|Developer(s)||The OpenXPKI Foundation|
|Operating system||Unix-like operating systems|
|Type||Public key infrastructure|
|License||Apache License V 2.0|
Search OpenXPKI on Amazon.
Other articles of the topic Free and open-source software : Wikimedia Foundation, SSH-MITM, Gede (software), Collabora Office, JBrout, Bimil, Creative Commons license
Some use of "" in your query was not closed by a matching "".Some use of "" in your query was not closed by a matching "".
The OpenXPKI project aims at creating an enterprise-grade open-source PKI software. Flexibility and modularity are the project's key design objectives.
OpenXPKI is mostly written in Perl. The software is separated into a server process and several client implementations which communicate with the server via Unix Domain Sockets.
One of these client implementations is a web frontend that allows users to access the OpenXPKI system using a web browser. A different client implements a SCEP server.
The OpenXPKI server mainly consists of a toolbox that provides the core cryptographic functions and a workflow engine that allows to define workflows implementing the PKI processes.
Multiple CA instances
OpenXPKI supports the configuration of multiple independent logical PKIs (called "PKI Realms") in a single application instance. This allows for configuration, for example, of a Root CA and one or more subordinate CAs within a single installation.
Fully automatic CA rollover
Within a logical PKI (called "PKI Realm") OpenXPKI supports multiple Issuing CAs with overlapping validity. Once a new Issuing CA becomes valid it automatically takes over issuing new certificates. This feature allows for a fully automatic CA rollover where administrators do not have to take down and reconfigure the whole PKI installation once a CA certificate is about to expire.
OpenXPKI utilizes a workflow engine that allows to modify and extend the basic operation of the PKI (e. g. certificate request and approval). Customizing the behaviour of the system is often accomplished by modifying the workflow description in XML format.
The workflow engine makes it possible to extend the system with customized workflows. OpenXPKI includes some standard workflows e. g. for requesting X.509 Digital Certificates and issuing Certificate Revocation Lists that can easily be customized to model the actual PKI processes. Custom workflows can extend the PKI system, for example, to personalize SmartCards via a self service web frontend.
Infrastructure key protection
To protect the private keys of the certificate authority and its subsystems, OpenXPKI natively supports secret sharing via Shamir's Secret Sharing algorithm.
An even higher security level can be achieved by protecting the private keys with a hardware security module. OpenXPKI currently supports nCipher's nShield hardware security module.
Ticketing system integration
OpenXPKI provides built-in integration with the RT Request Tracker. It can automatically create and link tickets in the ticketing system for incoming certificate requests and thus allows Registration Officers to keep track of their workload.
OpenXPKI fully supports Internationalization and localization of its interfaces.
It is possible to extend the cryptographic backend for non-western cryptography. Support for Russian national algorithms (GOST) as an example of foreign cryptography is already included.
OpenXPKI runs on most Unix-like operating systems (verified on FreeBSD, Linux, Solaris/OpenSolaris and Mac OS X). Database backends exist for MySQL, PostgreSQL, the Oracle Database and IBM DB2.
OpenXPKI has been used successfully in scenarios from performance testing up to enterprise level environments. Shortcomings are that it requires additional components to complete a certificate based authentication, including software for efficient certificate distribution.
- Lubin, Jake (25 February 2021). "What is OpenXPKI?". Security Boulevard. Retrieved 1 May 2021.
This article "OpenXPKI" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:OpenXPKI. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.