diff --git a/CMakeLists.txt b/CMakeLists.txt
index a494bc13..8c70765e 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -218,11 +218,20 @@ if(APPLE)
     RESOURCE "${APP_RESOURCES}"
   )
   find_program(MACDEPLOYQT_EXECUTABLE macdeployqt HINTS ${_qt_bin_dir})
+  find_program(INSTALL_NAME_TOOL install_name_tool HINTS ${_qt_bin_dir})
+
   add_custom_command(TARGET ${PROJECT_NAME} POST_BUILD
     COMMAND ${MACDEPLOYQT_EXECUTABLE} $<TARGET_FILE_DIR:${PROJECT_NAME}>/../..
         -always-overwrite ${APPSTORE}
     COMMENT "Running macdeployqt..."
   )
+  foreach(installdir ${CMAKE_PREFIX_PATH})
+    add_custom_command(TARGET ${PROJECT_NAME} POST_BUILD
+      COMMAND test ! -e $<TARGET_FILE_DIR:${PROJECT_NAME}>/../PlugIns/sqldrivers/libqsqlmysql.dylib ||
+          ${INSTALL_NAME_TOOL} -change ${installdir}/lib/libmariadb.3.dylib @rpath/libmariadb.3.dylib
+          $<TARGET_FILE_DIR:${PROJECT_NAME}>/../PlugIns/sqldrivers/libqsqlmysql.dylib
+    )
+  endforeach()
   if (PROVISIONPROFILE)
     add_custom_command(TARGET ${PROJECT_NAME} POST_BUILD
       COMMAND cmake -E copy ${PROVISIONPROFILE}
@@ -236,7 +245,6 @@ if(APPLE)
         --force -s ${APPLE_DEVELOPER_CERT}
         $<TARGET_FILE_DIR:${PROJECT_NAME}>/../..
       COMMENT "Running codesign for ${APPLE_DEVELOPER_CERT} ..."
-      DEPENDS ${PROJECT_SOURCE_DIR}/misc/entitlement${APPSTORE}.plist
     )
   endif()
 
diff --git a/Dockerfile b/Dockerfile
index 7cb66de9..78056694 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 ARG REGISTRY_PREFIX=''
-ARG CODENAME=jammy
+ARG CODENAME=noble
 
 FROM ${REGISTRY_PREFIX}ubuntu:${CODENAME} as builder
 
@@ -9,18 +9,17 @@ RUN set -x \
 	&& apt update \
 	&& apt upgrade -y \
 	&& apt install --yes --no-install-recommends \
-		build-essential libssl-dev pkg-config qtbase5-dev \
-		qttools5-dev-tools qttools5-dev libqt5sql5 libqt5help5 \
-		python3-sphinxcontrib.qthelp git cmake
+		build-essential libssl-dev pkg-config ninja-build \
+		python3-sphinxcontrib.qthelp git cmake locales \
+		qt6-base-dev qt6-tools-dev
 
-ARG PARALLELMFLAGS=-j6
 ARG BUILD_DIR=/tmp/build
 
 COPY . ${BUILD_DIR}
 RUN set -x \
 	&& cd ${BUILD_DIR} \
-	&& cmake -B BUILD \
-	&& cmake --build BUILD ${PARALLELMFLAGS} \
+	&& cmake -B BUILD -G Ninja \
+	&& cmake --build BUILD \
 	&& cmake --install BUILD \
 	&& cd \
 	&& mv ${BUILD_DIR}/misc/docker_start.sh / \
diff --git a/README.md b/README.md
index cf81634a..3755e39d 100644
--- a/README.md
+++ b/README.md
@@ -76,7 +76,7 @@ XCA can be used with Xcode after initializing the directory with:
 ### Windows
 
