|
The OpenXPKI project aims at creating an enterprise-grade open-source PKI software. Flexibility and modularity are the project's key design objectives. Design OpenXPKI is mostly written in Perl. The software is separated into a server process and several client implementations which communicate with the server via Unix Domain Sockets. One of these client implementations is a web frontend that allows users to access the OpenXPKI system using a web browser. A different client implements a SCEP server. The OpenXPKI server mainly consists of a toolbox that provides the core cryptographic functions and a workflow engine that allows to define workflows implementing the PKI processes. Key features Multiple CA instances OpenXPKI supports the configuration of multiple independent logical PKIs (called "PKI Realms") in a single application instance. This allows for configuration, for example, of a Root CA and one or more subordinate CAs within a single installation. Fully automatic CA rollover Within a logical PKI (called "PKI Realm") OpenXPKI supports multiple Issuing CAs with overlapping validity. Once a new Issuing CA becomes valid it automatically takes over issuing new certificates. This feature allows for a fully automatic CA rollover where administrators do not have to take down and reconfigure the whole PKI installation once a CA certificate is about to expire. Workflow engine OpenXPKI utilizes a workflow engine that allows to modify and extend the basic operation of the PKI (e. g. certificate request and approval). Customizing the behaviour of the system is often accomplished by modifying the workflow description in XML format. The workflow engine makes it possible to extend the system with customized workflows. OpenXPKI includes some standard workflows e. g. for requesting X.509 Digital Certificates and issuing Certificate Revocation Lists that can easily be customized to model the actual PKI processes. Custom workflows can extend the PKI system, for example, to personalize SmartCards via a self service web frontend. Infrastructure key protection To protect the private keys of the certificate authority and its subsystems, OpenXPKI natively supports secret sharing via Shamir's Secret Sharing algorithm. An even higher security level can be achieved by protecting the private keys with a hardware security module. OpenXPKI currently supports nCipher's nShield hardware security module. Ticketing system integration OpenXPKI provides built-in integration with the RT Request Tracker. It can automatically create and link tickets in the ticketing system for incoming certificate requests and thus allows Registration Officers to keep track of their workload. Internationalization OpenXPKI fully supports Internationalization and localization of its interfaces. Alternative cryptography It is possible to extend the cryptographic backend for non-western cryptography. Support for Russian national algorithms (GOST) as an example of foreign cryptography is already included. System requirements OpenXPKI runs on most Unix-like operating systems (verified on FreeBSD, Linux, Solaris/OpenSolaris and Mac OS X). Database backends exist for MySQL, PostgreSQL, the Oracle Database and IBM DB2.
|
|
|