I don't get most of the stuff myself. PKIs are overwhelming. There are thousands of flags you can set when creating a certificate it's not funny anymore. I did

I don't get most of the stuff myself. PKIs are overwhelming. There are thousands of flags you can set when creating a certificate it's not funny anymore. I did a lot of trial and error until i had a VPN using my certificates running successfully (that's what i needed the CA for in the first place). Maybe look for CA stuff in general or some TinyCA tutorial. I've used TinyCA, it's exactly the same complexity as XCA, although I like XCA's UI better.