 - Install the dependencies
-  - Install Python for windows from the store or https://www.python.org/downloads/windows/
+  - Install Python 3.11 for windows from the store or https://www.python.org/downloads/windows/
   - Install OpenSSL from here: https://slproweb.com/download/Win64OpenSSL-3_1_5.msi and verify the sha256 from https://github.com/slproweb/opensslhashes/blob/master/win32_openssl_hashes.json
   - To install the Qt libraries, cmake and the MinGW compiler [aqtinstall](https://github.com/miurahr/aqtinstall) is used.
     Sphinx is used to generate the documentation
diff --git a/changelog b/changelog
index de2e8701..3093899c 100644
--- a/changelog
+++ b/changelog
@@ -1,3 +1,12 @@
+ * Add PostgreSQL driver to Mac OSX
+ * Update libraies: OpenSSL 3.4.1, QT 6.8.3
+ * Close #603: xca.exe(portable) without signature
+ * Close #643: secp521r1 ssh fingerprints incorrect
+ * Close #641: Keep serial number & revoke old certificate
+ * Close #642: macOS MariaDB plugin requires SSL
+ * Close #640: Fix mysql on Mac OSX
+ * Close #602: Linux/Flatpak: default template TLS_server is missing
+
 xca 2.8.0 Sun Oct 13 2024
 -------------------------
 
diff --git a/cmake/text_header_file.cmake b/cmake/text_header_file.cmake
deleted file mode 100644
index c90b4693..00000000
--- a/cmake/text_header_file.cmake
+++ /dev/null
@@ -1,19 +0,0 @@
-
-if (FILE AND SRC AND DST)
-  if (APPLE)
-    set(DIR_HINT "HOME/Library/Application Support/data/xca/${FILE}.txt")
-  elseif (WIN32)
-    set(DIR_HINT "PROFILE\\Application Data\\xca\\${FILE}.txt")
-  else()
-    set(DIR_HINT "/usr/local/share/xca/${FILE}.txt or HOME/.local/share/xca/${FILE}.txt")
-  endif()
-
-  file(READ "${SRC}/preamble.txt" PREAMBLE)
-  file(READ "${SRC}/${FILE}.text" CONT)
-  file(WRITE "${DST}/${FILE}.txt"
-       ${PREAMBLE} "\n# "
-       ${DIR_HINT} "\n"
-       ${CONT})
-else()
-  message(FATAL_ERROR "Mandatory FILE or SRC variable not defined")
-endif()
diff --git a/doc/rst/certificates.rst b/doc/rst/certificates.rst
index b3589716..14791f63 100644
--- a/doc/rst/certificates.rst
+++ b/doc/rst/certificates.rst
@@ -152,6 +152,10 @@ original one with adjusted validity dates.
 Use the *Revoke old certificate* check-box to automatically revoke the old
 certificate.
 
+Be careful with the "Keep serial number" option. A revocation will revoke both
+certificates, because they have the same serial number. It is recommended to
+either replace the old certificate or not use this option at all.
+
 If more than one certificate of the same issuer is selected,
 all of them will be renewed at once with the same validity dates.
 The context menu shows this by adding the number of selected certificates
diff --git a/doc/rst/database.rst b/doc/rst/database.rst
index 5dc165fe..32fade64 100644
--- a/doc/rst/database.rst
+++ b/doc/rst/database.rst
@@ -80,9 +80,10 @@ Also the environment variable XCA_<driver-name>_OPTIONS may be used to set the o
 
 The file must contain the options as ; separated key=value pairs. The recognized options depend
 on the database driver. See:
-https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS for PostgreSQL and
-https://doc.qt.io/qt-6/sql-driver.html#connection-options for MySQL and
-https://doc.qt.io/qt-6/sql-driver.html#odbc-unicode-support for ODBC.
+
+ - https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS for PostgreSQL and
+ - https://doc.qt.io/qt-6/sql-driver.html#connection-options for MySQL and
+ - https://doc.qt.io/qt-6/sql-driver.html#odbc-unicode-support for ODBC.
 
