security/p5-openxpki-clca 1.22 DragonFly

Toolkit for basic PKI operations in small CA like root CA

System: DragonFly
Repository: DPorts
Maintainer: [email protected] (as in FreeBSD)
License: GPLv2
Categories: perl5, security
Package size: 38.8 KiB, 178.2 KiB installed

Description

Command Line Certificate Authority (clca) is a collection of tools (written in Bash and Perl atop of OpenSSL or LibreSSL) that allow for basic PKI operations such as Sub CA certificate issuance (signing certificate requests), certificate revocation and CRL issuance. Originally designed to be used for a Root CA, it may also be used for lower level CAs or even end entity certificates as well.

Ideal solution for off-line low-traffic CA, residing on a notebook, which is most of the time kept in a vault.

CA private keys can be held either in encrypted files (encrypted either with a simple passphrase or using Shamir's Secret Sharing) or stored in an HSM.

Port security/p5-openxpki-clca is an overly lightweight command-line alternative to its elder brother, a full-featured server-born port security/p5-openxpki designed for universal PKI solutions. These two ports are mutually independent and can coexist on the same host.

In the other systems

The newest version among them is 1.23, as upstream numbers it.

System

Port

Version

Vulnerabilities

Status

Maintainer

Last update

DragonFly

security/p5-openxpki-clca

1.22 behind since 2026-10-10

none known

[email protected]

FreeBSD

security/p5-openxpki-clca

1.23 newest

none known

[email protected]

2026-10-10

HardenedBSD

security/p5-openxpki-clca

1.23 newest

no data

[email protected]

GhostBSD

security/p5-openxpki-clca

1.23 newest

no data

[email protected]

Version history 1

1.22 2026-11-11

Upstream's version as each commit to the port's Makefile set it, or as this site first saw it in the system's packages; the tree's own revisions are not versions here.

Install

Binary package:

pkg install p5-openxpki-clca

From DPorts:

cd /usr/dports/security/p5-openxpki-clca && make install clean

Dependency graph

Ports that need it on the left, what it needs to run on the right; at most 8 of each. "Dependencies" below lists them all.

graph LR
  me["security/p5-openxpki-clca"]
  me --> d0["devel/p5-Class-Std"]
  me --> d1["lang/perl5.42"]
  me --> d2["security/openssl"]
  me --> d3["shells/bash"]
  me --> d4["textproc/p5-Regexp-Common"]
  me --> d5["textproc/p5-YAML"]
  me --> d6["www/p5-Template-Toolkit"]
  classDef this fill:#ab2b28,color:#ffffff,stroke:#ab2b28
  class me this

Dependencies

Run dependencies 7

No port depends on this one.

Configuration

No options to configure.

Service scripts: none

Message after installing

- Create root directory for your root certificate authority (CA),
    e.g. "/ca_home":
    mkdir -p /ca_home/private
- Publish it in your environment as CA_HOME (this name is fixed):
    e.g. export CA_HOME=/ca_home
- Populate it as:
    cp -pR /usr/local/share/examples/openxpki-clca/ /ca_home
    cp -pR /usr/local/share/doc/openxpki-clca/ /ca_home
- Follow advice at:
    /ca_home/*.md (patched for FreeBSD) or
    https://github.com/openxpki/clca (for original Debian Linux)
- Revise your configuration in 
    /ca_home/etc/*
    /ca_home/bin/*
- Run main interactive Bash script of this port as follows:
    cd /ca_home
    bin/clca
- This port/package installs some scripts into /usr/local/bin:
    clca, change-quorum.sh, provision,secret
    Sometime it is convenient to run them from your root ca directory /ca_home,
    as they are in your PATH. But beware of confusing them with scripts, which
    are located in /ca_home/bin/*.
- Use of OpenSSL or LibreSSL
  = This package comes (from FreeBSD build cluster) bound with 
  openssl from base system, cf: /usr/ports/Mk/Uses/ssl.mk
  If you want to use openssl or libressl from ports instead, then:
    1) add the name of respective port 
       (openssl, openssl30, openssl31, libressl, libressl-devel...)
       to /etc/make.conf file e.g. like this:
       DEFAULT_VERSIONS+= ssl=openssl31
    2) install security/openssl31
    3) cd /usr/ports/security/p5-openxpki-clca && make reinstall
       you do not need to rebuild dependencies, installed from packages.
    4) repeat steps above for re-population of root directory and revising
        configuration.
	5) If your system has more that one installation of openssl/libressl, you
		may want to create a symlink (early in the path) to your preferred
		openssl binary. Check your working copy of openssl with:
			which openssl
			openssl version
	6) Revise again your configuration in 
		/ca_home/etc/*
		/ca_home/bin/*
  = Using versions OpenSSL 1.0 or less can restrict features of this port.
  = This port builds just fine with any available versions of OpenSSL or 
    LibreSSL. But its operation with LibreSSL or OpenSSL 3.1+ has not been fully
	tested. Report your respective story to the list
      https://sourceforge.net/p/openxpki/mailman/
    or use OpenSSL 3.0 instead.
- If you choose to create (as docs advice) a new optional perl script in
  the /ca_home/bin directory, you may want to employ a construct like
    use FindBin;
    use lib "$FindBin::Bin/../lib";
  inside your script, so that perl modules from /ca_home/lib directory
  become available to your script if you need them to be.
- Note, that this software is optimized for use from autonomous device, when
  /ca_home directory is located on USB drive, which is extracted from computer
  after  work to be kept inside a steel vault.

If you update existing installation, repeat steps for re-population of root
directory and revising configuration. And please check if extra handwork 
is needed in your case:
    https://github.com/openxpki/clca