Next Previous Contents

14. Step by Step guides

Beginners may follow these steps to easily create their first certificates. This guide shows the minimal requirements for various tasks. For more advanced use of XCA, users are encouraged to familiarize themselves with the applicable standards.

14.1 Setting up a Root CA Certificate

  1. Click the Certificates tab.
  2. Click the New Certificate button.
  3. Make sure the Source tab is showing, clicking it if necessary.
  4. Click the Subject tab.
  5. Click the Extensions tab.
  6. The CRL distribtion point will be part of the issued certificates. It should however be thought about a common URL for all of them like http://www.example.com/crl/crl.der
  7. Click the OK button at the bottom.

You may wish to now issue an (initially) empty CRL. Follow the instructions given for issuing CRLs below, except that you do not actually revoke any certificate.

14.2 Creating a CA-Signed Host Certificate

  1. Click the Certificates tab.
  2. Click the New Certificate button.
  3. Make sure the Source tab is showing, clicking it if necessary.
  4. Click the Subject tab.
  5. Click the Extensions tab.
  6. Click the OK button at the bottom

14.3 Creating a Self-Signed Host Certificate

This procedure is almost identical to that of creating a CA-Signed certficate with the following exceptions:

  1. When creating certificate, select "Create a self signed certificate" under the Source tab.
  2. Self-signed certificates cannot be revoked, so the CRL URI should be blank.

14.4 Setting Up A Template

If you have, or expect to have, multiple hosts under one domain and signed by the same root certificate, then setting up a template for your hosts can simplify host certificate creation and improve consistency.

The values of templates can be applied on the first tab of the certificate-generation dialog. It can be selected, whether the subject, the extensions or both parts of the template will be applied. This way a subject-only template may be defined and later applied together with the HTTPS_client or HTTPS_server template.

  1. Click on the Templates tab.
  2. Click on the New template button
  3. Select an appropriate value for the Preset Template Values, then click OK
  4. Under the Subject tab, specify an internal name for the template.
  5. Fill in (or modify) any values that you wish to be populated when using the template. Leave the rest blank (notably the "Common Name" field).
  6. When all desired fields are filled in, click the OK button at the bottom of the window.

Your template is now ready for use when creating new certificates.

Alternatively, you may export an existing Certificate or Certificate signing request to a template by the Export-context menu of the item.

14.5 Revoking a Certificate issued by a CA

  1. Click the Certificates tab.
  2. Right-click on the certificate that you want to revoke and select Revoke
  3. Right-click the CA certificate that was used to sign the certificate being revoked. Select CA --> Generate CRL
  4. Click the OK button in the Create CRL dialog.
  5. Click on the Revocation lists tab in the main window.
  6. Right-click on the CRL you just generated and select Export. Select the desired format (probably DER) and click OK
  7. Copy the exported CRL to the location published in the issued certificate's CRL Distribution Points.
  8. Optionally, delete older CRLs for the same CA certificate.


Next Previous Contents