The_Great_Archive/xca
1
0
Fork 0
mirror of https://github.com/chris2511/xca.git synced 2026-09-14 11:06:19 +05:00
Code Issues Actions Packages Projects Releases Wiki Activity

pkcs7 export repaired and enhanced

Browse Source 
documentation updated
This commit is contained in:
chris2511 2003-11-25 19:34:01 +00:00
parent f44d717c3e
commit 70296ed6fb
4 changed files with 112 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

110
doc/xca.sgml
View File

@ -39,7 +39,7 @@ All datastructures (Keys, Certificate signing requests, Certificates and Templat
and exported in several formats like DER or PEM.
Import means reading a file from the filesystem and storing the datastructure
into the databasefile, while exporting means to write the datastructure
from the databasefile to the filesystem to be e.g imported to an other application.
from the databasefile to the filesystem to be e.g imported into an other application.
<p>
When starting the application the first time, it needs a password to encrypt the
@ -61,7 +61,7 @@ other applications.
<itemize>
<item><bf>DER</bf> <bf>D</bf>istinguished <bf>E</bf>ncoding <bf>R</bf>ules is the binary ASN.1 encoding of the data.
<item><bf>PEM</bf> <bf>P</bf>rivacy-<bf>E</bf>nhanced <bf>M</bf>ail is the base64 encoded version of the
<bf>DER</bf> formatted data with additional header and footer lines to be transported via e.g. E-mail
<bf>DER</bf> formated data with additional header and footer lines to be transported via e.g. E-mail
<item><bf>PKCS&num;X</bf> <bf>P</bf>ublic <bf>K</bf>ey <bf>C</bf>ryptography <bf>S</bf>tandards
published by <url url="http://www.rsasecurity.com" name="RSA Laboratories">
@ -140,6 +140,9 @@ Ilya Kozhevnikov &lt;ilya (at) ef.unn.ru&gt;
Paul Kirner &lt;kirner (at) fhwgt.de&gt;
Providing compile and test hardware
Wolfgang Glas &lt;wolfgang.glas (at) ev-i.at&gt;
Implementation of SPKAC and UTF8 support
Bugreports and feature input:
Frank Werner &lt;Frank (at) WeSoft.de&gt;
Peter Bieringer &lt;pb (at) bieringer.de&gt;
@ -157,18 +160,20 @@ Next to the usual X commandline options. There are the following
<itemize>
<item>-v show version information and exit
<item>-k expect all following non-option arguments to be RSA keys
<item>-r expect all following non-option arguments to be Certificate signing requests
<item>-r expect all following non-option arguments to be
Certificate signing requests or SPKAC requests
<item>-c expect all following non-option arguments to be Certificates
<item>-p expect all following non-option arguments to be PKCS#12 files
<item>-7 expect all following non-option arguments to be PKCS#7 files
<item>-l expect all following non-option arguments to be Revokation lists
<item>-t expect all following non-option arguments to be Xca templates
<item>-x Exit after processing all commandline options
</itemize>
<p>
when invoked with one of the -k -r -c -p options, the application
will show the details of the items and import it into the database
if desired and exit after that.
when invoked with one of the -k -r -c -p -7 options, the application
will show the details of the items and import it into the database.
If the application should exit afterwards, just supply the -x option.
This behaviour enables xca to be used as default application for viewing
PKI items.
@ -176,7 +181,9 @@ PKI items.
<sect>Common actions
<p>
Many actions are common to all crypto parts.
Many actions are common to all crypto parts and are mentioned here once for all.
The goal of this application is to provide an easy to use signing-tool and
also a common place for all selected PKI items like requests or Certificates.
<sect1>Importing items
<p>
The import of an item can be done by either clicking the import button on the right
