# How to use external PKI **URL:** \ **Category:** Gateway\ **Created:** [April 20, 2011, 5:57pm UTC](https://community.ciphermail.com/t/how-to-use-external-pki/180 "2011-04-20T17:57:35Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Manuel\_Faux](https://avatars.discourse-cdn.com/v4/letter/m/50afbb/32.png) [@Manuel\_Faux](https://community.ciphermail.com/u/Manuel_Faux)\ **Post date:** [April 20, 2011, 5:57pm UTC](https://community.ciphermail.com/t/how-to-use-external-pki/180/1 "2011-04-20T17:57:35Z")
Hello, I have an existing PKI outside of Djigzo. So I've created a Sub-CA and imported this CA incl. SKs into Djigzo. As far I understood the documentation, Djigzo does not support CRL-Generation, but the Documentation recommends using a full-blown CA like EJBCA instead. Has anyone ever used Djigzo in such a scenario? What is the recommended way to issue and to revoke certificates? I came up with the idea about writing an additional RequestHandler, which uses the EJBCA-API to issue the certificates, but is this necessary? Kind regards, Manuel Faux ---
**Author:** ![martijn](https://dub1.discourse-cdn.com/flex017/user_avatar/community.ciphermail.com/martijn/32/127_2.png) [@martijn](https://community.ciphermail.com/u/martijn)\ **Post date:** [April 20, 2011, 6:27pm UTC](https://community.ciphermail.com/t/how-to-use-external-pki/180/2 "2011-04-20T18:27:19Z")
Djigzo can generate CRLs, click CA en then click on "Create CRL". Only if you need a more advanced CA, like multiple CAs, use different key usage, use your own extensions etc. it's better to use an external CA. Kind regards, Martijn > **···** > > On 04/20/2011 07:57 PM, Manuel Faux wrote: > > > Hello, > > > > I have an existing PKI outside of Djigzo. So I've created a Sub-CA and imported this CA incl. SKs into Djigzo. As far I understood the documentation, Djigzo does not support CRL-Generation, but the Documentation recommends using a full-blown CA like EJBCA instead. > > Has anyone ever used Djigzo in such a scenario? What is the recommended way to issue and to revoke certificates? I came up with the idea about writing an additional RequestHandler, which uses the EJBCA-API to issue the certificates, but is this necessary? > > -- > Djigzo open source email encryption ---
**Author:** ![Manuel\_Faux](https://avatars.discourse-cdn.com/v4/letter/m/50afbb/32.png) [@Manuel\_Faux](https://community.ciphermail.com/u/Manuel_Faux)\ **Post date:** [April 20, 2011, 6:33pm UTC](https://community.ciphermail.com/t/how-to-use-external-pki/180/3 "2011-04-20T18:33:31Z")
Ok, in this case I misunderstood the documentation. It only states that CRLs for CA and Sub-CAs are not implemented. Thank's for your answer. Kind regards, Manuel Faux > **···** > > -----Original Message----- > From: users-bounces(a)lists.djigzo.com [mailto:users-bounces(a)[lists.djigzo.com](http://lists.djigzo.com)] On Behalf Of Martijn Brinkers > Sent: Wednesday, April 20, 2011 8:27 PM > To: users(a)lists.djigzo.com > Subject: Re: How to use external PKI > > On 04/20/2011 07:57 PM, Manuel Faux wrote: > > > Hello, > > > > I have an existing PKI outside of Djigzo. So I've created a Sub-CA and imported this CA incl. SKs into Djigzo. As far I understood the documentation, Djigzo does not support CRL-Generation, but the Documentation recommends using a full-blown CA like EJBCA instead. > > Has anyone ever used Djigzo in such a scenario? What is the recommended way to issue and to revoke certificates? I came up with the idea about writing an additional RequestHandler, which uses the EJBCA-API to issue the certificates, but is this necessary? > > Djigzo can generate CRLs, click CA en then click on "Create CRL". > > Only if you need a more advanced CA, like multiple CAs, use different key usage, use your own extensions etc. it's better to use an external CA. > > Kind regards, > > Martijn > > -- > Djigzo open source email encryption