[jaas]

EJBCA is popular but it's hardly a monoculture, especially among the larger CAs that can afford to do their own thing. Let's Encrypt doesn't use it, and I'm pretty sure a significant number of the other bigger CAs don't.

[cheeze]

Well, it will come out who was using it since they will have to disclose this.

I don't think Digicert/Symantec are using it