@ -184,7 +191,7 @@ or via the context menu available by right clicking on the list background.
The import function is smart enough to probe all known formats as there are:
<itemize>
<item><em>Keys:</em> PEM private key, PEM public key, DER private key, DER public key, PKCS#8 private key.
<item><em>Requests</em> DER request, PEM request.
<item><em>Requests</em> DER request, PEM request, Netscape SPKAC request.
<item><em>Certificates</em> DER certificate, PEM certificate (PKCS#12 and PKCS#7 certificates
must be imported with an extra button, because they can contain more than one certificate)
</itemize>
@ -196,7 +203,7 @@ It is possible to select more than one file by selecting them with SHIFT click.
When importing more than one Key, CRL, Certificate or Request
all items are shown in a Multi-Import dialog.
When importing a PKCS#7 or PKCS#12 item, the contained Keys and Certificates are shown in the import dialog.
In the import dialog the items can be examined, imported or dropped.
By using the import dialog the items can be examined, imported or dropped.
<p>
After reading the item it searches for this item in the database and if it is unique the item
@ -207,7 +214,7 @@ in the database.
<p>
The details dialog can be accessed by double clicking the item, by the context menu or by
the button on the right.
The names of the issuers certificate and the corresponding key are "clickable" and there
The names of the issuers certificate and the corresponding key are "clickable" and their
content will be shown on "double-click"
<sect1>Renaming an item
@ -222,7 +229,7 @@ will be appended to keep the internal name unique.
Items can be deleted by the button on the right or via the context menu.
If a certificate signed by this application is going to be removed
the application will warn you once more, because you can not revoke a
deleted certificate. So only delete a certificate signed by you
deleted certificate. Thus only delete a certificate signed by you
if you never exported it. Certificate signing requests can be deleted
when they got signed, because they are not needed anymore.
The request can be recovered from the resulting certificate by
@ -265,10 +272,10 @@ On this Page all personal data like country, name and Email address
can be filled in. Only the <tt>Internal name</tt> is mandatory.
The <tt>Country code</tt> field must either be empty or exactly contain
two letters representing your country code; e.g. <em>DE</em> for Germany.
If you want to create a SSL-server certificate the <tt>Common name</tt>
If you want to create an SSL-server certificate the <tt>Common name</tt>
must contain the <em>DNS</em> name of the server.
<p>
Other rather used <tt>name-entries</tt> can be selected in the dialog
Other rarely used <tt>name-entries</tt> can be selected in the dialog
below. Only such items are recognized that were added using the <tt>add</tt>
button. All items can be added more tha once, even those from above.
This is not very usual but allowed.
@ -276,7 +283,7 @@ This is not very usual but allowed.
<p>
Keys can be generated here <em>on the fly</em> by pressing the button.
If there is no usable key and you need one,
they key generation process will be invoked automatically.
the key generation process will be invoked automatically.
The newly generated key will be stored in the database and stay there,
even if you cancel the Wizard later. The drop-down list of the keys
does only contain keys that were not used by any other certificate or
@ -292,7 +299,7 @@ It is not in the focus of this document to explain them in detail.
The most important are the <tt>Basic Constraints</tt> and the <tt>Validity</tt> range.
<p>
