X Certificate and Key Management XCA 2.4.0 on Windows 10 |
| Developer(s) | Christian Hohnstädt (github/chris2511) [1] |
|---|
| Initial release | July 3, 2002; 22 years ago (2002-07-03) |
|---|
|
| Stable release | 2.4.0
/ May 7, 2021; 3 years ago (2021-05-07) |
|---|
|
|
| Written in | C++ |
|---|
| Operating system | |
|---|
| Platform | x86-64 |
|---|
| Type | Public Key Infrastructure |
|---|
| Website | hohnstaedt.de/xca/ |
|---|
X Certificate and Key management (XCA) is a free and open-source multi-platform GUI application intended for creating and/or managing X.509 certificates, certificate signing requests, private/public keys (RSA, DSA, and EC), smart cards (via PKCS #11), and certificate revocation lists (CRLs).[2][3]
Functionality
XCA has the following major features:[4]
- Generate and manage asymmetric private/public keys (RSA, DSA, and EC)
- Generate and manage X.509 certificates (including root and intermediate CA certificates) hierarchically
- Generate and process X.509 certificate signing requests (CSRs)
- Revoke previously issued certificates and generate certificate revocation lists (CRLs)
- Read, write, and delete certificates and keys from/to hardware tokens (e.g. smart cards or HSMs) using a PKCS #11 dynamically linked library provided by a third party.
- Sets of certificate hierarchies and keys are stored as a workspace in a database. Keys in the database are protected with password-based encryption.
- Can be controlled entirely via a graphical user interface that is generally considered easier to use than equivalent functionality provided by command-line applications such as OpenSSL.[5]
- Some operations are accessible over a command-line interface
Implementation
XCA is written mostly in C++. It relies on OpenSSL to handle cryptographic operations and data structures, and its user interface is implemented using the Qt framework.[6]
Usage
XCA has been endorsed (among others) by SUSE Linux,[3] Synopsys,[5] and Barracuda Networks.[7]
References
- ↑ "chris2511 (Christian Hohnstädt)". https://github.com/chris2511.
- ↑ "X Certificate and Key Management". Official website. https://hohnstaedt.de/xca/.
- ↑ 3.0 3.1 "Managing a PKI with XCA, X certificate and key manager". SUSE Linux. https://documentation.suse.com/sled/15-SP4/html/SLED-all/cha-security-xca.html.
- ↑ "Manual". Official website. https://hohnstaedt.de/xca/index.php/documentation/manual.
- ↑ 5.0 5.1 "Stop Paying For SSL Certificates You Don’t Need". Synopsys. https://www.synopsys.com/blogs/software-security/stop-paying-for-ssl-certificates/.
- ↑ "chris2511/xca: X Certificate and Key management". GitHub. https://github.com/chris2511/xca.
- ↑ "How to Create Certificates with XCA". Barracuda Networks. https://campus.barracuda.com/product/campus/doc/28475773/how-to-create-certificates-with-xca/.
External links
- Official website
- XCA on GitHub
TLS and SSL |
|---|
| Protocols and technologies |
- Transport Layer Security / Secure Sockets Layer (TLS/SSL)
- Datagram Transport Layer Security (DTLS)
- Server Name Indication (SNI)
- Application-Layer Protocol Negotiation (ALPN)
- DNS-based Authentication of Named Entities (DANE)
- DNS Certification Authority Authorization (CAA)
- HTTPS
- HTTP Strict Transport Security (HSTS)
- HTTP Public Key Pinning (HPKP)
- OCSP stapling
- Perfect forward secrecy
- STARTTLS
|
|---|
| Public-key infrastructure |
- Automated Certificate Management Environment (ACME)
- Certificate authority (CA)
- CA/Browser Forum
- Certificate policy
- Certificate revocation list (CRL)
- Domain-validated certificate (DV)
- Extended Validation Certificate (EV)
- Online Certificate Status Protocol (OCSP)
- Public key certificate
- Public-key cryptography
- Public key infrastructure (PKI)
- Root certificate
- Self-signed certificate
|
|---|
| See also |
- Domain Name System Security Extensions (DNSSEC)
- Internet Protocol Security (IPsec)
- Secure Shell (SSH)
|
|---|
| History |
- Export of cryptography from the United States
- Server-Gated Cryptography
|
|---|
| Implementations |
- Bouncy Castle
- BoringSSL
- Botan
- cryptlib
- GnuTLS
- JSSE
- LibreSSL
- MatrixSSL
- mbed TLS
- NSS
- OpenSSL
- RSA BSAFE
- S2n
- SChannel
- SSLeay
- stunnel
- wolfSSL
|
|---|
| Notaries |
- Certificate Transparency
- Convergence
- HTTPS Everywhere
- Perspectives Project
|
|---|
| Vulnerabilities | | Theory |
- Man-in-the-middle attack
- Padding oracle attack
|
|---|
| Cipher | |
|---|
| Protocol |
- BEAST
- BREACH
- CRIME
- DROWN
- Logjam
- POODLE (in regards to SSL 3.0)
|
|---|
| Implementation |
- Certificate authority compromise
- Random number generator attacks
- FREAK
- goto fail
- Heartbleed
- Lucky Thirteen attack
- POODLE (in regards to TLS 1.0)
- Kazakhstan MITM attack
|
|---|
|
|---|
 | Original source: https://en.wikipedia.org/wiki/X Certificate and Key management. Read more |