# kca-core

Pure PKI domain logic for KCA. It knows how to generate and parse keys, build
distinguished names, encode X.509 extensions, issue certificates, create CSRs
and CRLs, apply templates, and convert every supported import and export
format. It has no kaya or database dependencies and is unit-tested in
isolation. Native operations use `cryptography`; an in-memory CFFI/OpenSSL 3
backend supports XCA's legacy named curves and signature hashes without
private-key temporary files or command-line tools.