diff --git a/CertDetail.ui b/CertDetail.ui index 64c19de6..6d8e42d3 100644 --- a/CertDetail.ui +++ b/CertDetail.ui @@ -11,7 +11,7 @@ 0 0 - 569 + 561 446 @@ -70,6 +70,14 @@ 1 + + frameShape + MShape + + + frameShadow + MShadow + text Details of the Certificate @@ -448,10 +456,6 @@ text not available - - alignment - AlignCenter - hAlign @@ -503,6 +507,10 @@ frameShadow Sunken + + toolTip + The serial number of the certificate + QLineEdit @@ -778,10 +786,6 @@ text SELF SIGNED - - alignment - AlignCenter - hAlign diff --git a/CrlDetail.ui b/CrlDetail.ui index 57b68488..be3894a4 100644 --- a/CrlDetail.ui +++ b/CrlDetail.ui @@ -11,7 +11,7 @@ 0 0 - 542 + 538 381 @@ -450,7 +450,7 @@ toolTip - The internal name of the RSA key in the key database + The status of the CRL signature @@ -505,7 +505,7 @@ toolTip - The internal name of the certificate in the database + The internal name of the CRL in the database @@ -843,10 +843,6 @@ frameShadow Sunken - - toolTip - An md5 hashsum of the certificate - QLabel @@ -873,10 +869,6 @@ frameShadow Sunken - - toolTip - A SHA-1 hashsum of the certificate - @@ -928,6 +920,10 @@ name certList + + toolTip + A list of all revoked certificates + diff --git a/ExportKey_UI.ui b/ExportKey_UI.ui index 5dab48e6..177d3c9b 100644 --- a/ExportKey_UI.ui +++ b/ExportKey_UI.ui @@ -11,7 +11,7 @@ 0 0 - 595 + 591 375 @@ -310,6 +310,10 @@ PKCS#8 is an encrypted official Key-exchange format text E&xport the private part of the Key too + + toolTip + When exporting the private part, it should be encrypted. + QCheckBox diff --git a/MainWindowCrl.cpp b/MainWindowCrl.cpp index 3426930e..0247d7a5 100644 --- a/MainWindowCrl.cpp +++ b/MainWindowCrl.cpp @@ -81,7 +81,7 @@ bool MainWindow::showDetailsCrl(pki_crl *crl, bool import) iss = certs->getBySubject(crl->getIssuerX509_NAME()); numc = crl->numRev(); dlg->certList->clear(); - dlg->certList->addColumn(tr("Common Name")); + dlg->certList->addColumn(tr("Name")); dlg->certList->addColumn(tr("Serial")); dlg->certList->addColumn(tr("Revokation")); CERR("NUMBER:" << numc); @@ -95,11 +95,17 @@ bool MainWindow::showDetailsCrl(pki_crl *crl, bool import) current->setText(1, rev->getSerial().c_str() ); current->setText(2, rev->revokedAt(TIMEFORM_SORTABLE).c_str()); } + else { + current = new QListViewItem(dlg->certList, "Unknown" ); + } } + dlg->v3Extensions->setText(crl->printV3ext().c_str()); dlg->issuer->setText(iss->getDescription().c_str()); if (crl->verify(iss->getKey()) == 0) { dlg->signCheck->setText(tr("Success")); } + connect( dlg->certList, SIGNAL( doubleClicked(QListViewItem*) ), + this, SLOT( showDetailsCert(QListViewItem *) )); string odesc = crl->getDescription(); ret = dlg->exec(); string ndesc = dlg->descr->text().latin1(); diff --git a/NewX509.cpp b/NewX509.cpp index 969ff3e5..cd04b954 100644 --- a/NewX509.cpp +++ b/NewX509.cpp @@ -157,6 +157,7 @@ NewX509::NewX509(QWidget *parent , const char *name, db_key *key, db_x509req *re setFinishEnabled(page7,true); setNextEnabled(page2,false); + signerChanged(); } void NewX509::setRequest() { @@ -167,8 +168,17 @@ void NewX509::setRequest() changeDefault->setEnabled(false); changeDefault->setChecked(false); signerBox->setEnabled(false); - startText=tr("Welcome to the settings for Certificate signing requests.... (needs more prosa, volunteers ?)"); - endText=tr("You are done with entering all parameters for generating a Certificate signing request..... (needs more prosa, volunteers ?)"); + startText=tr("\ +Welcome to the settings for Certificate signing requests. +A signing request needs a private key, so it will be created \ +if there isn't any unused key available. \ +This signing request can then be given to a Certification authority \ +while the private key of the request and of the resulting certificate \ +returned from the CA does never leave your computer."); + endText=tr("\ +You are done with entering all parameters for generating a Certificate signing \ +request. The resulting Request should be exported and send to an appropriate CA \ +for signing it."); tText=tr("Certificate