CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

security/p5-openxpki 3.24.2_1

Perl based trustcenter for PKI: universal server building block

Port info

Maintainer
svysh.fbsd@gmail.com
Packages
latest: 3.24.2_1
Upstream
up to date
Last update
to 3.24.2_1 · 5c97fbea8c
Quarterly
2026Q4: 3.24.2_1
WWW
https://www.openxpki.org/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install p5-openxpki
installs 3.24.2_1 from latest; from quarterly (2026Q4) 3.24.2_1
Port
# cd /usr/ports/security/p5-openxpki && make install clean
# make -C /usr/ports/security/p5-openxpki config  # change options first
Size
2.2 MiB download · 7.3 MiB installed
Depends on
archivers/p5-Archive-Zip 1.68, converters/p5-JSON 4.10, databases/p5-DBD-Mock 1.59_1, databases/p5-DBD-SQLite 1.76, databases/p5-DBIx-Handler 0.15, databases/p5-SQL-Abstract-More 1.44, devel/p5-Cache-LRU 0.04_1, devel/p5-Class-Accessor-Chained 0.01_2, devel/p5-Class-Std 0.013, devel/p5-Config-GitLike 1.18, devel/p5-Config-Merge 1.04_1, devel/p5-Config-Std 0.903, devel/p5-Connector 1.56, devel/p5-Data-Serializer 0.65, devel/p5-Data-UUID 1.227, devel/p5-DateTime-Format-DateParse 0.05_2, devel/p5-Devel-NYTProf 6.14, devel/p5-Feature-Compat-Try 0.05, devel/p5-IO-Prompt 0.997004, devel/p5-IPC-ShareLite 0.17_2, devel/p5-Import-Into 1.002005,1, devel/p5-Locale-libintl 1.37, devel/p5-Log-Log4perl-Layout-JSON 0.61, devel/p5-Moose 2.4001,1, devel/p5-MooseX-InsideOut 0.106_2, devel/p5-MooseX-NonMoose 0.27, devel/p5-MooseX-Params-Validate 0.21, devel/p5-MooseX-StrictConstructor 0.21, devel/p5-Path-Class 0.37, devel/p5-Proc-Daemon 0.23, devel/p5-Proc-ProcessTable 0.637, devel/p5-Proc-SafeExec 1.5_1, devel/p5-Sys-SigAction 0.24, devel/p5-Test-Pod 1.52, devel/p5-Test-Pod-Coverage 1.10_2, devel/p5-TimeDate 2.35,1, devel/p5-Workflow 2.11, dns/p5-Net-DNS 1.57,1, lang/p5-Switch 2.17_1, lang/perl5.42 5.42.3, mail/p5-Mail-RFC822-Address 0.3_1, net-mgmt/p5-Net-IP 1.26_1, net-mgmt/p5-NetAddr-IP 4.079, net/p5-Net-Server 2.014, net/p5-SOAP-Lite 1.27, net/p5-perl-ldap 0.6800, security/p5-Crypt-Argon2 0.032, security/p5-Crypt-CBC 3.07, security/p5-Crypt-JWT 0.038, security/p5-Crypt-OpenSSL-AES 0.23, security/p5-Crypt-PKCS10 2.005,1, security/p5-Crypt-Rijndael 1.16, security/p5-Crypt-SMIME 0.31, security/p5-Crypt-SSLeay 0.72_3, security/p5-Crypt-X509 0.55, security/p5-Crypt-X509-CRL 0.4, security/p5-CryptX 0.091, security/p5-Data-Password 1.12, security/p5-openxpki-i18n 3.24.2, shells/bash 5.3.20, textproc/p5-PPI 1.291, textproc/p5-Pod-POM 2.01, textproc/p5-Regexp-Common 2024080801, textproc/p5-Text-CSV_XS 1.65, textproc/p5-XML-Filter-XInclude 1.0_2, textproc/p5-XML-SAX-Writer 0.57, textproc/p5-XML-Validator-Schema 1.10_2, www/p5-CGI 4.72, www/p5-CGI-Fast 2.17, www/p5-CGI-Session 4.49, www/p5-LWP-Protocol-connect 6.09_1, www/p5-LWP-Protocol-https 6.17, www/p5-RT-Client-REST 0.73,1, www/p5-Template-Toolkit 3.106
License
APACHE20
Creates
user openxpki, group openxpki
Options
2 of 3 on in the package: DOCS EXAMPLES
Show the 1 options that are off
GRAPHVIZ
pkg-message
Shown after installing
- Universal server building block (OpenXPKI) for arbitrary PKI: installed.
- i18n tools for UI: installed.
- Enable utf8 locale (e.g. en_US.utf8) for the translation staff to operate
  (translation is needed even for English language).
- Using database
  = Install your favorite database (enable utf8 support), e.g.
    databases/postgresql15-server 
    and perl interface for it, e.g. databases/p5-DBD-Pg
  = Examples, demos and tutorials of OpenXPKI traditionally use MariaDB 
    database. But its use with OpenXPKI on FreeBSD is a bit tricky:
      - Install e.g. databases/mariadb106-server
      - Add value mysql to file /etc/make.conf like this:
        DEFAULT_VERSIONS+= mysql=10.6m
      - cd /usr/ports/databases/p5-DBD-mysql4 && make reinstall
        Note that installing of databases/p5-DBD-MariaDB here may hinder
        operation of your OpeXPKI setup. 
- Install your favorite web server.
  Copy FastCGI scripts from /usr/local/share/examples/openxpki/cgi-bin to the location
  where your web server can use them. Set executable permissions for them.
  Copy htdocs files from /usr/local/share/examples/openxpki/htdocs to the location
  where your web server can use them.
  You can see some samples in /usr/local/share/examples/openxpki/config/apache.
- If you want your server to act just as the simplest CA,
  then the basic deployment procedure is all you need:
  copy sample configuration for this case with
    cp -pR /usr/local/share/examples/openxpki/config/* /usr/local/etc/openxpki/
  and follow advice at:
  https://openxpki.readthedocs.org/en/latest/quickstart.html
  Without this deployment procedure OpenXPKI server would not start.
- If you want more complex role for your server inside the PKI infrastructure,
  then perform further deployment procedure for your server atop
  the basic deployment.
- Oversimplified example scripts and configs are provided herewith for 
  illustration only, and not for production use. All features of OpenXPI in 
  production should be acquired by setting up an appropriate server with 
  needed deployment procedure.  
- This port has created user:group as openxpki:openxpki, which owns
  the OpenXPKI server.
- After first fresh installation, create empty log files as follows
  (assuming your web server is owned by user www):

