XCA

XCA stands for X Certificate and Key management and is an open-source graphical application designed to manage X.509 certificates, private keys, certificate signing requests (CSRs), and certificate revocation lists (CRLs). It functions as a front end to cryptographic libraries such as OpenSSL, providing a centralized database to organize PKI material and related operations. The project aims to simplify the creation, signing, and management of certificates and keys for both testing and production environments.

The software allows users to generate cryptographic keys (including RSA and elliptic curve types), create CSRs, and issue or sign certificates within a managed CA hierarchy that can include a root CA and intermediate CAs. It supports handling various certificate extensions, such as Basic Constraints, Key Usage, Extended Key Usage, Subject Alternative Name, Authority Key Identifier, and Subject Key Identifier, enabling detailed control over certificate properties and trust relationships. Users can manage trust stores, revoke certificates, and export or import items in common formats.

Data in XCA is stored in a dedicated database within the application, facilitating organization and portability of certificates, keys, CSRs, and CRLs. It supports exporting and importing standard encodings such as PEM, DER, and PKCS#12 bundles, and can generate files suitable for distribution or backup. The tool prioritizes local control of PKI assets and is adaptable for internal enterprise use, testing environments, or educational purposes.

XCA is cross-platform, running on Windows, Linux, and macOS. It is distributed under the GNU General Public License and relies on the Qt toolkit for its user interface, with OpenSSL providing cryptographic functionality. The project is maintained by a community of volunteers and remains a widely used option for managing certificates and keys outside of commercial PKI products.