Next Previous Contents

# XCA - X Certificate and key management

## (c) by Christian Hohnstädt, `christian@hohnstaedt.de`

August 2015 - Version 1.3.0

This application is intended for creating and managing X.509 certificates, certificate requests, RSA, DSA and EC private keys, Smartcards and CRLs. Everything that is needed for a CA is implemented. All CAs can sign sub-CAs recursively. These certificate chains are shown clearly. For an easy company-wide use there are customiseable templates that can be used for certificate or request generation. All crypto data is stored in an endian-agnostic file format portable across operating systems.

## 1. Introduction

- 1.1 File Formats
- 1.2 Further Reading
- 1.3 Copyright
- 1.4 Credits

## 2. Misc

- 2.1 Updating from Older Versions (Older than 0.6.0)
- 2.2 Download
- 2.3 DH Parameters

## 3. Command Line Options

- 3.1 Extracting items

## 4. Common Actions

- 4.1 Column Handling
- 4.2 Importing items
- 4.3 Details of an Item
- 4.4 Renaming an Item
- 4.5 Deleting Items
- 4.6 Searching Items

## 5. The Certificate Input Dialog

- 5.1 Source
- 5.2 Personal Settings
- 5.3 X509v3 Extensions

## 6. Smartcards (Security Tokens)

- 6.1 Key Management on the Token
- 6.2 The Token Menu

## 7. RSA, DSA and EC Keys

- 7.1 Generating Keys
- 7.2 Key Export

## 8. Certificate Signing Requests

- 8.1 Generating a new Request
- 8.2 Request Export
- 8.3 Request Transformation
- 8.4 Request Details

## 9. Certificates

- 9.1 CA certificates
- 9.2 Generating certificates
- 9.3 Certificate details
- 9.4 Certificate trust
- 9.5 Certificate Export
- 9.6 Certificate Transformation
- 9.7 Certificate revocation
- 9.8 Certificate renewal
- 9.9 CA special functions

## 10. Templates

## 11. Certificate Revocation Lists

- 11.1 Generation of Certificate revocation lists

## 12. Options

- 12.1 String settings
- 12.2 Default hash algorithm
- 12.3 Suppress success messages
- 12.4 Don't colorize expired certificates
- 12.5 Translate established x509 terms
- 12.6 Only use hashes supported by the token when signing with a token key
- 12.7 Disable legacy Netscape extensions
- 12.8 Mandatory subject entries
- 12.9 Explicit subject entries
- 12.10 PKCS#11 provider

## 13. Object IDs

## 14. Step by Step guides

- 14.1 Setting up a Root CA Certificate
- 14.2 Creating a CA-Signed Host Certificate
- 14.3 Creating a Self-Signed Host Certificate
- 14.4 Setting Up A Template
- 14.5 Revoking a Certificate issued by a CA

## 15. Appendix

- 15.1 PEM
- 15.2 SPKAC

Next Previous Contents