Personally, I used the openssl tools to generate a complete set of pki, and then I found that the function of xca this based on openssl but even more a bit more powerful than the openssl this tool,
I use it to generate a complete set of PKI (root certificate, the CA 2, level 3 CA, final entity certificate, and all levels of CA CRL), certificate of property also fill the OCSP server address, test after signature can also show the effectiveness and strict but xca validity checking minimum support only two days, I want to ask next everybody has what method can real-time check the validity of the certificate,
I shall be revoked the certificate of the four, for example, up to four 01 client will show certificate has been revoked,