EJBCA is the open-source CA that most people end up with when a private PKI outgrows a shell script and a directory of OpenSSL config files. It talks to hardware through PKCS#11, and this device is a PKCS#11 token.
It is a crypto token, configured like any other
In EJBCA a hardware key store is a crypto token of type PKCS#11. You point it at the OpenSC PKCS#11 library, identify the slot — by label rather than by index, which survives a reboot — and give it the user PIN. The CA’s signing key is then generated inside the card through EJBCA’s own key generation, so it exists nowhere else from the moment it is created.
Nothing about this is KeyNub-specific. EJBCA has spoken PKCS#11 for years, and the device presents a standard smart-card reader, so it appears as a token EJBCA already knows how to drive.
Where it fits, and where it does not
This is the right hardware for an offline root CA — generated in a ceremony, used to sign a few intermediates, then unplugged and put in a safe. It is also right for a small issuing CA, a lab, a proof of concept, or a validation authority that signs OCSP responses at a modest rate.
It is not the right hardware for a busy issuing CA. A signature costs 39 ms on an EC key and 1.04 s on RSA-4096, measured through the device, so an issuing CA stamping thousands of certificates an hour, or an OCSP responder signing per-request, wants a network HSM with a PCIe accelerator behind it. The usual arrangement is exactly that split: this device for the root, an appliance for the tier that does the work.
Backup before you build anything on it
EJBCA will happily let you create a CA whose key exists in precisely one place. Set up the encrypted backup domain at card initialisation, take a wrapped copy of the CA key, and rehearse restoring it onto a second device before the CA signs anything you care about. The shares are n-of-n, so custody needs planning — see running your own CA.
Where to go next
EJBCA is where a private PKI usually ends up. See also running your own CA, OpenSSL, code signing, or the hardware security module overview and the datasheet.
The KeyNub HSM ships from Munich. Ask us if you want to talk through a deployment first, or order one.
