From 0dd587a3f284fd557367f898fbf1a1e1954c9fe9 Mon Sep 17 00:00:00 2001 From: Christian Hohnstaedt Date: Fri, 1 Mar 2024 09:19:29 +0100 Subject: [PATCH] Move OpenSSL configuration file generation Instead of being a special context menu entry, make it an option in the export dialog. --- doc/rst/certificates.rst | 6 +++--- doc/rst/requests.rst | 9 +++++---- lib/db_x509.cpp | 2 ++ lib/db_x509req.cpp | 8 +++++++- lib/pki_export.cpp | 2 ++ lib/pki_export.h | 1 + lib/pki_x509super.cpp | 4 +--- lib/pki_x509super.h | 2 +- widgets/X509SuperTreeView.cpp | 23 +---------------------- widgets/X509SuperTreeView.h | 3 +-- 10 files changed, 24 insertions(+), 36 deletions(-) diff --git a/doc/rst/certificates.rst b/doc/rst/certificates.rst index 319706db..c98581b3 100644 --- a/doc/rst/certificates.rst +++ b/doc/rst/certificates.rst @@ -106,12 +106,12 @@ Certificate Export to be imported into your favorite calendar app. - **CA vCalendar (*.ics):** expiry notifications for the CA certificate, valid, issued cdrtificates and the latest CRL. + - **OpenSSL config:** Create an OpenSSL config file from the content of + this certificate, which can be used to generate a similar certificate + with openssl: `openssl req -new -x509 -config ` - **Token:** Store certificate on the Security token containing the private key. - **Other token:** Store certificate on any Security token. -- **OpenSSL config:** Create an OpenSSL config file from the content of this - certificate, which can be used to generate a similar certificate with - openssl: `openssl req -new -x509 -config ` When exporting PKCS#12 structures XCA asks later for an encryption password. diff --git a/doc/rst/requests.rst b/doc/rst/requests.rst index 8ced51c2..eedd5c43 100644 --- a/doc/rst/requests.rst +++ b/doc/rst/requests.rst @@ -50,10 +50,11 @@ Request Export Requests can be exported by the context-menu or by the button on the right. - **Clipboard** Writes all selected requests in PEM format to the Clipboard. -- **File** Write the request into a file in PEM or DER format. -- **OpenSSL config** Create and store an OpenSSL configuration file which - can be used to generate a similar request with openssl - `openssl req -new -config ` +- **File** Write the request into a file in PEM or DER format, or as + OpenSSL configuration file format. + +The OpenSSL config file format can be used to generate a similar +request with openssl `openssl req -new -config ` Request Transformation ---------------------- diff --git a/lib/db_x509.cpp b/lib/db_x509.cpp index 7742db14..eedad213 100644 --- a/lib/db_x509.cpp +++ b/lib/db_x509.cpp @@ -653,6 +653,8 @@ void db_x509::exportItems(const QModelIndexList &list, crt->icsVEVENT_ca() : crt->icsVEVENT(); } writeVcalendar(file, vcal); + } else if (xport->match_all(F_CONFIG)) { + crt->opensslConf(file); } } diff --git a/lib/db_x509req.cpp b/lib/db_x509req.cpp index b2a9f5ff..93573222 100644 --- a/lib/db_x509req.cpp +++ b/lib/db_x509req.cpp @@ -103,8 +103,14 @@ void db_x509req::exportItem(const QModelIndex &index, const pki_export *xport, XFile &file) const { pki_x509req *req = fromIndex(index); - if (req) + if (!req) + return; + + if (xport->match_all(F_CONFIG)) { + req->opensslConf(file); + } else { req->writeReq(file, xport->match_all(F_PEM)); + } } void db_x509req::setSigned(QModelIndex index, bool signe) diff --git a/lib/pki_export.cpp b/lib/pki_export.cpp index 435714ca..25c284f7 100644 --- a/lib/pki_export.cpp +++ b/lib/pki_export.cpp @@ -76,6 +76,7 @@ new pki_export(15, x509, "pfx", tr("PKCS #12"), F_PKCS12 | F_USUAL | F_CRYP new pki_export(16, x509, "txt", tr("Certificate Index file"), F_INDEX | F_CA, tr("OpenSSL specific Certificate Index file as created by the 'ca' command and required by the OCSP tool")), new pki_export(17, x509, "ics", tr("vCalendar"), F_CAL, tr("vCalendar expiry reminder for the selected items")), new pki_export(18, x509, "ics", tr("CA vCalendar"), F_CAL | F_CA, tr("vCalendar expiry reminder containing all issued, valid certificates, the CA itself and the latest CRL")), +new pki_export(38, x509, "conf", tr("OpenSSL config"), F_SINGLE | F_CONFIG, tr("OpenSSL configuration file to create a certificate or request with the openssl commandline tool")), new pki_export(19, asym_key, "pem", tr("PEM public"), F_PEM | F_CLIPBOARD, tr("Text