Since XCA 0.8.0 the use of Smart cards is supported. It is based on the PKCS#11 standard. The Options dialog contains an input field to select a PKCS#11 library.
The default is /usr/lib/opensc-pkcs11.so
and opensc-pkcs11.dll
in the XCA installation path, depending on your OS.
Once again: This software comes with no warranty at all! If XCA transforms your smart card into a fridge, don't blame me. For me everything worked fine and I tested it thoroughly.
On Linux the packages opensc
and libengine-pkcs11-openssl
should be installed.
Please read the opensc documentation for more details.
Generally if the opensc commandline-tool "pkcs11-tool -L" shows reasonable output, XCA will work.
Otherwise fix the opensc setup.
I had a functional setup with a "Reiner SCT" and a DELL keyboard with integrated card reader and TCOS Netkey E4 cards.
Most probably other cards will work as least as good or better.
I had no luck on windows, yet (application crashed). I don't know if it is an XCA problem or a PKCS#11.dll one. Please report any success. Thanks.
Before the keys of a Smart-card can be used, they must be imported into XCA. This means that XCA reads the Smart-card and stores the card's manufacturer, serial and the public key into the database. It is not unusal that a card contains more than one key.
When selecting a Smart-card private key for signing, XCA verifies that the correct card is inserted.
The following actions with smart cards are supported:
You may ignore the built-in certificates of a Smart-card and create your own CA certificate, self-signed by your Smart-card and issue end-entity certificates containing other RSA, DSA or EC keys or sign imported certificate requests.