 .. _extracting-items:
 
diff --git a/lib/db_temp.cpp b/lib/db_temp.cpp
index 412531bf..62d6819c 100644
--- a/lib/db_temp.cpp
+++ b/lib/db_temp.cpp
@@ -33,9 +33,14 @@ db_temp::db_temp() : db_x509name("templates")
 	tmpl->setAsPreDefined();
 	predefs << tmpl;
 
-	foreach(QString d, QStandardPaths::standardLocations(
-				QStandardPaths::AppDataLocation))
+	QStringList dirs = QStandardPaths::standardLocations(
+	                     QStandardPaths::AppDataLocation);
+#ifdef INSTALL_DATA_PREFIX
+	dirs << QString(INSTALL_DATA_PREFIX);
+#endif
+	foreach(QString d, dirs)
 	{
+		qDebug() << "Looking for templates at" << d;
 		QFileInfoList list = QDir(d).entryInfoList(
 				QStringList("*.xca"),
 				QDir::Files | QDir::NoSymLinks |
diff --git a/lib/xcaexport.cpp b/lib/xcaexport.cpp
index 9624bb66..b632da3a 100644
--- a/lib/xcaexport.cpp
+++ b/lib/xcaexport.cpp
@@ -55,5 +55,6 @@ int main(int argc, char *argv[])
 		QTextStream out(stdout);
 		out << doc;
 	}
+	pki_export::free_elements();
 	return EXIT_SUCCESS;
 }
diff --git a/misc/CMakeLists.txt b/misc/CMakeLists.txt
index aa6af143..8f7b506e 100644
--- a/misc/CMakeLists.txt
+++ b/misc/CMakeLists.txt
@@ -19,15 +19,25 @@ list(TRANSFORM XCA_TEMPLATES PREPEND ${S}/)
 target_sources(${CMAKE_PROJECT_NAME} PRIVATE ${XCA_TEMPLATES})
 list(APPEND APP_RESOURCES "${XCA_TEMPLATES}")
 
-##### Text Files ids.txt eku.txt dn.txt
+##### Text Files oids.txt eku.txt dn.txt
 
 macro(Text_header file)
-    add_custom_command(OUTPUT "${D}/${file}.txt"
-        COMMAND ${CMAKE_COMMAND} -DFILE=${file} -DSRC="${S}" -DDST="${D}"
-        -P "${PROJECT_SOURCE_DIR}/cmake/text_header_file.cmake"
-        DEPENDS "${S}/${file}.text" "${S}/preamble.txt"
-    )
-    list(APPEND TEXT_FILES "${D}/${file}.txt")
+  if (APPLE)
+    set(DIR_HINT "HOME/Library/Application Support/data/de.hohnstaedt.xca/${file}.txt")
+  elseif (WIN32)
+    set(DIR_HINT "PROFILE\\Application Data\\xca\\${file}.txt")
+  else()
+    set(DIR_HINT "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_DATADIR}/${file}.txt or \$HOME/.local/share/de.hohnstaedt.xca/${file}.txt")
+  endif()
+
+  file(READ "${S}/preamble.txt" PREAMBLE)
+  file(READ "${S}/${file}.text" CONT)
+  file(WRITE "${D}/${file}.txt"
+       ${PREAMBLE} "\n# "
+       ${DIR_HINT} "\n"
+       ${CONT}
+  )
+  list(APPEND TEXT_FILES "${D}/${file}.txt")
 endmacro()
 
