The_Great_Archive/xca
1
0
Fork 0
mirror of https://github.com/chris2511/xca.git synced 2026-09-12 19:51:05 +05:00
Code Issues Actions Packages Projects Releases Wiki Activity

CRL support enhanced

Browse Source 
Prosa added
This commit is contained in:
chris2511 2003-04-16 21:56:24 +00:00
parent 3156083906
commit bc793b0162
8 changed files with 149 additions and 106 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
CertDetail.ui
View File

@ -11,7 +11,7 @@
<rect>
<x>0</x>
<y>0</y>
<width>569</width>
<width>561</width>
<height>446</height>
</rect>
</property>
@ -70,6 +70,14 @@
<underline>1</underline>
</font>
</property>
<property stdset="1">
<name>frameShape</name>
<enum>MShape</enum>
</property>
<property stdset="1">
<name>frameShadow</name>
<enum>MShadow</enum>
</property>
<property stdset="1">
<name>text</name>
<string>Details of the Certificate</string>
@ -448,10 +456,6 @@
<name>text</name>
<string>not available</string>
</property>
<property stdset="1">
<name>alignment</name>
<set>AlignCenter</set>
</property>
<property>
<name>hAlign</name>
</property>
@ -503,6 +507,10 @@
<name>frameShadow</name>
<enum>Sunken</enum>
</property>
<property>
<name>toolTip</name>
<string>The serial number of the certificate</string>
</property>
</widget>
<widget row="0" column="1" rowspan="1" colspan="3" >
<class>QLineEdit</class>
@ -778,10 +786,6 @@
<name>text</name>
<string>SELF SIGNED </string>
</property>
<property stdset="1">
<name>alignment</name>
<set>AlignCenter</set>
</property>
<property>
<name>hAlign</name>
</property>

18
CrlDetail.ui
View File

@ -11,7 +11,7 @@
<rect>
<x>0</x>
<y>0</y>
<width>542</width>
<width>538</width>
<height>381</height>
</rect>
</property>
@ -450,7 +450,7 @@
</property>
<property>
<name>toolTip</name>
<string>The internal name of the RSA key in the key database</string>
<string>The status of the CRL signature</string>
</property>
</widget>
<widget row="2" column="2" >
@ -505,7 +505,7 @@
</property>
<property>
<name>toolTip</name>
<string>The internal name of the certificate in the database</string>
<string>The internal name of the CRL in the database</string>
</property>
</widget>
<widget row="0" column="0" >
@ -843,10 +843,6 @@
<name>frameShadow</name>
<enum>Sunken</enum>
</property>
<property>
<name>toolTip</name>
<string>An md5 hashsum of the certificate</string>
</property>
</widget>
<widget row="1" column="0" >
<class>QLabel</class>
@ -873,10 +869,6 @@
<name>frameShadow</name>
<enum>Sunken</enum>
</property>
<property>
<name>toolTip</name>
<string>A SHA-1 hashsum of the certificate</string>
</property>
</widget>
</grid>
</widget>
@ -928,6 +920,10 @@
<name>name</name>
<cstring>certList</cstring>
</property>
<property>
<name>toolTip</name>
<string>A list of all revoked certificates</string>
</property>
</widget>
</vbox>
</widget>

6
ExportKey_UI.ui
View File

@ -11,7 +11,7 @@
<rect>
<x>0</x>
<y>0</y>
<width>595</width>
<width>591</width>
<height>375</height>
</rect>
</property>
@ -310,6 +310,10 @@ PKCS#8 is an encrypted official Key-exchange format</string>
<name>text</name>
<string>E&amp;xport the private part of the Key too</string>
</property>
<property>
<name>toolTip</name>
<string>When exporting the private part, it should be encrypted.</string>
</property>
</widget>
<widget>
<class>QCheckBox</class>

8
MainWindowCrl.cpp
View File

@ -81,7 +81,7 @@ bool MainWindow::showDetailsCrl(pki_crl *crl, bool import)
iss = certs->getBySubject(crl->getIssuerX509_NAME());
numc = crl->numRev();
dlg->certList->clear();
dlg->certList->addColumn(tr("Common Name"));
dlg->certList->addColumn(tr("Name"));
dlg->certList->addColumn(tr("Serial"));
dlg->certList->addColumn(tr("Revokation"));
CERR("NUMBER:" << numc);
@ -95,11 +95,17 @@ bool MainWindow::showDetailsCrl(pki_crl *crl, bool import)
current->setText(1, rev->getSerial().c_str() );
current->setText(2, rev->revokedAt(TIMEFORM_SORTABLE).c_str());
}
else {
current = new QListViewItem(dlg->certList, "Unknown" );
}
}
dlg->v3Extensions->setText(crl->printV3ext().c_str());
dlg->issuer->setText(iss->getDescription().c_str());
if (crl->verify(iss->getKey()) == 0) {
dlg->signCheck->setText(tr("Success"));
}
connect( dlg->certList, SIGNAL( doubleClicked(QListViewItem*) ),
this, SLOT( showDetailsCert(QListViewItem *) ));
string odesc = crl->getDescription();
ret = dlg->exec();
string ndesc = dlg->descr->text().latin1();

