.TH XCA 1 .SH NAME .B xca \- X Certificate and key management .br A GUI for handling X509 certificates, RSA/DSA/EC keys, PKCS#10 Requests and CRLs in Software and on Smartcards. .SH SYNOPSIS .B xca .RI [ OPTIONS ] .br .SH "DESCRIPTION" This application is intended as CA, certificate- and Key store. It uses a SQL database to store the items. By default this is SQLite3, but MySQL and PostrgreSQL are also tested and supported. Known types are Certificate signing requests (PKCS#10), Certificates (X509v3), RSA, DSA and EC keys and Certificate revocation lists. The signing of requests, and the creation of self-signed certificates is supported. Both can use templates for simplicity. The PKI structures can be imported and exported in several formats like PKCS#12, PEM, DER, PKCS#8, PKCS#7. .br XCA enables users to manage smartcards via the PKCS#11 interface .SH OPTIONS .TP .B \-\-crlgen= * Generate CRL for . Use the 'name' option to set the internal name of the new CRL. .TP .B \-\-database= File name (*.xdb) of the SQLite database or a remote database descriptor: [user@host/TYPE:dbname#prefix]. .TP .B \-\-exit Exit after importing items. .TP .B \-\-help Print this help and exit. .TP .B \-\-hierarchy= * Save OpenSSL index hierarchy in . .TP .B \-\-index= * Save OpenSSL index in . .TP .B \-\-import * Import all provided items into the database. .TP .B \-\-issuers * Print all known issuer certificates that have an associated private key and the CA basic constraints set to 'true'. .TP .B \-\-keygen= * Generate a new key and import it into the database. Use the 'name' option to set the internal name of the new key. The parameter has the format: '[RSA|DSA|EC]:[|]. .TP .B \-\-list-curves Prints all known Elliptic Curves. .TP .B \-\-name= * Provides the name of new generated items. An automatic name will be generated if omitted. .TP .B \-\-no-gui Do not start the GUI. Alternatively set environment variable XCA_NO_GUI=1 or call xca as 'xca-console' symlink. .TP .B \-\-password= Database password for unlocking the database. .TP .B \-\-pem Print PEM representation of provided files. Prints only the public part of private keys. .TP .B \-\-print Print a synopsis of provided files. .TP .B \-\-sqlpass= Password to access the remote SQL server. .TP .B \-\-text Print the content of provided files as OpenSSL does. .TP .B \-\-verbose Print debug log on stderr. Alternatively set the environment variable XCA_DEBUG=1. .TP .B \-\-version Print version information and exit. .br .TP Options marked with an asterisk need a database. Either from the commandline or as default database. .SH PASS PHRASE ARGUMENTS The password options accept the same syntax as openssl does: .TP .B env:var Obtain the password from the environment variable var. Since the environment of other processes is visible on certain platforms (e.g. ps under certain Unix OSes) this option should be used with caution. .TP .B fd:number Read the password from the file descriptor number. This can be used to send the data via a pipe for example. .TP .B file:pathname The first line of pathname is the password. If the same pathname argument is supplied to password and sqlpassword arguments then the first line will be used for both passwords. pathname need not refer to a regular file: it could for example refer to a device or named pipe. .TP .B pass:password The actual password is password. Since the password is visible to utilities (like 'ps' under Unix) this form should only be used where security is not important. .TP .B stdin Read the password from standard input. .SH SEE ALSO A more detailed HTML documentation can be found in the doc directory, in the "Help" menu of the application or on https://hohnstaedt.de/documentation .SH AUTHOR This manual page was written by Christian Hohnstaedt