 Text_header(dn)
diff --git a/misc/qsqlmysql.patch b/misc/qsqlmysql.patch
new file mode 100644
index 00000000..abc99cc3
--- /dev/null
+++ b/misc/qsqlmysql.patch
@@ -0,0 +1,26 @@
+diff --git a/qtbase/src/plugins/sqldrivers/mysql/CMakeLists.txt b/qtbase/src/plugins/sqldrivers/mysql/CMakeLists.txt
+index fb28abd9..d7a3f2da 100644
+--- a/qtbase/src/plugins/sqldrivers/mysql/CMakeLists.txt
++++ b/qtbase/src/plugins/sqldrivers/mysql/CMakeLists.txt
+@@ -21,4 +21,3 @@ qt_internal_add_plugin(QMYSQLDriverPlugin
+         Qt::SqlPrivate
+ )
+ 
+-qt_internal_force_macos_intel_arch(QMYSQLDriverPlugin)
+diff --git a/qtbase/src/plugins/sqldrivers/mysql/qsql_mysql.cpp b/qtbase/src/plugins/sqldrivers/mysql/qsql_mysql.cpp
+index 3525c257..84081b22 100644
+--- a/qtbase/src/plugins/sqldrivers/mysql/qsql_mysql.cpp
++++ b/qtbase/src/plugins/sqldrivers/mysql/qsql_mysql.cpp
+@@ -1288,6 +1288,12 @@ bool QMYSQLDriver::open(const QString &db,
+ #endif
+ #if defined(MYSQL_VERSION_ID) && MYSQL_VERSION_ID >= 50711 && !defined(MARIADB_VERSION_ID)
+         {"MYSQL_OPT_SSL_MODE"_L1,        MYSQL_OPT_SSL_MODE,        setOptionSslMode},
++#endif
++#if defined(MARIADB_VERSION_ID)
++        {"MYSQL_OPT_SSL_ENFORCE"_L1,     MYSQL_OPT_SSL_ENFORCE,     setOptionBool},
++        {"MYSQL_OPT_SSL_VERIFY_SERVER_CERT"_L1, MYSQL_OPT_SSL_VERIFY_SERVER_CERT,     setOptionBool},
++        {"MARIADB_OPT_TLS_PEER_FP"_L1,   MARIADB_OPT_TLS_PEER_FP,     setOptionString},
++        {"MARIADB_OPT_TLS_PEER_FP_LIST"_L1,     MARIADB_OPT_TLS_PEER_FP_LIST,     setOptionString},
+ #endif
+         {"MYSQL_OPT_CONNECT_TIMEOUT"_L1, MYSQL_OPT_CONNECT_TIMEOUT, setOptionInt},
+         {"MYSQL_OPT_READ_TIMEOUT"_L1,    MYSQL_OPT_READ_TIMEOUT,    setOptionInt},
diff --git a/release/build-mac.sh b/release/build-mac.sh
index ff474308..a9b2d236 100755
--- a/release/build-mac.sh
+++ b/release/build-mac.sh
@@ -30,22 +30,14 @@ do_zstd()
   ZSTDV=1.5.6
   ARCHIVE=zstd-${ZSTDV}.tar.gz
   test -f $ARCHIVE || curl -L https://github.com/facebook/zstd/archive/refs/tags/v${ZSTDV}.tar.gz -o ${ARCHIVE}
-  for arch in x86_64 arm64; do
-    ZBUILD=zstd-${arch}
-    mkdir -p "$ZBUILD"
-    (cd "$ZBUILD"
-      tar -zxf ../${ARCHIVE} --strip-components 1
-      export CFLAGS="-target ${arch}-apple-macos11 -mmacosx-version-min=$SDK"
-      export PREFIX="$INSTALL_DIR"
-      make -j5 && make install
-    )
-    # DESTDIR="$INSTALL_DIR" make install
-    PARTS_dylib="$PARTS_dylib $ZBUILD/lib/libzstd.dylib"
-    PARTS_a="$PARTS_a $ZBUILD/lib/libzstd.a"
-  done
-  rm -f "$INSTALL_DIR"/lib/libzstd.dylib "$INSTALL_DIR"/lib/libzstd.a
-  lipo -create -output "$INSTALL_DIR"/lib/libzstd.dylib $PARTS_dylib
-  lipo -create -output "$INSTALL_DIR"/lib/libzstd.a $PARTS_a
+  ZBUILD=zstd-$ZSTDV
+  tar -zxf ${ARCHIVE}
+  (cd "$ZBUILD"
+    export CFLAGS="-arch x86_64 -arch arm64 -mmacosx-version-min=$SDK"
+    export PREFIX="$INSTALL_DIR"
+    make -j$JOBS && make install
+    unset CFLAGS PREFIX
+  )
 }
 
 do_mariadb_connector_c()
@@ -68,19 +60,31 @@ do_mariadb_connector_c()
   cmake --install ${B} --prefix="$INSTALL_DIR"
 }
 