39
NewX509.cpp
View File

@ -157,6 +157,7 @@ NewX509::NewX509(QWidget *parent , const char *name, db_key *key, db_x509req *re
setFinishEnabled(page7,true);
setNextEnabled(page2,false);
signerChanged();
}
void NewX509::setRequest()
{
@ -167,8 +168,17 @@ void NewX509::setRequest()
changeDefault->setEnabled(false);
changeDefault->setChecked(false);
signerBox->setEnabled(false);
startText=tr("Welcome to the settings for Certificate signing requests.... (needs more prosa, volunteers ?)");
endText=tr("You are done with entering all parameters for generating a Certificate signing request..... (needs more prosa, volunteers ?)");
startText=tr("\
Welcome to the settings for Certificate signing requests.
A signing request needs a private key, so it will be created \
if there isn't any unused key available. \
This signing request can then be given to a Certification authority \
while the private key of the request and of the resulting certificate \
returned from the CA does never leave your computer.");
endText=tr("\
You are done with entering all parameters for generating a Certificate signing \
request. The resulting Request should be exported and send to an appropriate CA \
for signing it.");
tText=tr("Certificate request");
setup();
}
@ -182,8 +192,16 @@ void NewX509::setTemp(pki_temp *temp)
{
setAppropriate(page1, false);
finishButton()->setEnabled(true);
startText=tr("Welcome to the settings for Templates.... (needs more prosa)");
endText=tr("You are done with entering all parameters for generating a Template..... (needs more prosa, volunteers ?)");
startText=tr("\
Welcome to the settings for Templates.
This templates do not refer to a ASN.1 structure but are used to keep default \
settings for Requests and certificates. \
When creating a Request or Certificate the template can preset the needed fields \
your default settings.");
endText=tr("\
You are done with entering all parameters for generating a Template.
After this step The template can be assigned to one of your CAs to be always \
applied when signing with this CA.");
tText=tr("Template");
if (temp->getDescription() != "--") {
description->setText(temp->getDescription().c_str());
@ -196,8 +214,17 @@ void NewX509::setTemp(pki_temp *temp)
void NewX509::setCert()
{
finishButton()->setEnabled(true);
startText=tr("Welcome to the settings for Certificates.... (needs more prosa)");
endText=tr("You are done with entering all parameters for generating a Certificate..... (needs more prosa, volunteers ?)");
startText=tr("\
Welcome to the settings for Certificates.
The information for the new Certificate can either be grabbed from a \
given Certificate-request or be filled in by hand. \
In the case of not signing a request there needs to be at least one unused key. \
If this is not the case it will be created.
If you want to self-sign a request (unusual but nevertheless possible) you need \
the private key used to create the request.");
endText=tr("\
You are done with entering all parameters for creating a Certificate.
");
tText=tr("Certificate");
setup();
}