format of the public key in one PEM file")), new pki_export(20, asym_key, "pem", tr("PEM private"), F_PEM | F_PRIVATE | F_USUAL | F_CLIPBOARD, tr("Unencrypted private key in text format")), @@ -91,6 +92,7 @@ new pki_export(29, asym_key, "pk8", tr("PKCS #8"), F_PKCS8 | F_PRIVATE | F new pki_export(30, x509_req, "csr", "PEM", F_PEM, tr("PEM Text format with headers")), new pki_export(31, x509_req, "der", "DER", F_DER | F_SINGLE, tr("Binary DER format of the certificate request")), +new pki_export(37, x509_req, "conf", tr("OpenSSL config"), F_SINGLE | F_CONFIG, tr("OpenSSL configuration file to create a certificate or request with the openssl commandline tool")), new pki_export(32, revocation, "crl", "PEM", F_PEM, tr("PEM Text format with headers")), new pki_export(33, revocation, "der", "DER", F_DER | F_SINGLE, tr("Binary DER format of the revocation list")), diff --git a/lib/pki_export.h b/lib/pki_export.h index 579a5e7b..f884ea60 100644 --- a/lib/pki_export.h +++ b/lib/pki_export.h @@ -48,6 +48,7 @@ enum { F_CAL = BIT(18),/* Calendar entry */ F_DER = BIT(19),/* DER format */ F_OVPN = BIT(20),/* OpenVPN format */ + F_CONFIG = BIT(21),/* OpenSSL config format */ }; class pki_export : public QObject { diff --git a/lib/pki_x509super.cpp b/lib/pki_x509super.cpp index c8d54d75..b2176fa6 100644 --- a/lib/pki_x509super.cpp +++ b/lib/pki_x509super.cpp @@ -205,7 +205,7 @@ static QString oid_sect() return ret; } -void pki_x509super::opensslConf(QString fname) +void pki_x509super::opensslConf(XFile &file) { QString extensions; extList el = getV3ext(); @@ -229,8 +229,6 @@ void pki_x509super::opensslConf(QString fname) "%2").arg(name).arg(extensions). arg(ASN1_STRING_get_default_mask(), 0, 16); - XFile file(fname); - file.open_write(); file.write(final.toUtf8()); } diff --git a/lib/pki_x509super.h b/lib/pki_x509super.h index 9a9b3987..f47b2609 100644 --- a/lib/pki_x509super.h +++ b/lib/pki_x509super.h @@ -57,7 +57,7 @@ class pki_x509super : public pki_x509name void setRefKey(pki_key *ref); void delRefKey(pki_key *ref); QVariant column_data(const dbheader *hd) const; - void opensslConf(QString fname); + void opensslConf(XFile &file); bool visible() const; bool hasPrivKey() const; QVariant getIcon(const dbheader *hd) const; diff --git a/widgets/X509SuperTreeView.cpp b/widgets/X509SuperTreeView.cpp index 047d4653..787dc544 100644 --- a/widgets/X509SuperTreeView.cpp +++ b/widgets/X509SuperTreeView.cpp @@ -16,7 +16,7 @@ #include #include -void X509SuperTreeView::fillContextMenu(QMenu *menu, QMenu *subExport, +void X509SuperTreeView::fillContextMenu(QMenu *menu, QMenu *, const QModelIndex &index, QModelIndexList indexes) { pki_x509super *x = dynamic_cast( @@ -25,7 +25,6 @@ void X509SuperTreeView::fillContextMenu(QMenu *menu, QMenu *subExport, if (indexes.size() != 1 || !x) return; - subExport->addAction(tr("OpenSSL config"), this, SLOT(toOpenssl())); transform = menu->addMenu(tr("Transform")); transform->addAction(tr("Template"), this, SLOT(toTemplate())); transform->addAction(tr("Public key"), this, @@ -48,26 +47,6 @@ void X509SuperTreeView::toTemplate() x509super()->toTemplate(idx); } -void X509SuperTreeView::toOpenssl() -{ - QModelIndex idx = currentIndex(); - - if (!idx.isValid() || !basemodel) - return; - - pki_x509super *pki = db_base::fromIndex(idx); - QString fn = Settings["workingdir"] + pki->getUnderlinedName() + ".conf"; - QString fname = QFileDialog::getSaveFileName(NULL, - tr("Save as OpenSSL config"), fn, - tr("Config files ( *.conf *.cnf);; All files ( * )")); - if (fname.isEmpty()) - return; - - update_workingdir(fname); - pki->opensslConf(fname); -} - - void X509SuperTreeView::showPki(pki_base *pki) { pki_x509super *x = dynamic_cast(pki); diff --git a/widgets/X509SuperTreeView.h b/widgets/X509SuperTreeView.h index c204f44c..40191568 100644 --- a/widgets/X509SuperTreeView.h +++ b/widgets/X509SuperTreeView.h @@ -25,13 +25,12 @@ class X509SuperTreeView: public XcaTreeView public: X509SuperTreeView(QWidget *parent) : XcaTreeView(parent) { } - void fillContextMenu(QMenu *menu, QMenu *subExport, + void fillContextMenu(QMenu *menu, QMenu *, const QModelIndex &index, QModelIndexList indexes); public slots: void showPki(pki_base *pki); void extractPubkey(); void toTemplate(); - void toOpenssl(); }; #endif