OpenCA PKI vs XiPKI
OpenCA PKI
openca.orgXiPKI
github.comSide by side
| Figure | OpenCA PKI | XiPKI |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | — |
| Web | Yes | — |
| Windows | Yes | — |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Public Key Infrastructure Software | 8.4 (#5) | 7.3 (#16) |
| CA management | The software provides a complete certification-authority management solution. | XiPKI supports multiple CAs in one software instance, database clusters, active instances for the same CA, and CA management through embedded OSGi commands and an API. |
| Database support | The guide documents PostgreSQL, MySQL, Oracle and DBM database back ends. | Supported databases listed are DB2, MariaDB, MySQL, Oracle, PostgreSQL, H2, and HSQLDB. |
| OCSP | OpenCA includes an OCSP responder component for certificate-status checking. | The OCSP responder supports RFC 2560 and RFC 6960, the lightweight high-volume profile in RFC 5019, signed and unsigned requests, health checks, and several certificate status sources including EJBCA databases. |
| Purpose | OpenCA PKI is an open source, out-of-the-box Certification Authority for setting up and managing a PKI. | XiPKI is an open-source public key infrastructure system covering certification authority, registration authority, and OCSP responder functions, intended for critical infrastructure. |
| Support | The project describes community support through mailing lists, forums, and online chat, and mentions paid support from independent third parties. | The project directs users to open a GitHub issue and asks bug reports to include test data, logs, version, OS, JRE or JDK, and reproduction steps. |
Plans
In their own words
OpenCA PKI
OpenCA PKI is free, open-source software for establishing and managing a public key infrastructure, with an out-of-the-box Certification Authority. It is intended for on-premises deployment and is listed for Linux, macOS, self-hosted, and web environments. The project says it implements commonly used protocols with full-strength cryptography; listed capabilities include SCEP support, HSM integration, and certificate profiles. The download page lists OpenCA PKI (SpecialK) version 1.5.1. Installation requires other software, including OpenLDAP, OpenSSL, Apache, and Apache mod_ssl, and OpenCA Tools version 1.3.0 is listed as a prerequisite to install first. The project dates to 1998 and describes its work as volunteer-driven and managed through collaboration and consensus. Community support is available through mailing lists, forums, and online chat; independent third parties offer paid support. Security concerns can be reported privately by email or publicly through the project issue trackers. The documentation page says downloadable documentation is unavailable and notes that the OpenCA Guide for version 0.9.2 is outdated in some parts.
XiPKI
XiPKI is an open-source public key infrastructure system for certification authority, registration authority, and OCSP responder functions, aimed at critical infrastructure. It supports multiple CAs in one instance, database clusters, and active instances for the same CA, with management through embedded OSGi commands and an API. Its CA gateway supports EST, SCEP, CMP, ACME, and its RESTful API. The OCSP responder handles RFC 2560, RFC 6960, and RFC 5019, along with signed and unsigned requests, health checks, and multiple certificate status sources. HSM connections use PKCS#11; listed devices include AWS CloudHSM, Nitrokey, nCipher, Sansec, SoftHSM, TASS, Thales, and Utimaco. The project describes native support for ML-DSA, ML-KEM, and composite post-quantum algorithms. XiPKI is free under Apache License 2.0. It supports Linux and macOS and requires Java 11 or later and Tomcat 10 or 11. Listed databases include DB2, MariaDB, MySQL, Oracle, PostgreSQL, H2, and HSQLDB.