📄 xca-6.html
字号:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"><HTML><HEAD> <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.21"> <TITLE>XCA : Certificates</TITLE> <LINK HREF="xca-5.html" REL=previous> <LINK HREF="xca.html#toc6" REL=contents></HEAD><BODY>Next<A HREF="xca-5.html">Previous</A><A HREF="xca.html#toc6">Contents</A><HR><H2><A NAME="s6">6.</A> <A HREF="xca.html#toc6">Certificates</A></H2><P>All Certificates from the database are displayed in a tree view reflecting the chain dependencies.If there is a CA certificate and several client certificates signed by this CA,the client certificates can be shown by clicking on the plus sign of the CA certificate.</P><H2><A NAME="ca_cert"></A> <A NAME="ss6.1">6.1</A> <A HREF="xca.html#toc6.1">CA certificates </A></H2><P>XCA recognizes your CA certificates if the CA flag in the <EM>Basic Constraints</EM> is set to trueand if there is a corresponding private key.In this case the <CODE>CA</CODE> submenu in the context-menu is enabled.</P><P>For building the chains the CA flag is disregarded instead it consideres the issuer name andthe signature to decide which certificate is the issuer.</P><H2><A NAME="ss6.2">6.2</A> <A HREF="xca.html#toc6.2">Generating certificates</A></H2><P>After clicking on the <CODE>New Certificate</CODE> button the Certificate Wizard will be started to askall needed information for generating a new Request. See: <A HREF="xca-3.html#wizard">Wizard</A>Certificate creation can also be invoked by the context menu of the certificate list backgroundor by the context menu of the request.In this case the Wizard is preset with the Request to be signedi.</P><P>If in the certificate list a <EM>CA certificate</EM> is selected, thiscertificate is preselected as signer certificate on the second page of the Wizard.</P><H2><A NAME="ss6.3">6.3</A> <A HREF="xca.html#toc6.3">Certificate details</A></H2><P>The signer is the internal name of the issuers certificate, <EM>SELF SIGNED</EM> if it isself signed or <EM>SIGNER UNKNOWN</EM> if the issuers certificate is not available.The validity is set to <EM>valid</EM> if the certificate dates are validor to <EM>Not valid</EM> if the are not, regarding the internal time and date of the OS.</P><P>If the certificate was revoked, the revocation date is shown instead.</P><H2><A NAME="ss6.4">6.4</A> <A HREF="xca.html#toc6.4">Certificate trustment</A></H2><P>The certificate trustment can be changed by the context menu of the certificate.It can be set to:<UL><LI><B>Not trusted</B> - never trust this certificate, even if we trust the issuer. This is the default for imported self-signed certificates.</LI><LI><B>Trust depends on issuer</B> - only trust this certificate, if we trust theissuer. This is the default for imported and generated non-self-signed certificates.</LI><LI><B>Always trust</B> - always trust this certificate, even if we do not trustthe issuers certificate or if it is absent. This is the default for generated self-signed certificates.</LI></UL></P><H2><A NAME="ss6.5">6.5</A> <A HREF="xca.html#toc6.5">Certificate export</A></H2><P>The filename can be selected in the export dialog and the Export format:<UL><LI><B>PEM</B> - PEM encoded</LI><LI><B>PEM with Certificate chain</B> - PEM encoded certificate and all issuers up to theroot certificate in one file</LI><LI><B>PEM all trusted Certificates</B> - List of all PEM encoded certificatesthat are marked als <EM>Always trusted</EM> (usually all self-signed certificates)in one file for e.g. apache as trusted cert store.</LI><LI><B>PEM all Certificates</B> - All PEM encoded certificates in one file.</LI><LI><B>DER</B> - DER encoded certificate.</LI><LI><B>Signed PKCS#7</B> - PEM encoded PKCS#7 structure signed by the issuer.</LI><LI><B>PKCS#12</B> - PKCS#12 structure containing the certificate and the corresponding </LI><LI><B>PKCS#12</B> - PKCS#12 structure containing the certificate, the corresponding private key and the chain of all issuers certificates.</LI></UL></P><P>The PKCS#12 structures will be encrypted by the password you are asked for later.</P><H2><A NAME="ss6.6">6.6</A> <A HREF="xca.html#toc6.6">Certificate revokation</A></H2><P>Certificates only can be revoked, if the private key of the issuers certificateis available. The certificate will marked as revoked and the revokation datewill be stored with the certificate.</P><H2><A NAME="ss6.7">6.7</A> <A HREF="xca.html#toc6.7">Certificate renewal</A></H2><P>Certificates only can be renewed, if the private key of the issuers certificateis available. Renewal is done by creating a new certificate as a copy of the original onewith just adjusted validity dates.</P><H2><A NAME="ss6.8">6.8</A> <A HREF="xca.html#toc6.8">PKCS#7</A></H2><P>PKCS#7 structures can be created by the context menu of the signing certificate.The PKCS#7 structure can be either signed or encrypted. Therefore it will prompt for a file to be either signed or encrypted.The resulting file has the original filename with ".p7s" suffix.</P><H2><A NAME="ss6.9">6.9</A> <A HREF="xca.html#toc6.9">CA special functions</A></H2><P>The context menu of CA certificates does contain the <EM>CA</EM> submenu.that makes the following functions available:</P><P><UL><LI><B>Serial</B> The serial number of the next certificatesigned by this issuer.</LI><LI><B>CRL days</B> The days until the next CRL release.</LI><LI><B>Signing Template</B> The default template for signing certificates.</LI><LI><B>Generate CRL</B> Generate the CRL by collecting all revoked certificatesand their revokation date.</LI></UL></P><HR>Next<A HREF="xca-5.html">Previous</A><A HREF="xca.html#toc6">Contents</A></BODY></HTML>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -