Internal Architecture

For developers and other interested parties, the following diagrams show an outline of the internal architecture of EJBCA, and dependencies between different modules.

Model View Controller Design

All the web modules are packaged as Web Archives (WAR) and packaged inside an Enterprise Archive (EAR) together with EJB modules for business logic, code for mapping Java objects to database rows and additional libraries need by the application that isn't provided by the application server.


The latest version of the Dia file is attached to ECA-8193.

Sample Flow

Let's say you run the pkcs10 ClientToolBox command, on a system with an RA and a CA, where the RA responds to WebService (SOAP) requests.

The flow would then start from PKCS10ReqCommand in ClientToolBox and finally reach X509CAImpl.generateCertificate, where the certificate is actually generated. The following displays an overview of how the call would flow between classes:

EJBCA Module Descriptions

This is a list of all modules in the modules directory. Unit tests directories (src-test) are excluded from this list.

Color key: WAR/RAR files in blue, EJB Stateless Session Beans in yellow, Entity beans in red, Standalone application in green.

ModuleBuild artifacts, by source directoryEditionDescription
acmesrc: JAR file with implementationEnterpriseACME protocol (RFC 8555) service.
src-common: WAR file
admin-guisrc: WAR file
Admin Web interface.
appserver-extsrc: Two JAR files with log classes
App server "extensions". Currently, it contains classes that extend log4j.
batchenrollment-guisrc: Standalone application
A GUI application to mass enroll certificates.
caasrc: JAR file with implementationEnterpriseCertification Authority Authorization (RFC 6844) validation.
src-cli: Standalone application
certificatestoresrc: WAR file
The certificate store servlet, allowing certificates to be downloaded.
cesecore-commonsrc: Common classes JAR
Common classes for the CESeCore framework.
cesecore-cvcasrc: JAR file with implementation
Implementation of CVC CA. Excluded in RA-only and VA-only builds.
cesecore-ejbsrc: EJB SSBs
Implementations of CESeCore Statless Session Beans.
cesecore-ejb-interfacesrc: EJB SSB interfaces
Interfaces for cesecore-ejb
cesecore-entitysrc: JAR file with entity classes
Entity classes for the CESeCore framework. These correspond to tables in the database.
cesecore-p11src: JAR file
Security fix for old versions of the SunPKCS11 implementation.
cesecore-x509casrc: JAR file with implementation
Implementation of X509CA. Excluded in RA-only and VA-only builds.
clearcache-warsrc: WAR file
WAR file that allows clearing caches by an HTTP request from localhost.
clientToolBoxsrc: Standalone application
Command line utility to manage HSM keys, send Web Service requests, run stress test, etc.
cli-utilsrc: JAR file with common classes
Common classes shared by the command line utilities in EJBCA.
cmpclientsrc: Standalone applicationEnterpriseCommand line CMP client.
cmpProxysrc: Standalone WAR file (HTTP or TCP)EnterpriseStandaone WAR file.
commonNo build artifact
Default log4j configuration for CLI utilities and tests.
configdump

