Next Previous Contents

15. Step by Step guides

Beginners may follow these steps to easily create their first certificates. This guide shows the minimal requirements for various tasks. For more advanced use of XCA, users are encouraged to familiarize themselves with the applicable standards.

15.1 Setting up a Root CA Certificate

  1. Click the Certificates tab.
  2. Click the New Certificate button.
  3. Make sure the Source tab is showing, clicking it if necessary.
  4. Click the Subject tab.
  5. Click the Extensions tab.
  6. Click the OK button at the bottom.

You may wish to now issue an (initially) empty CRL. Follow the instructions given for issuing CRLs below, except that you do not actually revoke any certificate.

15.2 Creating a CA-Signed Host Certificate

  1. Click the Certificates tab.
  2. Click the New Certificate button.
  3. Make sure the Source tab is showing, clicking it if necessary.
  4. Click the Subject tab.
  5. Click the Extensions tab.
  6. Click the OK button at the bottom

15.3 Creating a Self-Signed Host Certificate

This procedure is almost identical to that of creating a CA-Signed certficate with the following exceptions:

  1. When creating certificate, select "Create a self signed certificate" under the Source tab.
  2. Self-signed certificates cannot be revoked, so the CRL URI should be blank.

15.4 Setting Up A Template

If you have, or expect to have, multiple hosts under one domain and signed by the same root certificate, then setting up a template for your hosts can simplify host certificate creation and improve consistency.

  1. Click on the Templates tab.
  2. Click on the New template button
  3. Select an appropriate value for the Preset Template Values, then click OK
  4. Under the Subject tab, specify an internal name for the template.
  5. Fill in (or modify) any values that you wish to be populated when using the template. Leave the rest blank (notably the "Common Name" field).
  6. When all desired fields are filled in, click the OK tab at the bottom of the window.

Your template is now ready for use when creating new certificates.

15.5 Revoking a Certificate issued by a CA

  1. Click the Certificates tab.
  2. Right-click on the certificate that you want to revoke and select Revoke
  3. Right-click the CA certificate that was used to sign the certificate being revoked. Select CA --> Generate CRL
  4. Click the OK button in the Create CRL dialog.
  5. Click on the Revocation lists tab in the main window.
  6. Right-click on the CRL you just generated and select Export. Select the desired format (probably PEM) and click OK
  7. Copy the exported CRL to the location published in the root certificate's CRL Distribution Points.
  8. Optionally, delete older CRLs for the same CA certificate.


Next Previous Contents