+do_postgres()
+{
+  PGV=17.4
+  ARCHIVE=postgresql-$PGV.tar.gz
+  test -f $ARCHIVE || curl -L https://ftp.postgresql.org/pub/source/v$PGV/$ARCHIVE -O
+  tar -zxf ${ARCHIVE}
+  (cd postgresql-$PGV
+    CFLAGS="-arch x86_64 -arch arm64 -mmacosx-version-min=$SDK" \
+    ./configure --with-ssl=openssl --without-icu --prefix="${INSTALL_DIR}" \
+       --with-includes="$INSTALL_DIR"/include --with-libraries="$INSTALL_DIR"/lib
+    make -j$JOBS && make install
+  )
+}
+
 # need to install ninja via "brew install ninja"
-do_qsqlmysql()
+do_qsql()
 {
   PLUGIN="$QT_DIR/plugins/sqldrivers/libqsqlmysql.dylib"
 #  test -f "$PLUGIN" && return
   SQL_BUILD="$TOP_DIR/build-sqlplugins"
   ( cd "$QT_DIR/../Src/qtbase"
-    ./configure -cmake-generator Ninja -release -no-feature-x86intrin -sql-mysql \
+    ./configure -cmake-generator Ninja -release -no-feature-x86intrin -sql-mysql -sql-psql \
 	CMAKE_BUILD_TYPE=Release \
 	CMAKE_PREFIX_PATH="$INSTALL_DIR" \
 	CMAKE_OSX_DEPLOYMENT_TARGET=$SDK \
-	DMySQL_ROOT="$INSTALL_DIR" \
-	FEATURE_sql_odbc=OFF FEATURE_sql_sqlite=OFF
   )
 
   rm -rf "$SQL_BUILD"
@@ -91,24 +95,30 @@ do_qsqlmysql()
 	-DCMAKE_INSTALL_PREFIX="$QT_DIR" \
 	-DCMAKE_OSX_DEPLOYMENT_TARGET=$SDK \
 	-DMySQL_ROOT="$INSTALL_DIR" \
-	"$QT_DIR/../Src/qtbase/src/plugins/sqldrivers"
+	-DPostgreSQL_ROOT="$INSTALL_DIR" \
+	-DFEATURE_sql_odbc=OFF -DFEATURE_sql_sqlite=OFF \
+	"$QT_SQL_SRC"
 
-  cmake --build $SQL_BUILD -j$JOBS -v
+  cmake --build $SQL_BUILD -j$JOBS
   cmake --install $SQL_BUILD
-  install_name_tool -change @rpath/libmariadb.3.dylib\
+  # Replace @rpath name by full path in the installed file,
+  # to trigger macdeployqt to pick up this library.
+  # This is a hack, but it works. we need to revert it
+  # after macdeployqt has run.
+  install_name_tool -change @rpath/libmariadb.3.dylib \
                 "$INSTALL_DIR"/lib/libmariadb.3.dylib \
         $QT_DIR/plugins/sqldrivers/libqsqlmysql.dylib
 
   file $QT_DIR/plugins/sqldrivers/libqsqlmysql.dylib
-  file $SQL_BUILD/plugins/sqldrivers/libqsqlmysql.dylib
   otool -L $QT_DIR/plugins/sqldrivers/libqsqlmysql.dylib
 }
 
 OSSL_MAJOR="3"
-OSSL="openssl-3.3.2"
+OSSL="openssl-3.4.1"
 XCA_DIR="$(cd `dirname $0`/.. && pwd)"
 TOP_DIR="`dirname $XCA_DIR`"
-QT_DIR="$TOP_DIR/6.6.3/macos"
+QT_DIR="$TOP_DIR/6.8.3/macos"
+QT_SQL_SRC="$QT_DIR/../Src/qtbase/src/plugins/sqldrivers"
 
 BUILDDIR="$TOP_DIR/osx-release-dmg"
 BUILDDIR_APPSTORE="$TOP_DIR/osx-release-appstore"
@@ -121,11 +131,13 @@ cd $TOP_DIR
 do_openssl
 #do_zstd
 #do_mariadb_connector_c
-# aqt install-src mac 6.6.3 --archives qtbase
-# qtbase/src/plugins/sqldrivers/mysql/CMakeLists.txt:
-#    -qt_internal_force_macos_intel_arch(QMYSQLDriverPlugin)
-do_qsqlmysql
+#do_postgres
+# aqt install-src mac 6.8.3 --archives qtbase
+if grep qt_internal_force_macos_intel_arch $QT_SQL_SRC/mysql/CMakeLists.txt; then
+  (cd $QT_SQL_SRC && patch -p5 < $XCA_DIR/misc/qsqlmysql.patch)
+fi
 