For more information consult the documents in <ref id="otherdoc">.
Expecially if you don't know what this is all about consider not to create any
Especially if you don't know what this is all about consider not to create any
certificates before reading those documents.
<sect2>Basic Constraints
@ -327,6 +334,8 @@ the keys with a use counter of 0.
<sect1>Generating Keys
<p>
The dialog asks for the internal name of the key and the keysize in bits.
Even if the drop-down list only shows the most usual values, any other value
can be added here by editing this box.
While searching for random prime numbers a progress bar is shown. Although the
Progressbar carries a <tt>Cancel</tt> button it has no effect clicking on it
since the underlaying <em>OpenSSL</em> routine does not support an abort.
@ -336,7 +345,7 @@ After the key generation is done the key will be stored in the database.
<sect1>Key export
<p>
Keys can be exported by either selecting the key and pressing <em>Export</em> or by
using the context-menu. This opens a Dialogbox where you can change the following settings:
using the context-menu. This opens a Dialogbox where the following settings cn be adjusted:
<itemize>
<item>filename
<item>Outputformat (DER, PEM, PKCS#8)
@ -344,9 +353,8 @@ using the context-menu. This opens a Dialogbox where you can change the followin
<item>Encryption of the exported file (yes/no)
</itemize>
The filename is the internal name plus a <tt>pem</tt> suffix.
If the desired fileformat is not PEM it is your responsibility
to change the suffix to <tt>der</tt> or <tt>pk8</tt>.
The filename is the internal name plus a <tt>pem</tt>, <tt>der</tt> or <tt>pk8</tt> suffix.
When changing the fileformat, the suffix of the filename changes accordingly
Only PKCS&num;8 or PEM files can be encrypted, because
the DER format (although it could be encrypted)
does not support a way to supply the encryption algorithm
@ -363,6 +371,9 @@ They are used to supply a Certification Authority with the
needed information to issue a valid certificate for you
without knowing your private key. This
includes your personal information and your public key.
<p>
Netscape SPKAC files can not be created or exported, but they can be imported and signed.
This requests are marked in the Signature field as SPKAC and they do carry a netscape icon.
<sect1>Generating a new Request
<p>
@ -374,11 +385,8 @@ In this case all needed data is copied from the certificate and the Wizard is no
<sect1>Request export
<p>
Requests can be exported by either the context-menu or by selecting the request and pressing
the <tt>Export</tt> button.
The only supported format for exported requests is PEM, because there is no need for
DER formatted requests in real life. If someone needs DER formatted requests, drop me
a mail and I will implement it.
Requests can be exported only by the context-menu. There is a sub-menu to select PEM or DER format.
The filename can be selected in the next dialog.
<sect1>Request details
<p>
@ -407,10 +415,10 @@ the signature to decide which certificate is the issuer.
<sect1>Generating certificates
<p>
After clicking on the <tt>New Certificate</tt> button the Certificate Wizard will be started to ask
all needed information for generating a new Request. See: <ref id="wizard" name="Wizard">
all needed information for generating a new Certificate. See: <ref id="wizard" name="Wizard">
Certificate creation can also be invoked by the context menu of the certificate list background
or by the context menu of the request.
In this case the Wizard is preset with the Request to be signedi.
In this case the Wizard is preset with the Request to be signed.
<p>
If in the certificate list a <em>CA certificate</em> is selected, this
