At the time of writing (26 Feb 2008) EJBCA is approved classified under ECCN code 5D002 and approved for export under License Exception TSU. See The Bureau of Industry and Security website for further details. EJBCA actually has the same classification as the Bouncy Castle JCE provider, from which this FAQ text is a rip-off. Thanks BC!