+do_qsql
 
 cmake -B "$BUILDDIR" "$XCA_DIR" \
 	-DCMAKE_OSX_ARCHITECTURES="arm64;x86_64" \
@@ -135,12 +147,6 @@ cmake -B "$BUILDDIR" "$XCA_DIR" \
 
 cmake --build "$BUILDDIR" -j$JOBS
 
-if test -d /Applications/Postgres.app; then
-	echo "###### Hey Christian, rename /Applications/Postgres.app when linking, to skip those drivers !!"
-	# If the Postgres.app exists, macdeployqt will take that libpg.dylib and
-	# install it inside XCA. This destroys other links to libssl-1.1 ...
-	# Let the users install /Applications/Postgres.app
-fi
 (cd "$BUILDDIR" && cpack)
 
 ######## Create the AppStore Package
@@ -156,3 +162,10 @@ read xca_version < "$BUILDDIR_APPSTORE"/PKGVERSION.txt
 cmake --build "$BUILDDIR_APPSTORE" -j$JOBS
 productbuild --component "$BUILDDIR_APPSTORE/xca.app" /Applications \
     --sign "3rd Party Mac Developer Installer" "$BUILDDIR_APPSTORE/xca-${xca_version}-appstore.pkg"
+
+if find "${BUILDDIR_APPSTORE}/xca.app" "${BUILDDIR}/xca.app" -name "*.dylib" | xargs otool -L | grep -e "/Applications/\|\t$HOME"
+then
+  echo
+  echo "Error: some libraries are linked to /Applications or $HOME"
+  exit 1
+fi
diff --git a/release/build-w64.sh b/release/build-w64.sh
index cf57ff27..d34044e9 100644
--- a/release/build-w64.sh
+++ b/release/build-w64.sh
@@ -1,6 +1,7 @@
 #!/bin/sh
 
 # in C:\msys64\msys2.ini: MSYS2_PATH_TYPE=inherit
+# pacman -S vim make zip
 
 # Build xca on Windows 
 do_openssl() {
@@ -13,19 +14,18 @@ do_openssl() {
   make install
 }
 
-OSSL="openssl-3.3.2"
+OSSL="openssl-3.4.1"
 XCA_DIR="$(cd `dirname $0`/.. && pwd)"
 TOP_DIR="`dirname $XCA_DIR`"
-QT_DIR="$TOP_DIR/QT/6.8.0/mingw_64"
 BUILDDIR="$TOP_DIR/w64-release"
-INSTALL_DIR="/c/OpenSSL"
+INSTALL_DIR="$TOP_DIR/OpenSSL"
 JOBS=7
 
 cd $TOP_DIR
 do_openssl
 
 cd $TOP_DIR
-cmake -B "$BUILDDIR" -G "MinGW Makefiles" -DCMAKE_PREFIX_PATH="$QT_DIR:$INSTALL_DIR" $XCA_DIR
-cmake --build "$BUILDDIR" -j5
+cmake -B "$BUILDDIR" -G "MinGW Makefiles" -DCMAKE_PREFIX_PATH="$INSTALL_DIR" $XCA_DIR
+cmake --build "$BUILDDIR" -j$JOBS
 cmake --build "$BUILDDIR" -t install
 cd "$BUILDDIR" && cpack
diff --git a/release/osslsign.sh b/release/osslsign.sh
index 3664a84c..88d65e86 100755
--- a/release/osslsign.sh
+++ b/release/osslsign.sh
@@ -1,6 +1,5 @@
 #!/bin/sh
 
-if test -z "$1"; then echo "usage: $0 <filename>"; exit 1; fi
 
 set -x
 V="${1##*xca-}"
@@ -20,11 +19,33 @@ case "$OSTYPE" in
 esac
 pkcs11_id="9d8aad00d9fa2bc1f104e9744108d4551b53d2b7"
 