certificate is preselected as signer certificate on the second page of the Wizard.
@ -420,7 +428,7 @@ certificate is preselected as signer certificate on the second page of the Wizar
The signer is the internal name of the issuers certificate, <em>SELF SIGNED</em> if it is
self signed or <em>SIGNER UNKNOWN</em> if the issuers certificate is not available.
The validity is set to <em>valid</em> if the certificate dates are valid
or to <em>Not valid</em> if the are not, regarding the internal time and date of the OS.
or to <em>Not valid</em> if the are not, regarding to the internal time and date of the OS.
<p>
If the certificate was revoked, the revocation date is shown instead.
@ -450,7 +458,12 @@ that are marked als <em>Always trusted</em> (usually all self-signed certificate
in one file for e.g. apache as trusted cert store.
<item><bf>PEM all Certificates</bf> - All PEM encoded certificates in one file.
<item><bf>DER</bf> - DER encoded certificate.
<item><bf>Signed PKCS#7</bf> - PEM encoded PKCS#7 structure signed by the issuer.
<item><bf>PKCS#7</bf> - DER encoded PKCS#7 structure containing the certificate.
<item><bf>PKCS#7 with Certificate chain</bf> - DER encoded PKCS#7 structure containing the
certificate and all issuers up to the root certificate.
<item><bf>PKCS#7 all trusted Certificates</bf> - DER encoded PKCS#7 structure containing all
certificates that are marked als <em>Always trusted</em>
<item><bf>PKCS#7 all Certificates</bf> - DER encoded PKCS#7 structure containing all certificates.
<item><bf>PKCS#12</bf> - PKCS#12 structure containing the certificate and the corresponding
<item><bf>PKCS#12</bf> - PKCS#12 structure containing the certificate, the corresponding
private key and the chain of all issuers certificates.
@ -508,6 +521,47 @@ then a Certificate Revokation List should be created and will be stored in the
database.
<p>
<sect>Appendix
<p>
Here one can find several examples for file formats:
<sect1>PEM
<p>
<tscreen><verb>
-----BEGIN CERTIFICATE-----
MIIC0zCCAjygAwIBAgIQKNOqLomUfJxugwU5FHGCSjANBgkqhkiG9w0BAQQFADBf
MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsT
LkNsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw
HhcNOTcxMDEzMDAwMDAwWhcNMDQwMTA1MjM1OTU5WjBDMREwDwYDVQQKEwhWZXJp
U2lnbjEuMCwGA1UECxMlVmVyaVNpZ24gQ2xhc3MgMiBPblNpdGUgSW5kaXZpZHVh
bCBDQTCBnTANBgkqhkiG9w0BAQEFAAOBiwAwgYcCgYEA3CqZnW4z/LtBdsQ5Ho33
dueQD3RVYWFyPPg3SxsfCOkwHXDFFolgM0ZIf8bQmj12mMOhwaxS0Re5FARphlxh
T7NlZYtjou4hfEGvrXJAw02Rs0m+mPtXx1ousEun7wkk84GdOMWS2kqnmFGp2DB2
LWrWry9+2xEqhftlYFpF6BsCAQOjga0wgaowDwYDVR0TBAgwBgEB/wIBADBEBgNV
HSAEPTA7MDkGC2CGSAGG+EUBBwEBMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3
LnZlcmlzaWduLmNvbS9ycGEwMQYDVR0fBCowKDAmoCSgIoYgaHR0cDovL2NybC52
ZXJpc2lnbi5jb20vcGNhMi5jcmwwCwYDVR0PBAQDAgEGMBEGCWCGSAGG+EIBAQQE
AwIBBjANBgkqhkiG9w0BAQQFAAOBgQCeTebTWFTbJFzaxCsD3432QbAsiAng0VcA
OzlDYn1BMIRT0NsrJbeTjQ8cOmvCkgesEPYsm+SniOktibXDJT+n87Can4+0CQBx
qUUsBUoG0PtMGjH4Vr/QD5sG8cMecG3FJR4CWwKitoz47h7sxM50B6RB9je1eIvS
1NMPRGO1nQ==
-----END CERTIFICATE-----
</verb></tscreen>
<sect1>SPKAC
<p>
<tscreen><verb>
SPKAC=MIIBPzCBqTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAw9eRsqOS9k
gd5Wk5Z2OWLCB8TuYlhRKpvfdIh6dZBERIQ/7xojDhOeg235Y/iWR0Jj9pXLOz2Q
dL7ppUwsGCnXXQGCdTG4OXAziBZTcLoMIxHzIvJ9pgX3APsuEWospGJzDPQv0sup
GCEiQK6qzAFa5BISQpIczHufBFGtLbGesCAwEAARYFaGVsbG8wDQYJKoZIhvcNAQ
EEBQADgYEAZOCMay68W5629GI/fj0R7AGJBQBCu79KtAxcnmiDhI4ELWIoB04wJg
GqlcdCY6eo1CHZN9LNVltzSUghVl/zPwaBFodhI6CbSnMfk+nkPa2psXQXoQs2+1
7QPXfOlqDvqyOhwGFnPDMYSLeYVwQjh/Miov+vPV5+8Qhc2owuh9A=
CN=Fred vom Jupiter
O=Jupiter Gas Ltd.
OU=CRM inner planets
L=Jupiter
</verb></tscreen>
<!-- %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% -->
</article>

