Next Previous Contents

# XCA - X Certificate and key management

## (c) by Christian Hohnstädt, `christian@hohnstaedt.de`

April 2020 - Version 2.3.0

This application is intended for creating and managing X.509 certificates, certificate requests, RSA, DSA and EC private keys, Smart-cards and CRLs. Everything that is needed for a CA is implemented. All CAs can sign sub-CAs recursively. These certificate chains are shown clearly. For an easy company-wide use there are customisable templates that can be used for certificate or request generation. All cryptographic data is stored in a SQL database. SQLite, MySQL (MariaDB), PostgreSQL and MicrosoftSQL (ODBC) databases are supported.

## 1. Introduction

- 1.1 File Formats
- 1.2 Further Reading
- 1.3 Copyright
- 1.4 Credits

## 2. Miscellaneous

- 2.1 Updating from versions earlier than 2.0.0
- 2.2 Download
- 2.3 DH Parameters
- 2.4 Entropy sources for XCA

## 3. Command Line Options

- 3.1 Extracting items

## 4. Common Actions

- 4.1 Column Handling
- 4.2 Importing items
- 4.3 Details of an Item
- 4.4 Renaming an Item
- 4.5 Deleting Items
- 4.6 Searching Items
- 4.7 Date and source of appearance
- 4.8 Comments
- 4.9 Database primary key

## 5. The Certificate Input Dialog

- 5.1 Source
- 5.2 Personal Settings
- 5.3 X509v3 Extensions

## 6. Smart-cards (Security Tokens)

- 6.1 Key Management on the Token
- 6.2 The Token Menu

## 7. RSA, DSA and EC Keys

- 7.1 Generating Keys
- 7.2 Key Export

## 8. Certificate Signing Requests

- 8.1 Generating a new Request
- 8.2 Request Export
- 8.3 Request Transformation
- 8.4 Request Details

## 9. Certificates

- 9.1 CA certificates
- 9.2 Generating certificates
- 9.3 Certificate details
- 9.4 Certificate Export
- 9.5 Certificate Transformation
- 9.6 Certificate revocation
- 9.7 Certificate renewal
- 9.8 CA special functions

## 10. Templates

## 11. Certificate Revocation Lists

- 11.1 Generation of Certificate revocation lists

## 12. Options

- 12.1 String settings
- 12.2 Default hash algorithm
- 12.3 Suppress success messages
- 12.4 Don't colorize expired certificates
- 12.5 Translate established x509 terms
- 12.6 Only use hashes supported by the token when signing with a token key
- 12.7 Disable legacy Netscape extensions
- 12.8 Mandatory subject entries
- 12.9 Explicit subject entries
- 12.10 PKCS#11 provider

## 13. Object IDs

- 13.1 New OIDs
- 13.2 OID lists
- 13.3 Adding your company specific Subject entry

## 14. Step by Step guides

- 14.1 Setting up a Root CA Certificate
- 14.2 Creating a CA-Signed Host Certificate
- 14.3 Creating a Self-Signed Host Certificate
- 14.4 Setting Up A Template
- 14.5 Revoking a Certificate issued by a CA

## 15. Appendix

- 15.1 PEM

Next Previous Contents