114
NewX509_UI.ui
View File

@ -11,7 +11,7 @@
<rect>
<x>0</x>
<y>0</y>
<width>648</width>
<width>644</width>
<height>531</height>
</rect>
</property>
@ -332,15 +332,9 @@
</property>
<property>
<name>whatsThis</name>
<string>A certificate signing request can be signed, even if the
private key of the request is not available. This is the
actually the intention of a CSR:
Getting signed by a CA certificate, whoes certificate
of course must be in the database
Of course you need the private key of the CSR if you want
to create a self-signed cert from it.</string>
<string>A certificate signing request can be signed, even if the private key of the request is not available. This is the intention of a CSR:
Getting signed by a CA certificate, whoes certificate of course must be in the database
Of course you need the private key of the CSR if you want to create a self-signed cert from it.</string>
</property>
</widget>
</hbox>
@ -438,9 +432,7 @@ to create a self-signed cert from it.</string>
</property>
<property>
<name>whatsThis</name>
<string>This list contains all certificates with the CA-flag set to true
and whoes private key is present in the key database.
<string>This list contains all certificates with the CA-flag set to true and whoes private key is present in the key-database.
If this list is disabled, you only can create a self-signed certificate.</string>
</property>
</widget>
@ -516,9 +508,7 @@ If this list is disabled, you only can create a self-signed certificate.</string
</property>
<property>
<name>whatsThis</name>
<string>This list contains all templates from the toplevel template
Tab.
<string>This list contains all templates from the toplevel template Tab.
Additionally it contains 4 default templates:
Empy, CA, client, server</string>
</property>
@ -808,6 +798,10 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"</
<name>maxLength</name>
<number>100</number>
</property>
<property>
<name>toolTip</name>
<string>This name is only used internally and does not appear in the resulting certificate</string>
</property>
</widget>
<widget row="3" column="1" >
<class>QLineEdit</class>
@ -844,6 +838,10 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"</
<name>maxLength</name>
<number>2</number>
</property>
<property>
<name>toolTip</name>
<string>Must be exactly 2 letter of size (DE, UK)</string>
</property>
</widget>
<widget row="4" column="0" >
<class>QLabel</class>
@ -1148,14 +1146,9 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"</
</property>
<property>
<name>whatsThis</name>
<string>Set this to TRUE if you want to create a CA certificate
that signs other certificates.
This is always set to FALSE for client or server certificates.
In most cases self-signed certificates are CA certificates.
Self-signed non-CA certificates are unusual although
they are possible.</string>
<string>Set this to TRUE if you want to create a CA certificate that signs other certificates.
This is always set to FALSE for client or server certificates. In most cases self-signed certificates are CA certificates.
Self-signed non-CA certificates are unusual although they are possible.</string>
</property>
</widget>
<widget row="1" column="0" >
@ -1181,14 +1174,8 @@ they are possible.</string>
</property>
<property>
<name>whatsThis</name>
<string>If this is left empty the pathlen is not included in the
certificate.
Otherwise it distinguishes the count of chained CA certificates below this one.
A pathlen of 0 means, that this certificate may not issue
other sub-CA certificates.
Although it can do it, all chain-checking algorithms in
e.g. your browser or openssl will (should) fail.</string>
<string>If this is left empty the pathlen is not included in the certificate. Otherwise it distinguishes the count of chained CA certificates below this one.
A pathlen of 0 means, that this certificate may not issue other sub-CA certificates. Although it can do it, all chain-checking algorithms in e.g. your browser or openssl will (should) fail.</string>
</property>
</widget>
<widget row="1" column="2" >
@ -1258,11 +1245,8 @@ e.g. your browser or openssl will (should) fail.</string>
</property>
<property>
<name>whatsThis</name>
<string>If this box is checked an attempt is made to copy the subject key
identifier from the signing certificate.
It also copies the issuer and serial number from the issuer
certificate. Normally this will only be done if the keyid option fails.</string>
<string>If this box is checked an attempt is made to copy the subject key identifier from the signing certificate.
It also copies the issuer and serial number from the issuer certificate. Normally this will only be done if the keyid option fails.</string>
</property>
</widget>
</vbox>
@ -1277,6 +1261,15 @@ certificate. Normally this will only be done if the keyid option fails.</string>
<name>title</name>
<string>Validity</string>
</property>
<property>
<name>toolTip</name>
<string>Number of validity</string>
</property>
<property>
<name>whatsThis</name>
<string>The validation time period is counted from "now" of your system clock the amount of time entered here.
It is not possible to adjust the starting time of a certificate. This is a weakness of this program based on the laziness of the programmer and not a weakness of certificates or OpenSSL.</string>
</property>
<hbox>
<property stdset="1">
<name>margin</name>
@ -1303,20 +1296,6 @@ certificate. Normally this will only be done if the keyid option fails.</string>
<name>text</name>
<string>365</string>
</property>
<property>
<name>toolTip</name>
<string>Number of validity</string>
</property>
<property>
<name>whatsThis</name>
<string>The validation time period is counted from "now" of your
system clock the amount of time entered here.
It is not possible to adjust the starting time of a certificate.
This is a weakness of this program based on the laziness
of the programmer and not a weakness of certificates
or OpenSSL.</string>
</property>
</widget>
<widget>
<class>QComboBox</class>
@ -1458,13 +1437,8 @@ or OpenSSL.</string>
</property>
<property>
<name>whatsThis</name>
<string>The issuer alternative name extension allows various literal values to be used.
These include "email" (an email address)
"URI" a uniform resource indicator, "DNS" (a DNS domain name), RID (a
registered ID: OBJECT IDENTIFIER) and IP (an IP address).
<string>The issuer alternative name extension allows various literal values to be used. These include "email" (an email address) , "URI" a uniform resource indicator, "DNS" (a DNS domain name), RID (a registered ID: OBJECT IDENTIFIER) and IP (an IP address).
Examples:
email:my@other.address, IP: 1.1.1.1 , URI:http://my.url.here/
email:my@other.address, RID:1.2.3.4, DNS: ns.server.tld</string>
</property>
@ -1481,13 +1455,8 @@ email:my@other.address, RID:1.2.3.4, DNS: ns.server.tld</string>
</property>
<property>
<name>whatsThis</name>
<string>The subject alternative name extension allows various literal values to be used.
These include "email" (an email address)
"URI" a uniform resource indicator, "DNS" (a DNS domain name), RID (a
registered ID: OBJECT IDENTIFIER) and IP (an IP address).
<string>The subject alternative name extension allows various literal values to be used. These include "email" (an email address) , "URI" a uniform resource indicator, "DNS" (a DNS domain name) , RID (a registered ID: OBJECT IDENTIFIER) and IP (an IP address).
Examples:
email:my@other.address, IP: 1.1.1.1 , URI:http://my.url.here/
email:my@other.address, RID:1.2.3.4, DNS: ns.server.tld</string>
</property>
@ -1500,22 +1469,11 @@ email:my@other.address, RID:1.2.3.4, DNS: ns.server.tld</string>
</property>
<property>
<name>whatsThis</name>
<string>This is a multi-valued extension that supports all the literal options of
subject alternative name. Of the few software packages that currently interpret
this extension most only interpret the URI option.
Currently each option will set a new DistributionPoint with the fullName
field set to the given value.
Other fields like cRLissuer and reasons cannot currently be set or displayed:
at this time no examples were available that used these fields.
If you see this extension with &lt;UNSUPPORTED&gt; when you attempt to print it out
or it doesn't appear to display correctly then let me know, including the
certificate (mail me at steve@openssl.org) .
<string>This is a multi-valued extension that supports all the literal options of subject alternative name. Of the few software packages that currentlyi nterpret this extension most only interpret the URI option.
Currently each option will set a new DistributionPoint with the fullName field set to the given value.
Other fields like cRLissuer and reasons cannot currently be set or displayed: at this time no examples were available that used these fields.
If you see this extension with &lt;UNSUPPORTED&gt; when you attempt to print it out or it doesn't appear to display correctly then let me know,i ncluding the certificate (mail steve at openssl dot org) .
Examples:
URI:http://www.myhost.com/myca.crl
URI:http://www.my.com/my.crl, URI:http://www.oth.com/my.crl</string>
</property>