src-cli: Standalone application

EnterpriseConfigdump lets you export a YAML file of your EJBCA configuration. Certificates or keys are not exported.
src-common: JAR file with interfaces
src-ejb: EJB SSBs
crlstoresrc: WAR file
The CRL store servlet. It allows CRLs to be downloaded.
ctsrc: JAR with implementation and OCSP extensionEnterpriseCertificate Transparency (RFC 6962) submission.
editition-specificsrc-ejb: EJB SSBs (placeholders for CE)
Interfaces and placeholders for Enterprise Edition specific functionality.
src-interface: EJB SSB interfaces
editition-specific-eesrc-ejb: EJB SSBs (actual implementations)EnterpriseEnterprise Edition only EJBs.
ejbca-cmp-tcpsrc: WAR file
CMP TCP server. Runs inside the app server if configured.
ejbca-cmp-warsrc: WAR file
CMP HTTP interface. Contains a servlet.
ejbca-commonsrc: JAR file with utility classes
Utility classes specific to EJBCA, and not used in other products that use CESeCore.
ejbca-common-websrc: JAR file with utility classes
Utility classes that are specific to the EJBCA web interfaces.
ejbca-ejbsrc: EJB SSBs
Implementations of EJBCA specific Stateless Session Beans.
ejbca-ejb-clisrc: Standalone application
Command line utility to operate EJBCA via the Remote EJB interface.
ejbca-ejb-interfacesrc: EJB SSB interfaces
Interfaces for ejbca-ejb.
ejbca-entitysrc: JAR file with entity classes
Entity classes specific to EJBCA. These correspond to tables in the database.
src-cli: Standalone application (ejbca-db-cli.jar)EnterpriseDatabase CLI tool for migrating between databases and for handling database protection.
ejbca-propertiesJAR file with properties
The properties files from conf/, conf/plugins/ and src/upgrade/
ejbca-renew-warsrc: WAR file
Self-service certificate renewal in public web.
ejbca-rest-apisrc: WAR fileEnterpriseWAR with entry point for the REST API.
ejbca-rest-*src: JAR file with REST ResourceEnterpriseREST Resource for different parts of the API (common, camanagement, cryptotoken).
ejbca-scep-warsrc: WAR file
SCEP protocol for creating and renewing certificate.
ejbca-webdist-warsrc: WAR file
CertDistServlet which implements download of certificates and CRL.
ejbca-webtestNo build artifact
This module contains Selenium tests for the AdminWeb, PublicWeb and RA Web.
ejbca-wssrc: JAR files with interface and implementation
This is the module for the WebService (SOAP) interface.
ejbca-ws-clisrc: JAR files with WS module of ClientToolBox
This module is included in ClientToolBox, and provides a WebService (SOAP) client.
estsrc-war: WAR fileEnterpriseProvides an EST protocol interface to EJBCA.
externalrasrc: JAR files for client and serviceEnterpriseThe ExternalRA is a legacy module for running an external Registration Authority. It consists of a service built into EJBCA, and an external web GUI.
src: Standalone application (externalra-cli.jar)
externalra-guisrc: WAR fileEnterpriseThe web GUI part of ExternalRA, to be deployed on a remote server.
externalra-scepsrc: Standalone applicationEnterpriseSCEP client for ExternalRA.
healthcheck-warsrc: WAR file
Provides a Health Check URL to check CA status.
oldlogexport-clisrc: Standalone application
Tool to export legacy LogEntryData database table to a file.
peerconnectorsrc-cli: JAR files with subcommands for ejbca-ejb-cliEnterpriseModule for handling peer connections, such as CA-RA or CA-VA.
src-common: JAR file with common classes
src-ejb: EJB SSBs
src-interface: EJB SSB interface
src-publ: JAR file with classes for handling peer publisher communication
src-ra: JAR file with classes for handling RA peer communication
src-rar: RAR file
src-war: WAR file
plugins-eesrc: JAR file
Extra plugins, such as Publishers, included in Enterprise Edition only.
publicweb-guisrc: WAR file
The EJBCA Public Web pages (/ejbca/ URL).
ra-guisrc: WAR file
The EJBCA RA Web pages (/ejbca/ra/ URL).
statedumpsrc-cli: Standalone applicationInternalStatedump is a PrimeKey internal tool, not included in EJBCA releases. It is the predecessor of Configdump.
src-common: JAR file with common classes
src-ejb: EJB SSB
systemtestssrc: EJB SSBs

Contains functional tests of EJBCA. These require an app server to be running.


The EJBs provide additional Remote EJB access that is required by the test, and are only built into the app server when productionmode is set to false.

src-interface: EJB SSB interfaces
unidfnrsrc-ejb: EJB SSB and entityEnterpriseUNID-FNR allows authenticated OCSP clients to obtain personal information from a certificate identifier.
vasrc-war: WAR file
OCSP responder servlet.
validationtoolsrc: Standalone applicationEnterpriseCommand line application for validating certificates.

EJB Stateless Session Beans Dependencies

The following diagram shows the internal relations between the Stateless Session Beans as they are injected. An updated version of this diagram can be generated by running "ant gen-depgraph" on a machine where the "dot" application is available.

Database Diagram

This is generated with MySQL / MariaDB Workbench, by using the Tools → Reverse Engineer tool and then selecting Arrange → Autolayout.