install -m 660 -o openxpki -g openxpki /dev/null /var/log/openxpki/openxpki.log
install -m 660 -o www -g www /dev/null /var/log/openxpki/webui.log
install -m 660 -o www -g www /dev/null /var/log/openxpki/scep.log
install -m 660 -o www -g www /dev/null /var/log/openxpki/soap.log

- It is essential that www and openpki are two different users in your system.

- Start daemons in this order:
    1) database server,
    2) OpenXPKI server (/usr/local/etc/rc.d/openxpki start),
    3) web server.
- Docs installed (if you opted so) into /usr/local/share/doc/openxpki
- Mind FreeBSD specific file structure:
    /usr/local/etc/openxpki: server configuration, logs configuration.
    /var/openxpki: pid file, socket file, ...
    /var/openxpki/session: session files.
    /var/log/openxpki: server log files.
    /var/tmp: temporary directory.
- Use of openssl/libressl
  = This package comes (from FreeBSD build cluster) bound with 
  openssl from base system, cf: /usr/ports/Mk/Uses/ssl.mk
  If you want to use openssl or libressl from ports instead, then:
    1) add the name of respective port 
       (openssl, openssl30, openssl31, libressl, libressl-devel...)
       to /etc/make.conf file e.g. like this:
       DEFAULT_VERSIONS+= ssl=openssl31
    2) install security/openssl31
    3) cd /usr/ports/security/p5-openxpki && make reinstall
       you do not need to rebuild dependencies, installed from packages.
  = Using versions OpenSSL 1.0 or less can restrict features of the OpenXPI.
  = OpenXPKI builds just fine with any available versions of OpenSSL or 
    LibreSSL. But its operation with LibreSSL, or with OpenSSL 3+ has not
    been fully tested. Report your respective story to the list
      https://sourceforge.net/p/openxpki/mailman/
    or use OpenSSL 1.1.1 instead.
Shown after upgrading
If you update existing installation, please check if extra handwork 
is needed in your case:
http://openxpki.readthedocs.io/en/latest/upgrading.html
https://sourceforge.net/p/openxpki/mailman/message/37607700/

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 163.24.2_13.24.2_1–
FreeBSD 153.24.2_13.24.2_1–
FreeBSD 143.24.2_13.24.2_13.24.2_1

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 153.24.2_13.24.2_1–
FreeBSD 143.24.2_13.24.2_13.24.2_1

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 3.24.2_1.

Fixed (0)

No VuXML entries for this package.

