EJBCA Pure PQC Lab — ML-DSA-65 Two-Tier PKI Hierarchy

A hands-on implementation of NIST FIPS 204 (ML-DSA) in a two-tier PKI hierarchy using EJBCA Community Edition.

📖 Full walkthrough: Building a Post-Quantum PKI: How I Signed a Root CA and Sub CA Using ML-DSA on EJBCA

What This Lab Builds

A complete pure PQC PKI hierarchy running across two separate virtual machines, each with its own EJBCA container:

VM 1 — Root CA
  └─ ML-DSA-65 self-signed Root CA
  └─ CRL published and reachable

VM 2 — Sub CA
  └─ ML-DSA-65 Sub CA signed by Root CA
  └─ CRL published and reachable
  └─ OCSP responder active

Every certificate in the chain — Root CA, Sub CA — is signed exclusively with ML-DSA-65 (NIST FIPS 204). No RSA. No ECDSA. Pure PQC end to end.

Why ML-DSA-65

ML-DSA (formerly CRYSTALS-Dilithium) is the NIST-standardized post-quantum digital signature algorithm under FIPS 204. The Dilithium3 parameter set (ML-DSA-65) was selected for this lab — it provides 128-bit post-quantum security and is the recommended general-purpose option for most deployments.

Repository Structure

ejbca-pqc-lab/
├── README.md
├── root-ca/
│   └── setup-lab.sh     # Run on VM1 — sets up the Root CA machine
└── sub-ca/
    └── setup-lab.sh     # Run on VM2 — sets up the Sub CA machine

Prerequisites

• Two Linux VMs (Ubuntu 22.04 or 24.04 recommended)
• Both VMs on the same network and able to reach each other
• sudo access on both machines
• EJBCA Community Edition 9.3.7 or later (pulled automatically by the script)

Quick Start

VM 1 — Root CA Machine

chmod +x setup-lab.sh
sudo ./setup-lab.sh

Once complete, access the Admin UI at:

https://<VM1_IP>:8443/ejbca/adminweb/

Import superadmin.p12 from the container into your browser:

docker cp ejbca:/opt/ejbca/p12/superadmin.p12 ~/superadmin.p12

Default password: ejbca

Then follow the Medium article to configure the Root CA manually.

VM 2 — Sub CA Machine

chmod +x setup-lab.sh
sudo ./setup-lab.sh

Once complete, access the Admin UI at:

https://<VM2_IP>:8443/ejbca/adminweb/

Import superadmin.p12 the same way, then follow the Medium article to configure the Sub CA.

What the Script Does

1. Installs Docker
2. Installs Docker Compose
3. Creates a persistent ejbca-data volume
4. Generates docker-compose.yml
5. Starts the EJBCA container
6. Waits up to 5 minutes for EJBCA to initialize
7. Prints access URLs and next steps

What the Script Does NOT Do

All EJBCA configuration is done manually through the Admin UI — certificate profiles, crypto tokens, CA creation, CRL settings, and OCSP. This is intentional. The script gets the platform running. The Medium article documents every manual decision and why it was made.

Revocation Infrastructure

What Was Left Out and Why

ACME — The ACME protocol (RFC 8555) does not support ML-DSA for account key authentication. Only RSA and ECDSA are allowed. Including ACME would require a classical account key, breaking the pure PQC story. IETF is working on a PQC ACME draft. This lab will be updated when that is finalized.

Browser trust — No major browser trust store recognizes ML-DSA yet. This is a private PKI lab, not a publicly trusted hierarchy. That is expected and correct.

Author

Mohammad Amin Kokash Security Engineer GitHub · Medium

License

MIT