47
lib/pki_crl.cpp
View File

@ -92,6 +92,14 @@ pki_crl::pki_crl(const string fname )
crl = d2i_X509_CRL_fp(fp, &crl);
}
fclose(fp);
int r = fname.rfind('.');
#ifdef WIN32
int l = fname.rfind('\\');
#else
int l = fname.rfind('/');
#endif
CERR( fname << "r,l: "<< r <<","<< l );
setDescription(fname.substr(l+1,r-l-1));
openssl_error();
}
else fopen_error(fname);
@ -274,3 +282,42 @@ bool pki_crl::verify(pki_key *key)
}
return ret ;
}
string pki_crl::printV3ext()
{
#define V3_BUF 100
ASN1_OBJECT *obj;
BIO *bio = BIO_new(BIO_s_mem());
int i, len, n = X509_CRL_get_ext_count(crl);
char buffer[V3_BUF+1];
X509_EXTENSION *ex;
string text="";
for (i=0; i<n; i++) {
text += "<b><u>";
ex = X509_CRL_get_ext(crl,i);
obj = X509_EXTENSION_get_object(ex);
len = i2t_ASN1_OBJECT(buffer, V3_BUF, obj);
if (len <0 || len > V3_BUF) openssl_error("V3 buffer too small, this is a bug!");
buffer[len] = '\0';
CERR("extension: "<< buffer <<", length: " << len);
text += buffer;
text += ": ";
if (X509_EXTENSION_get_critical(ex)) {
text += " <font color=\"red\">critical</font>:";
}
if(!X509V3_EXT_print(bio, ex, 0, 0)) {
M_ASN1_OCTET_STRING_print(bio,ex->value);
}
text+="</u></b><br><tt>";
do {
len = BIO_read(bio, buffer, V3_BUF);
buffer[len] = '\0';
text+=buffer;
CERR("extension-length: "<< len);
} while (len == V3_BUF);
text+="</tt><br>";
}
BIO_free(bio);
openssl_error();
return text;
}

1
lib/pki_crl.h
View File

@ -87,6 +87,7 @@ class pki_crl: public pki_base
X509_NAME *getIssuerX509_NAME();
bool verify(pki_key *pkey);
long getSerial(int num);
string printV3ext();
};