From fca7200e6d0bb3cd151c304bc233a5c049e9d761 Mon Sep 17 00:00:00 2001 From: chris Date: Tue, 17 Dec 2002 21:56:29 +0000 Subject: [PATCH] documentation extended --- doc/xca.sgml | 96 ++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 93 insertions(+), 3 deletions(-) diff --git a/doc/xca.sgml b/doc/xca.sgml index 76450094..cf04142c 100644 --- a/doc/xca.sgml +++ b/doc/xca.sgml @@ -144,6 +144,8 @@ Thank you very much. Common actions +

+Many actions are common to all crypto parts. Importing items

The import of an item can be done by either clicking the import button on the right @@ -156,11 +158,12 @@ The import function is smart enough to probe all known formats as there are: must be imported with an extra button, because they can contain more than one certificate) After selecting the filename XCA will probe for the known formats of that item -and in case of an error it prompts the last OpenSSL errormessage. +and in case of an error it prompts the last OpenSSL error message.

After reading the item it searches for this item in the database and if it is unique the item -is stored in the database, otherwise it shows a message containing the internal name of the item. +is stored in the database, otherwise it shows a message containing the internal name of the item +in the database. Details of an item

@@ -307,6 +310,9 @@ includes your personal information and your public key.

After clicking on the New Request button the Certificate Wizard will be started to ask all needed information for generating a new Request. See: +The request generation can also be invoked by the context menu of a certificate (Export->Request). +This menu point is only available if the private key of the certificate is available. +In this case all needed data is copied from the certificate and the Wizard is not invoked. Request export

@@ -333,15 +339,99 @@ the client certificates can be shown by clicking on the plus sign of the CA cert CA certificates

XCA recognizes your CA certificates if the CA flag in the Basic Constraints is set to true -and if there is a private key. In this case the CA submenu in the context-menu is enabled. +and if there is a corresponding private key. +In this case the CA submenu in the context-menu is enabled. +

For building the chains the CA flag is disregarded instead it consideres the issuer name and the signature to decide which certificate is the issuer. Generating certificates +

After clicking on the New Certificate button the Certificate Wizard will be started to ask all needed information for generating a new Request. See: +Certificate creation can also be invoked by the context menu of the certificate list background +or by the context menu of the request. +In this case the Wizard is preset with the Request to be signedi. +

+If in the certificate list a CA certificate is selected, this +certificate is preselected as signer certificate on the second page of the Wizard. +Certificate details +

+The signer is the internal name of the issuers certificate, SELF SIGNED if it is +self signed or SIGNER UNKNOWN if the issuers certificate is not available. +The validity is set to valid if the certificate dates are valid +or to Not valid if the are not, regarding the internal time and date of the OS. +

+If the certificate was revoked, the revocation date is shown instead. + +Certificate trustment +

+The certificate trustment can be changed by the context menu of the certificate. +It can be set to: + +Not trusted - never trust this certificate, even if we trust the issuer. +This is the default for imported self-signed certificates. +Trust depends on issuer - only trust this certificate, if we trust the +issuer. This is the default for imported and generated non-self-signed certificates. +Always trust - always trust this certificate, even if we do not trust +the issuers certificate or if it is absent. This is the default for generated +self-signed certificates. + + +Certificate export +

+The filename can be selected in the export dialog and the Export format: + +PEM - PEM encoded +PEM with Certificate chain - PEM encoded certificate and all issuers up to the +root certificate in one file +PEM all trusted Certificates - List of all PEM encoded certificates +that are marked als Always trusted (usually all self-signed certificates) +in one file for e.g. apache as trusted cert store. +PEM all Certificates - All PEM encoded certificates in one file. +DER - DER encoded certificate. +Signed PKCS#7 - PEM encoded PKCS#7 structure signed by the issuer. +PKCS#12 - PKCS#12 structure containing the certificate and the corresponding +PKCS#12 - PKCS#12 structure containing the certificate, the corresponding +private key and the chain of all issuers certificates. + +

+The PKCS#12 structures will be encrypted by the password you are asked for later. + +Certificate revokation +

+Certificates only can be revoked, if the private key of the issuers certificate +is available. The certificate will marked as revoked and the revokation date +will be stored with the certificate. + +Certificate renewal +

+Certificates only can be renewed, if the private key of the issuers certificate +is available. Renewal is done by creating a new certificate as a copy of the original one +with just adjusted validity dates. + +PKCS#7 +

+PKCS#7 structures can be created by the context menu of the signing certificate. +The PKCS#7 structure can be either signed or encrypted. +Therefore it will prompt for a file to be either signed or encrypted. +The resulting file has the original filename with ".p7s" suffix. + +CA special functions +

+The context menu of CA certificates does contain the CA submenu. +that makes the following functions available: + + +Serial The serial number of the next certificate +signed by this issuer. +CRL days The days until the next CRL release. +Signing Template The default template for signing certificates. +Generate CRL Generate the CRL by collecting all revoked certificates +and their revokation date. +