Problem reports (3) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
262193maintainer-feedback? security/p5-openxpki - Pkg post install message refers to non-existent filesNew2024-08-16
277514maintainer-feedback? security/p5-openxpki - I18N Translations do not appear in webuiNew2024-03-05
277513maintainer-feedback? security/p5-openxpki - service script resets file permissions and ownership which breaks webuiNew2024-03-05

Commits (98)

Raphael Kubo da Costa (rakuco) · 1.4.0
Update to 1.4.0.

PR:		207519
Submitted by:	Sergei Vyshenski <svysh.fbsd@gmail.com> (maintainer)
b088ca94eb
Martin Wilke (miwi) · 1.2.0
- Update to 1.2.0 - Switch to options helper

PR:		204987
Submitted by:	maintainer
Approved by:	mat (mentor)
Differential Revision:	D4575
b44961b1fc
Mathieu Arnold (mat) · 0.28.0
Make it so that the default Perl is always called perl5.

- Move Perl's man1 files along with its man3 files.
- Move where Perl installs its modules man1 pages.
- Convert the ports installing man1 pages.
- Make different Perl versions installable at the same time.
  Though you should note that only the default version can be used to
  install Perl modules, and the non default Perl versions cannot use the
  modules installed via ports if they contain .so as they are installed
  in a version specific directory.

Reviewed by:	bapt (the Mk bits)
Exp-run by:	antoine
Sponsored by:	Absolight
Differential Revision:	https://reviews.freebsd.org/D3542
afae652a2a
Dmitry Marakasov (amdmi3) · 0.28.0
- Update to 0.28.0 - Add IGNORE if LibreSSL is installed. This port uses low level functions of OpenSSL, and big work of the upstream is ahead to support LibreSSL.  This version of OpenXPKI still does not have full support of LibreSSL. - Allow non-root user to build and stage so library.

PR:		199179
Submitted by:	spil.oss@gmail.com
Patch by:	svysh.fbsd@gmail.com (maintainer)
2382b2ce62
Mathieu Arnold (mat) · 0.27.0.1
Update ports in the remaining categories to not use GH_COMMIT.

With minor cleanups to make things simpler.

With hat:	portmgr
Sponsored by:	Absolight
fb4deed873
Bartek Rutkowski (robak) · 0.27.0.1
security/p5-openxpki: update 0.26.1.1 -> 0.27.0.1

PR:		198525
Submitted by:	Sergei Vyshenski <svysh.fbsd@gmail.com>
b5bac9f80f
John Marino (marino) · 0.26.1.1
security/p5-openxpki: Upgrade version 0.25.0.1 => 0.26.1.1

PR:		197470
Submitted by:	maintainer (Sergei Vyshenski)
92f51515eb
Mathieu Arnold (mat) · 0.25.0.1_1
Don't overwrite Perl's lddlflags, and remove a bunch of checks, we always ship with -shared.

With hat:	perl
Sponsored by:	Absolight
8cda4a6497
Frederic Culot (culot) · 0.25.0.1
- Update to 0.25.0.1

PR:		ports/195594
Submitted by:	Sergei Vyshenski <svysh.fbsd@gmail.com> (maintainer)
ac2fc0ec4b
Mathieu Arnold (mat) · 0.23.0.1_1
Change the way Perl modules are installed, update the default Perl to 5.18.

Before, we had:

  site_perl :           lib/perl5/site_perl/5.18
  site_perl/perl_arch : lib/perl5/site_perl/5.18/mach
  perl_man3 :           lib/perl5/5.18/man/man3

Now we have:

  site_perl : lib/perl5/site_perl
  site_arch : lib/perl5/site_perl/mach/5.18
  perl_man3 : lib/perl5/site_perl/man/man3

Modules without any .so will be installed at the same place regardless of the
Perl version, minimizing the upgrade when the major Perl version is changed.
It uses a version dependent directory for modules with compiled bits.

As PERL_ARCH is no longer needed in plists, it has been removed from
PLIST_SUB.

The USE_PERL5=fixpacklist keyword is removed, the .packlist file is now
always removed, as is perllocal.pod.

The old site_perl and site_perl/arch directories have been kept in the
default Perl @INC for all Perl ports, and will be phased out as these old
Perl versions expire.

