If I can have ssh/pam authentication and have ssh retrieve
public key from LDAP that might be a consolatory price.
That is possible, but I don't think that's really what you are
trying to do. It really sounds like what you want to do is:
1) generate an ssh compatible cert (or pub/priv key pair) using your
existing cert that is issued by ejbca - that may be possible, but
you'll need to have the ssh cert signed by the ejbca - could be
difficult
or
2) use your regular x509 cert for ssh authentication - it doesn't
look as though ssh supports this although it's not clear from the
man page - would be a very good feature for ssh though