diff --git a/NewX509.cpp b/NewX509.cpp index 90d8d7ca..969ff3e5 100644 --- a/NewX509.cpp +++ b/NewX509.cpp @@ -482,3 +482,8 @@ void NewX509::newKeyDone(QString name) keyList->setCurrentItem(0); dataChangeP2(); } + +void NewX509::helpClicked() +{ + QWhatsThis::enterWhatsThisMode(); +} diff --git a/NewX509.h b/NewX509.h index f631f039..06b401d2 100644 --- a/NewX509.h +++ b/NewX509.h @@ -63,6 +63,7 @@ #include #include #include +#include #include #include #include @@ -109,6 +110,7 @@ class NewX509: public NewX509_UI void switchExtended(); void templateChanged(); void signerChanged(); + void helpClicked(); signals: void genKey(); diff --git a/NewX509_UI.ui b/NewX509_UI.ui index 72ed22c3..dee4f8ad 100644 --- a/NewX509_UI.ui +++ b/NewX509_UI.ui @@ -11,7 +11,7 @@ 0 0 - 652 + 648 531 @@ -24,10 +24,6 @@ caption X Certificate and Key management - - whatsThis - hjfghjgfhjfghj - QWidget @@ -334,6 +330,18 @@ name reqList + + whatsThis + A certificate signing request can be signed, even if the +private key of the request is not available. This is the +actually the intention of a CSR: + +Getting signed by a CA certificate, whoes certificate +of course must be in the database + +Of course you need the private key of the CSR if you want +to create a self-signed cert from it. + @@ -428,6 +436,13 @@ toolTip All certificates in your database that can create valid signatures + + whatsThis + This list contains all certificates with the CA-flag set to true +and whoes private key is present in the key database. + +If this list is disabled, you only can create a self-signed certificate. + @@ -495,6 +510,18 @@ 0 + + toolTip + All available templates + + + whatsThis + This list contains all templates from the toplevel template +Tab. + +Additionally it contains 4 default templates: +Empy, CA, client, server + QCheckBox @@ -905,6 +932,10 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"text &Generate a new key + + toolTip + This funny button creates a key. Go figure. + @@ -1115,6 +1146,17 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"toolTip If this will become a CA certificate or not + + whatsThis + Set this to TRUE if you want to create a CA certificate +that signs other certificates. + +This is always set to FALSE for client or server certificates. + +In most cases self-signed certificates are CA certificates. +Self-signed non-CA certificates are unusual although +they are possible. + QLabel @@ -1135,7 +1177,18 @@ For a SSL servercertificate choose the DNS name of the server as "Common name" toolTip - How much CA may be below this. + How much CAs may be below this. + + + whatsThis + If this is left empty the pathlen is not included in the +certificate. +Otherwise it distinguishes the count of chained CA certificates below this one. + +A pathlen of 0 means, that this certificate may not issue +other sub-CA certificates. +Although it can do it, all chain-checking algorithms in +e.g. your browser or openssl will (should) fail. @@ -1148,6 +1201,10 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"text &Critical + + toolTip + The basic constraints should always be critical but they need not + @@ -1182,7 +1239,7 @@ For a SSL servercertificate choose the DNS name of the server as "Common name" toolTip - Wether to create a + Creates a hash of the key following the PKIX guidelines @@ -1195,6 +1252,18 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"text &Authority Key Identifier + + toolTip + Copy the Subject Key Identifier from the issuer + + + whatsThis + If this box is checked an attempt is made to copy the subject key +identifier from the signing certificate. + +It also copies the issuer and serial number from the issuer +certificate. Normally this will only be done if the keyid option fails. + @@ -1234,6 +1303,20 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"text 365 + + toolTip + Number of validity + + + whatsThis + The validation time period is counted from "now" of your +system clock the amount of time entered here. + +It is not possible to adjust the starting time of a certificate. +This is a weakness of this program based on the laziness +of the programmer and not a weakness of certificates +or OpenSSL. + QComboBox @@ -1312,7 +1395,7 @@ For a SSL servercertificate choose the DNS name of the server as "Common name" toolTip - Wether to copy the subj. alt. name of the issuer + Wether to copy the subj. alt. name from the issuer @@ -1358,6 +1441,10 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"text Copy &e-mail address from subject line + + whatsThis + This will automatically include any email addresses contained in the certificate subject name in the extension. + QLineEdit @@ -1367,7 +1454,19 @@ For a SSL servercertificate choose the DNS name of the server as "Common name" toolTip - Valid IDs: DNS: IP: URL: email: + DNS: IP: URI: email: RIP: + + + whatsThis + The issuer alternative name extension allows various literal values to be used. +These include "email" (an email address) +"URI" a uniform resource indicator, "DNS" (a DNS domain name), RID (a +registered ID: OBJECT IDENTIFIER) and IP (an IP address). + +Examples: + +email:my@other.address, IP: 1.1.1.1 , URI:http://my.url.here/ +email:my@other.address, RID:1.2.3.4, DNS: ns.server.tld @@ -1378,7 +1477,19 @@ For a SSL servercertificate choose the DNS name of the server as "Common name" toolTip - Valid IDs: DNS: IP: URL: email: + DNS: IP: URI: email: RIP: + + + whatsThis + The subject alternative name extension allows various literal values to be used. +These include "email" (an email address) +"URI" a uniform resource indicator, "DNS" (a DNS domain name), RID (a +registered ID: OBJECT IDENTIFIER) and IP (an IP address). + +Examples: + +email:my@other.address, IP: 1.1.1.1 , URI:http://my.url.here/ +email:my@other.address, RID:1.2.3.4, DNS: ns.server.tld @@ -1387,6 +1498,27 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"name crlDist + + whatsThis + This is a multi-valued extension that supports all the literal options of +subject alternative name. Of the few software packages that currently interpret +this extension most only interpret the URI option. + +Currently each option will set a new DistributionPoint with the fullName +field set to the given value. + +Other fields like cRLissuer and reasons cannot currently be set or displayed: +at this time no examples were available that used these fields. + +If you see this extension with <UNSUPPORTED> when you attempt to print it out +or it doesn't appear to display correctly then let me know, including the +certificate (mail me at steve@openssl.org) . + +Examples: + +URI:http://www.myhost.com/myca.crl +URI:http://www.my.com/my.crl, URI:http://www.oth.com/my.crl + @@ -2362,8 +2494,15 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"NewX509_UI dataChangeP2() + + NewX509_UI + helpClicked() + NewX509_UI + helpClicked() + dataChangeP2() newKey() + helpClicked() signerChanged() switchExtended() templateChanged()