm to Issue Mesh Certificates from EJBCA

  Deploy Istio and cert-manager with Helm to issue Istio service mesh certificates from EJBCA.

• Clean up MicroK8s Cluster and Redeploy with Helm

  Clean up the MicroK8s cluster, removing previous containers and configurations, and then redeploy MariaDB and EJBCA using a Helm chart on the cleaned-up cluster.

• Secure the Software Supply Chain with Chainloop

  About Chainloop Chainloop is an open-source evidence store for software supply chain attestations, Software Bill of Materials (SBOMs), vulnerability reports (V…

• Replace ADCS with EJBCA Microsoft Auto-enrollment

  Learn how to replace Microsoft Active Directory Certificate Services (ADCS) auto-enrollment with EJBCA Microsoft Auto-enrollment (MSAE) as a drop-in alternative.

• Zero Touch PQC PKI Deployment with Kubernetes, Helm, and PQC Composite Certificates

  Deploy a PQC-ready PKI in Kubernetes using Helm for automation and backed by SecuroSys and Fortanix HSMs.

• Configure EJBCA for NXP EdgeLock 2GO Service Platform

  Use NXP EdgeLock 2GO with EJBCA to provision and manage x.509 certificates to devices from your own PKI.

• Configure EJBCA for Microchip TrustFLEX and TrustCUSTOM

  In this guide, you will learn how to set up EJBCA to issue X.509 certificates that conform to Atmel/Microchip’s compressed certificate format. For more informa…