Skip to content
SPECIFICTION
Get listed

XiPKI

github.com

Free plan macOSLinuxAPISelf-hosted
Visit github.com
Spec score 7.3 #16 of 26 in Public Key Infrastructure Software

What it is

XiPKI is an open-source public key infrastructure system for certification authority, registration authority, and OCSP responder functions, aimed at critical infrastructure. It supports multiple CAs in one instance, database clusters, and active instances for the same CA, with management through embedded OSGi commands and an API. Its CA gateway supports EST, SCEP, CMP, ACME, and its RESTful API. The OCSP responder handles RFC 2560, RFC 6960, and RFC 5019, along with signed and unsigned requests, health checks, and multiple certificate status sources. HSM connections use PKCS#11; listed devices include AWS CloudHSM, Nitrokey, nCipher, Sansec, SoftHSM, TASS, Thales, and Utimaco. The project describes native support for ML-DSA, ML-KEM, and composite post-quantum algorithms. XiPKI is free under Apache License 2.0. It supports Linux and macOS and requires Java 11 or later and Tomcat 10 or 11. Listed databases include DB2, MariaDB, MySQL, Oracle, PostgreSQL, H2, and HSQLDB.

Spec sheet

Purpose
XiPKI is an open-source public key infrastructure system covering certification authority, registration authority, and OCSP responder functions, intended for critical infrastructure.Read 4 Oct 2026 · github.com
Support
The project directs users to open a GitHub issue and asks bug reports to include test data, logs, version, OS, JRE or JDK, and reproduction steps.Read 4 Oct 2026 · github.com
Maker
The GitHub account identifies the project author as Lijun Liao, PhD, and lists Germany as the location.Read 4 Oct 2026 · github.com
CA management
XiPKI supports multiple CAs in one software instance, database clusters, active instances for the same CA, and CA management through embedded OSGi commands and an API.Read 4 Oct 2026 · github.com
Certificate protocols
Its CA protocol gateway supports EST, SCEP, CMP, ACME, and XiPKI's own RESTful API.Read 4 Oct 2026 · github.com
Database support
Supported databases listed are DB2, MariaDB, MySQL, Oracle, PostgreSQL, H2, and HSQLDB.Read 4 Oct 2026 · github.com
Downloads
The setup archive can be downloaded from GitHub Releases or Maven Central, or built from source.Read 4 Oct 2026 · github.com
HSM integrations
It supports HSM integration through PKCS#11 and lists AWS CloudHSM, Nitrokey, nCipher, Sansec, SoftHSM, TASS, Thales, and Utimaco devices.Read 4 Oct 2026 · github.com
Latest release
The releases page lists v6.7.1 as the latest release, dated 2026/09/07.Read 4 Oct 2026 · github.com
OCSP
The OCSP responder supports RFC 2560 and RFC 6960, the lightweight high-volume profile in RFC 5019, signed and unsigned requests, health checks, and several certificate status sources including EJBCA databases.Read 4 Oct 2026 · github.com
Operating requirements
The project lists Linux and macOS, Java 11 or later, and Tomcat 10 or 11 as supported platform requirements.Read 4 Oct 2026 · github.com
Post-quantum cryptography
The project describes native support for ML-DSA, ML-KEM, and composite post-quantum algorithms.Read 4 Oct 2026 · github.com
Security and compliance
The project says Bouncy Castle can be switched between LTS and FIPS variants to meet different compliance requirements, and lists eIDAS standards EN 319 411 and EN 319 412 support.Read 4 Oct 2026 · github.com

Plans and prices

Apache License 2.0 Free Open-source software under Apache Software License, Version 2.0 Read 4 Oct 2026 · github.com

Every XiPKI plan and price →

Strong points and limits

Strong points

  • Supports EST, SCEP, CMP, and ACME.
  • Multiple CAs can run in one instance.
  • PKCS#11 HSM integration is supported.
  • Free under Apache License 2.0.
  • Supports Linux and macOS.

Limits

  • Requires Java 11 or later.
  • Requires Tomcat 10 or 11.
  • The project directs support requests to GitHub issues.

Who it suits

XiPKI suits organizations needing self-hosted certificate authority, registration authority, and OCSP services, particularly in critical infrastructure. Its requirements and broad protocol, database, and HSM support are relevant to teams managing their own PKI environment.

Verdict

XiPKI documents substantial protocol, deployment, database, and HSM details for a self-hosted PKI system. Its Java and Tomcat requirements are important to account for before deployment.

Where Specifiction places it

Alternatives to XiPKIAll alternatives →