KeyFactor EJBCA / SignServer & Primus HSM

Modern enterprises demand scalable, robust, and easy-to-integrate PKI solutions to manage digital certificates and cryptographic operations securely. Traditional HSM integrations using PKCS#11 are often cumbersome to configure and maintain. Moreover, evolving cryptographic standards necessitate infrastructure readiness for PQC algorithms to stay secure and future-proof.

Solution

Securosys and Keyfactor offer a REST API-based integration that seamlessly connects Securosys Primus HSMs with Keyfactor EJBCA and SignServer. By leveraging REST API integration, Keyfactor EJBCA and SignServer can establish direct, secure connections with Securosys Primus HSMs, eliminating the need for additional middleware or PKCS#11 configurations. This integration streamlines certificate issuance, validation, and encryption processes, all while ensuring hardware-backed protection of private keys.

Enterprises benefit from real-time cryptographic operations that optimize both performance and security without added complexity. The solution also includes built-in support for NIST-selected post-quantum cryptographic algorithms – such as ML-DSA, SLH-DSA, ML-KEM, HSS-LMS, and XMSS – allowing organizations to future-proof their PKI infrastructure. As a result, businesses can smoothly transition into the post-quantum era while staying resilient against evolving security threats.

REST API integration reduces deployment complexity by eliminating PKCS#11 dependencies.

Native support for post-quantum algorithms ensures long-term cryptographic agility.

SKA policies enforce multi-party authorization and regulatory compliance.

Available on-premises or as a cloud-based service, enabling scalable deployment options.

This integration provides organizations with a forward-looking solution by supporting Post-Quantum Cryptography (PQC) algorithms, ensuring resilience against emerging threats. Businesses can utilize hybrid signatures that combine classical and post-quantum cryptographic algorithms, enabling broad compatibility across legacy and modern systems.

The solution strengthens security for critical applications such as digital signing, document authentication, and identity verification. These capabilities help organizations meet stringent compliance requirements while maintaining the highest level of trust in digital transactions. By leveraging this integration, businesses can proactively adapt their cryptographic infrastructure to evolving security challenges without disruptive systems overhauls.

Solution Components

Securosys Primus HSM and CloudHSM provide secure cryptographic key storage and management, ensuring that private keys remain protected in a tamper-resistant environment. Being compliant with FIPS 140-2 Level 3 and Common Criteria EAL4+, Securosys HSMs meet the highest security standards for enterprise environments.

Keyfactor’s EJBCA is a scalable, comprehensive certificate authority (CA) and PKI platform that handles certificate issuance, validation, and lifecycle management. SignServer ensures secure digital signing and timestamping for compliance and high-trust applications.

Keyfactor Solution Brief - Graphic(3)

KeyFactor EJBCA / Sign Server

Challenge

Solution

Key Benefits

Joint Use Case

Solution Components

Resources

KeyFactor EJBCA / Sign Server

Challenge

Solution

Key Benefits

Joint Use Case

Solution Components

Resources

Related Products