Import and Sign CSR via Command Line

[lunakoa]

Trying to find a faster way to sign CSR. Are there command line ways to sign a certificate when XCA is the CA? One way I have thought of was to export the key and sign using openssl then importing the crt into XCA, the issue there is the Serial number, not sure who XCA determines the serial number.

Was hoping to create a way from linux hosts to create the CSR and send it to XCA and have it sign and import it all via command line.

Any challenges or security issues I am not thinking of?

[xsten]

Not too sure I will answer your question, but maybe I can help (or maybe you can help me).

Importing using CLI is done with "xca --import" option. The doc says it is used to import "items" into database.
According to database schema, an "item" is a certificate, a CRL, a key, ...

I am trying to use this option to import key generated outside XCA. Unfortunately, import fails with the message :

Error: "Not an XCA Template, but 'ENCRYPTED PRIVATE KEY'"

From XCA sourcecode, I guess that I should not send my private key, but an "xca template", which is a rather obscure structure looking like this :
`00000000 00 00 03 b4 00 00 00 0a 30 00 00 00 00 1e 00 00 |........0.......|

00000010 00 14 00 4f 00 43 00 53 00 50 00 73 00 74 00 61 |...O.C.S.P.s.t.a|

00000020 00 70 00 6c 00 65 00 00 00 02 00 30 00 00 00 0e |.p.l.e.....0....|

00000030 00 61 00 64 00 76 00 5f 00 65 00 78 00 74 00 00 |.a.d.v._.e.x.t..|

00000040 00 00 00 00 00 14 00 61 00 75 00 74 00 68 00 49 |.......a.u.t.h.I|

00000050 00 6e 00 66 00 41 00 63 00 63 00 00 00 00 00 00 |.n.f.A.c.c......|

00000060 00 0e 00 61 00 75 00 74 00 68 00 4b 00 65 00 79 |...a.u.t.h.K.e.y|

00000070 00 00 00 02 00 31 00 00 00 12 00 62 00 61 00 73 |.....1.....b.a.s|

00000080 00 69 00 63 00 50 00 61 00 74 00 68 00 00 00 00 |.i.c.P.a.t.h....|

00000090 00 00 00 14 00 62 00 63 00 43 00 72 00 69 00 74 |.....b.c.C.r.i.t|
...`

soooo... I did not find a way to import anything in XCA with "--import" option, but maybe those clues will help you.

Ofc, If I find the solution to this problem, I will post it on this thread.

[xsten]

Replying my own post...

Import is working - but I could not make it work with aes-256 encrypted keys (xca fails "main DB open failed: 2" - but I am not on the latest version of XCA...)

Here are the command lines to generate key and csr with openssl and import them into an xca database :

openssl genrsa -out mykey.pem 2048
openssl req -new -key mykey.pem -out mycsr.pem -config openssl_mtls.cnf # you'll have to write a your openssl cnf file

xca.exe --no-gui --database=$DBUSER@$DBHOST/$DBTYPE:$DBNAME --sqlpass="$SQLPASSWORD" --password="$DBPASSWORD" --import mykey.pem --import-names mykey

xca.exe --no-gui --database=$DBUSER@$DBHOST/$DBTYPE:$DBNAME --sqlpass="$SQLPASSWORD" --password="$DBPASSWORD" --import mycsr.pem --import-names mycsr

Enjoy