23
view/CertView.cpp
View File

@ -362,6 +362,7 @@ void CertView::loadPKCS7()
#define P7_ONLY 0
#define P7_CHAIN 1
#define P7_TRUSTED 2
#define P7_ALL 3
void CertView::store()
{
@ -409,16 +410,19 @@ void CertView::store()
case 5: // P7 lonely
writePKCS7(fname, P7_ONLY);
break;
case 6: // P12
case 6: // P7
writePKCS7(fname, P7_CHAIN);
break;
case 7: // P12
case 7: // P7
writePKCS7(fname, P7_TRUSTED);
break;
case 8: // P12
case 8: // P7
writePKCS7(fname, P7_ALL);
break;
case 9: // P12
writePKCS12(fname,false);
break;
case 9: // P12 + cert chain
case 10: // P12 + cert chain
writePKCS12(fname,true);
break;
@ -483,7 +487,16 @@ void CertView::writePKCS7(QString s, int type)
if (type == P7_TRUSTED) {
list = db->getContainer();
if (!list.isEmpty()) {
for ( cer = list.first(); cer != NULL; cer = list.next() ) {
for ( cer = list.first(); cer != NULL; cer = list.next() ) {
if (((pki_x509*)cer)->getTrust() == 2)
p7->addCert((pki_x509 *)cer);
}
}
}
if (type == P7_ALL) {
list = db->getContainer();
if (!list.isEmpty()) {
for ( cer = list.first(); cer != NULL; cer = list.next() ) {
p7->addCert((pki_x509 *)cer);
}
}

3
widgets/ExportCert.cpp
View File

@ -70,6 +70,7 @@ ExportCert::ExportCert(QString fname, bool hasKey, QString dpath,
exportFormat->insertItem("PKCS #7");
exportFormat->insertItem("PKCS #7 with Certificate chain");
exportFormat->insertItem("PKCS #7 all trusted Certificates");
exportFormat->insertItem("PKCS #7 all Certificates");
if (hasKey) {
exportFormat->insertItem("PKCS #12");
exportFormat->insertItem("PKCS #12 with Certificate chain");
@ -103,7 +104,7 @@ void ExportCert::chooseFile()
void ExportCert::formatChanged()
{
char *suffix[] = {"crt", "crt", "crt", "crt", "cer", "p7b", "p7b", "p7b", "p12", "p12"};
char *suffix[] = {"crt", "crt", "crt", "crt", "cer", "p7b", "p7b", "p7b", "p7b", "p12", "p12"};
int selected = exportFormat->currentItem();
QString fn = filename->text();
QString nfn = fn.left(fn.findRev('.')+1) + suffix[selected];

20
widgets/MainWindow.cpp
View File

@ -282,16 +282,16 @@ void MainWindow::read_cmdline()
void MainWindow::cmd_help(const char* msg) {
printf(" -c : The following arguments are X509 certificates
-r : The following arguments are PKCS10 requests
-k : The following arguments are RSA keys
-p : The following arguments are PKCS#12 files
-7 : The following arguments are PKCS#7 files
-l : The following arguments are CRLs
-t : The following arguments are XCA templates
-v : Print name and version number
-d : The following argument is the database name
-x : exit the application after managing the commandline args ");
printf(" -v show version information and exit
-k expect all following non-option arguments to be RSA keys
-r expect all following non-option arguments to be
Certificate signing requests or SPKAC requests
-c expect all following non-option arguments to be Certificates
-p expect all following non-option arguments to be PKCS#12 files
-7 expect all following non-option arguments to be PKCS#7 files
-l expect all following non-option arguments to be Revokation lists
-t expect all following non-option arguments to be XCA templates
-x Exit after processing all commandline options");
qFatal("Cmdline Error (%s)\n", msg);
}