XiPKI
What it is
XiPKI is free, open-source public key infrastructure software for certification authority, registration authority, and OCSP responder functions, intended for critical infrastructure. It supports multiple CAs in one instance, database clusters, and active instances for the same CA, with management through embedded OSGi commands and an API. The CA gateway supports EST, SCEP, CMP, ACME, and XiPKI’s RESTful API. Its OCSP responder handles RFC 2560, RFC 6960, and the high-volume RFC 5019 profile, along with signed and unsigned requests, health checks, and multiple certificate-status sources. HSM connections use PKCS#11; the listed devices include AWS CloudHSM, Nitrokey, nCipher, Sansec, SoftHSM, TASS, Thales, and Utimaco. The project describes native support for ML-DSA, ML-KEM, and composite post-quantum algorithms. Requirements include Linux or macOS, Java 11 or later, and Tomcat 10 or 11. Listed databases include DB2, MariaDB, MySQL, Oracle, PostgreSQL, H2, and HSQLDB. XiPKI is available under Apache License 2.0. Users can download a setup archive from GitHub Releases or Maven Central, or build from source. For bug reports, the project requests test data, logs, version, operating system, Java runtime or development kit, and reproduction steps.
For and against
For
- Supports EST, SCEP, CMP, and ACME
- PKCS#11 enables HSM integration
- Supports multiple CAs in one instance
- Free under Apache License 2.0
Against
- Requires Java 11 or later
- Requires Tomcat 10 or 11
- Deployment requires Linux or macOS
The verdict
XiPKI offers a broad set of certificate authority and OCSP capabilities, including HSM integration and post-quantum algorithm support. Its operating requirements and infrastructure scope make it a fit for organizations prepared to deploy and manage PKI software.
Who it suits
XiPKI is aimed at organizations that need to operate CA, RA, and OCSP services, including critical infrastructure. It suits teams able to meet its Java, Tomcat, and database requirements.
Plans and prices
Apache License 2.0
Open-source software under Apache Software License, Version 2.0
Read 4 Oct 2026 · github.com
On the record
- CA management
- XiPKI supports multiple CAs in one software instance, database clusters, active instances for the same CA, and CA management through embedded OSGi commands and an API.github.com · read 4 Oct 2026
- Certificate protocols
- Its CA protocol gateway supports EST, SCEP, CMP, ACME, and XiPKI's own RESTful API.github.com · read 4 Oct 2026
- Database support
- Supported databases listed are DB2, MariaDB, MySQL, Oracle, PostgreSQL, H2, and HSQLDB.github.com · read 4 Oct 2026
- Downloads
- The setup archive can be downloaded from GitHub Releases or Maven Central, or built from source.github.com · read 4 Oct 2026
- HSM integrations
- It supports HSM integration through PKCS#11 and lists AWS CloudHSM, Nitrokey, nCipher, Sansec, SoftHSM, TASS, Thales, and Utimaco devices.github.com · read 4 Oct 2026
- Latest release
- The releases page lists v6.7.1 as the latest release, dated 2026/09/07.github.com · read 4 Oct 2026
- Maker
- The GitHub account identifies the project author as Lijun Liao, PhD, and lists Germany as the location.github.com · read 4 Oct 2026
- OCSP
- The OCSP responder supports RFC 2560 and RFC 6960, the lightweight high-volume profile in RFC 5019, signed and unsigned requests, health checks, and several certificate status sources including EJBCA databases.github.com · read 4 Oct 2026
- Operating requirements
- The project lists Linux and macOS, Java 11 or later, and Tomcat 10 or 11 as supported platform requirements.github.com · read 4 Oct 2026
- Post-quantum cryptography
- The project describes native support for ML-DSA, ML-KEM, and composite post-quantum algorithms.github.com · read 4 Oct 2026
- Purpose
- XiPKI is an open-source public key infrastructure system covering certification authority, registration authority, and OCSP responder functions, intended for critical infrastructure.github.com · read 4 Oct 2026
- Security and compliance
- The project says Bouncy Castle can be switched between LTS and FIPS variants to meet different compliance requirements, and lists eIDAS standards EN 319 411 and EN 319 412 support.github.com · read 4 Oct 2026
- Support
- The project directs users to open a GitHub issue and asks bug reports to include test data, logs, version, OS, JRE or JDK, and reproduction steps.github.com · read 4 Oct 2026