PR:		194969
Differential Revision:	https://reviews.freebsd.org/D1019
Exp-run by:	antoine
Reviewed by:	perl@
Approved by:	portmgr
eee58d187e
Bartek Rutkowski (robak) · 0.23.0.1
security/p5-openxpki: update 0.21.0.1 -> 0.23.0.1

PR:		194772
Submitted by:	Sergei Vyshenski <svysh.fbsd@gmail.com>
Approved by:	mentors (implicit)
309eda0978
Frederic Culot (culot) · 0.21.0.1
- Update to 0.21.0.1

PR:		ports/193019
Submitted by:	Sergei Vyshenski <svysh.fbsd@gmail.com> (maintainer)
c636e28abc
William Grzybowski (wg) · 0.20.0.1
security/p5-openxpki: update to 0.20.0.1

PR:		192594
Submitted by:	maintainer
15127c98e7
William Grzybowski (wg) · 0.19.0.1
security/p5-openxpki: update to 0.19.0.1

PR:		192410
Submitted by:	maintainer
ad191bf93e
William Grzybowski (wg) · 0.14.0.1
security/p5-openxpki: update to 0.14.0.1

- Follow restructuring of the original software
  and absorb functionality from retired ports
  (cf. neighboring RPs about each of them):
  security/p5-openxpki-client,
  security/p5-openxpki-client-scep,
  security/p5-openxpki-deployment
- Add CONFLICTS with the retired ports listed above.
- Remove building of long developer docs
- Follow LICENSE change of the original software.
- Switch MASTER_SITES from SF to GH.

PR:		191444
Submitted by:	maintainer
d733d99b20
Mathieu Arnold (mat) · 0.9.1389_2
Remove all the bootstrap files (.bs) from the plists.

Starting with perl 5.20, they're not installed any more if empty,
and on FreeBSD, they're (always ?) empty.

PR:		190681
Submitted by:	mat
Exp-Run by:	antoine
Sponsored by:	Absolight
61de712f46
Sunpoet Po-Chuan Hsieh (sunpoet) · 0.9.1389_2
- Support STAGEDIR
c328984512
Baptiste Daroussin (bapt) · 0.9.1389_2
Mark as broken unstaged perl ports

With hat:	portmgr
0542e45bb8
Baptiste Daroussin (bapt) · 0.9.1389_2
Add NO_STAGE all over the place in preparation for the staging support (cat: security)
a65ed2e51b
Sunpoet Po-Chuan Hsieh (sunpoet) · 0.9.1389_2
- Update OSVERSION check and comment - While I'm here:   - Move LICENSE upward   - Use USES=gmake   - Convert to new perl5 framework   - Fix spelling of FreeBSD and OpenSSL   - Remove outdated OSVERSION check

PR:		ports/181828
Submitted by:	Sergei Vyshenski <svysh.fbsd@gmail.com> (maintainer)
5c5086ad71
Baptiste Daroussin (bapt) · 0.9.1389_2
Convert security to new options framework
0b881b0ece
Martin Wilke (miwi) · 0.9.1389_2
- Update to Maintainer e-mail - While here trim header

PR:		176512 176513 176514 176515 176516
		176518 176519 176520 176521 176517
Submitted by:	maintainer
5d17d32d4c
Andrej Zverev (az) · 0.9.1389_2
- Remove SITE_PERL from *_DEPENDS

Approved by: portmgr@ (bapt@)
3982ced0ba
Eitan Adler (eadler) · 0.9.1389_2
At the moment 1385 ports use BUILD_DEPENDS= ${RUN_DEPENDS} and 450 ports use BUILD_DEPENDS:= ${RUN_DEPENDS}. This patch fixes ports that are currently broken. This is a temporary measure until we organically stop using := or someone(s) spend a lot of time changing all the ports over.

Explicit duplication > := > = and this just moves ports one step to the left

Approved by:	portmgr
c59a3834c4
Sunpoet Po-Chuan Hsieh (sunpoet) · 0.9.1389_2
- Change PERL_CONFIGURE to "yes" for all values between 5.8.1+ and 5.8.9+

Suggested by:	az
With hat:	perl
00ca886ed4
Olli Hauer (ohauer) · 0.9.1389_2
-remove MD5
87931c6875
Baptiste Daroussin (bapt) · 0.9.1389_2
- Fix dependency list - Convert to USERS/GROUPS macros - Add license - Bump portrevision

PR:		ports/149740
Submitted by:	Sergei Vyshenski <svysh _at_ pn.sinp.msu.ru> (maintainer)
Approved by:	tabthorpe (mentor)
ee40034e80
Wen Heping (wen) · 0.9.1389_1
- Fix build with openssl

PR:		ports/145620
Submitted by:	Sergei Vyshenski <svysh@pn.sinp.msu.ru> (maintainer)
f0b7004cca
Dmitry Marakasov (amdmi3) · 0.9.1389
- Switch SourceForge ports to the new File Release System: categories starting with P,R,S
3eb168f46b
Marcelo Araujo (araujo) · 0.9.1389
- Update to 0.9.1389.

