For developers and other interested parties, the following diagrams show an outline of the internal architecture of EJBCA, and dependencies between different modules.

EJBCA Module Descriptions

This is a list of all modules in the modules directory. Unit tests directories (src-test) are excluded from this list.

ModuleBuild artifacts, by source directoryEditionDescription
acmesrc: JAR file with implementationEnterpriseACME protocol (RFC 8555) service.
src-common: WAR file
admin-guisrc: WAR file
Admin Web interface.
appserver-extsrc: Two JAR files with log classes
App server "extensions". Currently, it contains classes that extend log4j.
batchenrollment-guisrc: Standalone application
A GUI application to mass enroll certificates.
caasrc: JAR file with implementationEnterpriseCertification Authority Authorization (RFC 6844) validation.
src-cli: Standalone application
certificatestoresrc: WAR file
The certificate store servlet, allowing certificates to be downloaded.
cesecore-commonsrc: Common classes JAR
Common classes for the CESeCore framework.
cesecore-cvcasrc: JAR file with implementation
Implementation of CVC CA. Excluded in RA-only and VA-only builds.
cesecore-ejbsrc: EJB SSBs
Implementations of CESeCore Statless Session Beans.
cesecore-ejb-interfacesrc: EJB SSB interfaces
Interfaces for cesecore-ejb
cesecore-entitysrc: JAR file with entity classes
Entity classes for the CESeCore framework. These correspond to tables in the database.
cesecore-p11src: JAR file
Security fix for old versions of the SunPKCS11 implementation.
cesecore-x509casrc: JAR file with implementation
Implementation of X509CA. Excluded in RA-only and VA-only builds.
clearcache-warsrc: WAR file
WAR file that allows clearing caches by an HTTP request from localhost.
clientToolBoxsrc: Standalone application
Command line utility to manage HSM keys, send Web Service requests, run stress test, etc.
cli-utilsrc: JAR file with common classes
Common classes shared by the command line utilities in EJBCA.
cmpclientsrc: Standalone applicationEnterpriseCommand line CMP client.
cmpProxysrc: Standalone WAR file (HTTP or TCP)EnterpriseStandaone WAR file.
commonNo build artifact
Default log4j configuration for CLI utilities and tests.
configdump

src-cli: Standalone application

EnterpriseConfigdump lets you export a YAML file of your EJBCA configuration. Certificates or keys are not exported.
src-common: JAR file with interfaces
src-ejb: EJB SSBs
crlstoresrc: WAR file
The CRL store servlet. It allows CRLs to be downloaded.
ctsrc: JAR with implementation and OCSP extensionEnterpriseCertificate Transparency (RFC 6962) submission.
editition-specificsrc-ejb: EJB SSBs (placeholders for CE)
Interfaces and placeholders for Enterprise Edition specific functionality.
src-interface: EJB SSB interfaces
editition-specific-eesrc-ejb: EJB SSBs (actual implementations)EnterpriseEnterprise Edition only EJBs.
ejbca-cmp-tcpsrc: WAR file
CMP TCP server. Runs inside the app server if configured.
ejbca-cmp-warsrc: WAR file
CMP HTTP interface. Contains a servlet.
ejbca-commonsrc: JAR file with utility classes
Utility classes specific to EJBCA, and not used in other products that use CESeCore.
ejbca-common-websrc: JAR file with utility classes
Utility classes that are specific to the EJBCA web interfaces.
ejbca-ejbsrc: EJB SSBs
Implementations of EJBCA specific Stateless Session Beans.
ejbca-ejb-clisrc: Standalone application
Command line utility to operate EJBCA via the Remote EJB interface.
ejbca-ejb-interfacesrc: EJB SSB interfaces
Interfaces for ejbca-ejb.
ejbca-entitysrc: JAR file with entity classes
Entity classes specific to EJBCA. These correspond to tables in the database.
src-cli: Standalone application (ejbca-db-cli.jar)EnterpriseDatabase CLI tool for migrating between databases and for handling database protection.
ejbca-propertiesJAR file with properties
The properties files from conf/, conf/plugins/ and src/upgrade/
ejbca-renew-warsrc: WAR file

Self-service certificate renewal in public web.
(warning) Public Web is deprecated as of EJBCA 7.9 and will no longer be supported as of the next major version of EJBCA.

ejbca-rest-apisrc: WAR fileEnterpriseWAR with entry point for the REST API.
ejbca-rest-*src: JAR file with REST ResourceEnterpriseREST Resource for different parts of the API (common, camanagement, cryptotoken).
ejbca-scep-warsrc: WAR file
SCEP protocol for creating and renewing certificate.
ejbca-webdist-warsrc: WAR file
CertDistServlet which implements download of certificates and CRL.
ejbca-webtestNo build artifact
This module contains Selenium tests for the AdminWeb, PublicWeb and RA Web.
(warning) Public Web is deprecated as of EJBCA 7.9 and will no longer be supported as of the next major version of EJBCA.
ejbca-wssrc: JAR files with interface and implementation
This is the module for the WebService (SOAP) interface.
ejbca-ws-clisrc: JAR files with WS module of ClientToolBox
This module is included in ClientToolBox, and provides a WebService (SOAP) client.
estsrc-war: WAR fileEnterpriseProvides an EST protocol interface to EJBCA.
externalrasrc: JAR files for client and serviceEnterpriseThe ExternalRA is a legacy module for running an external Registration Authority. It consists of a service built into EJBCA, and an external web GUI.
src: Standalone application (externalra-cli.jar)
externalra-guisrc: WAR fileEnterpriseThe web GUI part of ExternalRA, to be deployed on a remote server.
externalra-scepsrc: Standalone applicationEnterpriseSCEP client for ExternalRA.
healthcheck-warsrc: WAR file
Provides a Health Check URL to check CA status.
oldlogexport-clisrc: Standalone application
Tool to export legacy LogEntryData database table to a file.
peerconnectorsrc-cli: JAR files with subcommands for ejbca-ejb-cliEnterpriseModule for handling peer connections, such as CA-RA or CA-VA.
src-common: JAR file with common classes
src-ejb: EJB SSBs
src-interface: EJB SSB interface
src-publ: JAR file with classes for handling peer publisher communication
src-ra: JAR file with classes for handling RA peer communication
src-rar: RAR file
src-war: WAR file
plugins-eesrc: JAR file
Extra plugins, such as Publishers, included in Enterprise Edition only.
publicweb-guisrc: WAR file
The EJBCA Public Web pages (/ejbca/ URL).
ra-guisrc: WAR file
The EJBCA RA Web pages (/ejbca/ra/ URL).
statedumpsrc-cli: Standalone applicationInternalStatedump is a PrimeKey internal tool, not included in EJBCA releases. It is the predecessor of Configdump.
src-common: JAR file with common classes
src-ejb: EJB SSB
systemtestssrc: EJB SSBs

Contains functional tests of EJBCA. These require an app server to be running.


The EJBs provide additional Remote EJB access that is required by the test, and are only built into the app server when productionmode is set to false.

src-interface: EJB SSB interfaces
unidfnrsrc-ejb: EJB SSB and entityEnterpriseUNID-FNR allows authenticated OCSP clients to obtain personal information from a certificate identifier.
vasrc-war: WAR file
OCSP responder servlet.
validationtoolsrc: Standalone applicationEnterpriseCommand line application for validating certificates.


Database Diagram

Note: This diagram is current as of EJBCA 7.8.1