-osslsigncode sign \
+do_sign()
+{
+  echo "#### Signing $1"
+  osslsigncode sign \
   -key "$pkcs11_id" -pkcs11cert "$pkcs11_id" \
   -pkcs11engine "$engine" -pkcs11module "$module" \
   -n "XCA ${V}" -i https://hohnstaedt.de/xca \
   -t http://timestamp.comodoca.com -h sha2 \
   -in "${1}" -out "${1}.signed" &&
 
-exec mv "${1}.signed" "${1}"
+  mv "${1}.signed" "${1}"
+}
+
+case "$1" in
+  xca-portable-*.zip)
+    unzip "$1"
+    for file in xca-portable-*/lib*.dll xca-portable-*/xca.exe; do
+      test -f "$file"
+      do_sign "$file"
+    done
+    rm -f "$1"
+    zip "$1" xca-portable-*
+    ;;
+  *.msi|*.exe)
+    do_sign "$1"
+    ;;
+  *)
+    echo "Unexpected file : $1"
+    ;;
+esac
diff --git a/release/release.txt b/release/release.txt
index f9fde31f..c25bb4e7 100644
--- a/release/release.txt
+++ b/release/release.txt
@@ -25,6 +25,14 @@ xcrun notarytool submit "$DMG" --keychain-profile "AC_PASSWORD" --key-id HWR8GSJ
 
 xcrun stapler staple "$DMG"
 
+MS Code signing
+---------------
+Currently only works on MAC....
+
+./release/osslsign.sh xca-portable-*.zip
+./release/osslsign.sh xca-*.msi
+
+
 Microsoft Store
 -----------------
 OpenSSL:
diff --git a/widgets/CertExtend.cpp b/widgets/CertExtend.cpp
index 75df37ec..44386f3f 100644
--- a/widgets/CertExtend.cpp
+++ b/widgets/CertExtend.cpp
@@ -37,6 +37,25 @@ void CertExtend::on_applyTime_clicked()
 				     validRange->currentIndex());
 }
 
+void CertExtend::on_keepSerial_toggled(bool checked)
+{
+	if (checked) {
+		old_revoke = revoke->isChecked();
+		revoke->setEnabled(false);
+		revoke->setChecked(false);
+
+		old_replace = replace->isChecked();
+		replace->setEnabled(false);
+		replace->setChecked(true);
+	} else {
+		revoke->setEnabled(true);
+		revoke->setChecked(old_revoke);
+
+		replace->setEnabled(true);
+		replace->setChecked(old_replace);
+	}
+}
+
 void CertExtend::accept()
 {
 	if (signer && notBefore->getDate() < signer->getNotBefore()) {
diff --git a/widgets/CertExtend.h b/widgets/CertExtend.h
index 92ca9004..e1317561 100644
--- a/widgets/CertExtend.h
+++ b/widgets/CertExtend.h
@@ -18,12 +18,15 @@ class CertExtend: public QDialog, public Ui::CertExtend
 	Q_OBJECT
 
 	pki_x509 *signer{};
+	bool old_replace{};
+	bool old_revoke{};
 
    public:
 	CertExtend(QWidget *parent, pki_x509 *s);
 
    public slots:
 	void on_applyTime_clicked();
+	void on_keepSerial_toggled(bool);
 	void accept();
 
 };
diff --git a/widgets/KeyDetail.cpp b/widgets/KeyDetail.cpp
index 2dcae74f..913560b6 100644
--- a/widgets/KeyDetail.cpp
+++ b/widgets/KeyDetail.cpp
@@ -50,9 +50,9 @@ void KeyDetail::setupFingerprints(pki_key *key)
 	v->addWidget(widget);
 	v->addStretch();
 
-	QStringList sl; sl <<
-		"ssh MD5" << "ssh SHA256 B64" <<
-		"x509 SHA1" << "DER SHA256";
+	QStringList sl = { "x509 SHA1", "DER SHA256" };
+	if (key->SSH2_compatible())
+		sl += QStringList({ "ssh MD5", "ssh SHA256 B64" });
 
 	foreach(QString type, sl) {
 		qDebug() << type << key->fingerprint(type);