PR:		ports/130795
Submitted by:	Sergei Vyshenski <svysh@pn.sinp.msu.ru> (maintainer)
2dbbd40430
Pav Lucistnik (pav) · 0.9.1267
- Make this use openssl from port on 6.x

Reported by:	pointyhat
82bd87c7c6
Martin Wilke (miwi) · 0.9.1267
- Update to 0.9.1267

PR:		125047
Submitted by:	Sergei Vyshenski <svysh@pn.sinp.msu.ru> (maintainer)
fed74f0e1c
Edwin Groothuis (edwin) · 0.9.1084_1
Bump portrevision due to upgrade of devel/gettext.

The affected ports are the ones with gettext as a run-dependency
according to ports/INDEX-7 (5007 of them) and the ones with USE_GETTEXT
in Makefile (29 of them).

PR:             ports/124340
Submitted by:   edwin@
Approved by:    portmgr (pav)
090059a210
Martin Wilke (miwi) · 0.9.1084
- Update to 0.9.1084

PR:		116859
Submitted by:	Sergei Vyshenski <svysh@pn.sinp.msu.ru> (maintainer)
de0d021646
Mark Linimon (linimon) · 0.9.914
Welcome bsd.perl.mk.  Add support for constructs such as USE_PERL5=5.8.0+. Drop support for antique perl.

Work done by:	gabor
Sponsored by:	Google Summer of Code 2007
Hat:		portmgr
9839011ec3
Martin Wilke (miwi) · 0.9.914
- Update to 0.9.914

PR:		113413
Submitted by:	Sergei Vyshenski <svysh@pn.sinp.msu.ru> (maintainer)
d96d1a543a
Martin Wilke (miwi) · 0.9.781
- Update to 0.9.781

PR:             110931
Submitted by:   Sergei Vyshenski <svysh@cryptocom.ru> (maintainer)
f30da97824
Martin Wilke (miwi) · 0.9.724
- Update to 0.9.724

PR:		108614
Submitted by:	Sergei Vyshenski <svysh@cryptocom.ru> (maintainer)
bc0a5645c6
Martin Wilke (miwi) · 0.9.633
- Update to 0.9.633

PR:		ports/106609
Submitted by:	Sergei Vyshenski <svysh@cryptocom.ru> (maintainer)
96de15b211
Rong-En Fan (rafan) · 0.9.548
- Update to 0.548 - Split openxpki port into 8 separate ports. This reduces maintainer's   loading and make our automatic porting tools happier. Users need   not to install all of the 8 ports to make OpenXPKI work. He/She just   install what he/she needs.  Detail reasons can be found in PR.

PR:		ports/103937
Submitted by:	Sergei Vyshenski <svysh at cryptocom.ru> (maintainer)
8d3dc989a5
Erwin Lansing (erwin) · 0.9.455
Fix pkg-plist and unbreak

PR:		103356
Submitted by:	Sergei Vyshenski <svysh@cryptocom.ru> (maintainer)
b4cee60d53
Kris Kennaway (kris) · 0.9.455
BROKEN: Incomplete pkg-plist
51803a48c0
Martin Wilke (miwi) · 0.9.455
- Fix pkg-plist [1]

Submitted by:	pontyhat via krismail
                Sergei Vyshenski <svysh(at)cryptocom.ru> (maintainer) [1]
c8be89455e
Martin Wilke (miwi) · 0.9.455
- Update to 0.9.455

PR:		ports/102008
Submitted by:	Sergei Vyshenski <svysh(at)cryptocom.ru> (maintainer)
Approved by:	krion (mentor)
94cf9733c2
Erwin Lansing (erwin) · 0.9.402
Add support for DESTDIR part I.

This commit should largele be a NOOP as it only adds support
for DESTDIR undefined. This does allow us to start testing
ports with DESTDIR set, but this is as of yet not supported.

Although this has been extensively tested on pointyhat, this
is a very intrusive change and some cases may have been
overlooked. Please contact Gabor and me if you find any.

PR:             100555
Submitted by:   gabor
Sponsored by:   Google Summer of Code 2006
50513d5d52
Rong-En Fan (rafan) · 0.9.402
- Update to 0.9.402

PR:		ports/100612
Submitted by:	maintainer
23b2b8752c
Rong-En Fan (rafan) · 0.9.342_1
- Fix non-portable dependency

PR:		99840
Submitted by:	maintainer
Approved by:	delphij (mentor, implicit)
d8b34e05b3
Erwin Lansing (erwin) · 0.9.342
Add p5-openxpki 0.9.342, perl based enterprise class trastcenter software for PKI.

PR:		ports/99317
Submitted by:	Sergei Vyshenski <svysh@cryptocom.ru>
d3de307fe3