request"); setup(); } @@ -182,8 +192,16 @@ void NewX509::setTemp(pki_temp *temp) { setAppropriate(page1, false); finishButton()->setEnabled(true); - startText=tr("Welcome to the settings for Templates.... (needs more prosa)"); - endText=tr("You are done with entering all parameters for generating a Template..... (needs more prosa, volunteers ?)"); + startText=tr("\ +Welcome to the settings for Templates. +This templates do not refer to a ASN.1 structure but are used to keep default \ +settings for Requests and certificates. \ +When creating a Request or Certificate the template can preset the needed fields \ +your default settings."); + endText=tr("\ +You are done with entering all parameters for generating a Template. +After this step The template can be assigned to one of your CAs to be always \ +applied when signing with this CA."); tText=tr("Template"); if (temp->getDescription() != "--") { description->setText(temp->getDescription().c_str()); @@ -196,8 +214,17 @@ void NewX509::setTemp(pki_temp *temp) void NewX509::setCert() { finishButton()->setEnabled(true); - startText=tr("Welcome to the settings for Certificates.... (needs more prosa)"); - endText=tr("You are done with entering all parameters for generating a Certificate..... (needs more prosa, volunteers ?)"); + startText=tr("\ +Welcome to the settings for Certificates. +The information for the new Certificate can either be grabbed from a \ +given Certificate-request or be filled in by hand. \ +In the case of not signing a request there needs to be at least one unused key. \ +If this is not the case it will be created. +If you want to self-sign a request (unusual but nevertheless possible) you need \ +the private key used to create the request."); + endText=tr("\ +You are done with entering all parameters for creating a Certificate. +"); tText=tr("Certificate"); setup(); } diff --git a/NewX509_UI.ui b/NewX509_UI.ui index dee4f8ad..06938a14 100644 --- a/NewX509_UI.ui +++ b/NewX509_UI.ui @@ -11,7 +11,7 @@ 0 0 - 648 + 644 531 @@ -332,15 +332,9 @@ whatsThis - A certificate signing request can be signed, even if the -private key of the request is not available. This is the -actually the intention of a CSR: - -Getting signed by a CA certificate, whoes certificate -of course must be in the database - -Of course you need the private key of the CSR if you want -to create a self-signed cert from it. + A certificate signing request can be signed, even if the private key of the request is not available. This is the intention of a CSR: +Getting signed by a CA certificate, whoes certificate of course must be in the database +Of course you need the private key of the CSR if you want to create a self-signed cert from it. @@ -438,9 +432,7 @@ to create a self-signed cert from it. whatsThis - This list contains all certificates with the CA-flag set to true -and whoes private key is present in the key database. - + This list contains all certificates with the CA-flag set to true and whoes private key is present in the key-database. If this list is disabled, you only can create a self-signed certificate. @@ -516,9 +508,7 @@ If this list is disabled, you only can create a self-signed certificate. whatsThis - This list contains all templates from the toplevel template -Tab. - + This list contains all templates from the toplevel template Tab. Additionally it contains 4 default templates: Empy, CA, client, server @@ -808,6 +798,10 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"maxLength 100 + + toolTip + This name is only used internally and does not appear in the resulting certificate + QLineEdit @@ -844,6 +838,10 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"maxLength 2 + + toolTip + Must be exactly 2 letter of size (DE, UK) + QLabel @@ -1148,14 +1146,9 @@ For a SSL servercertificate choose the DNS name of the server as "Common name" whatsThis - Set this to TRUE if you want to create a CA certificate -that signs other certificates. - -This is always set to FALSE for client or server certificates. - -In most cases self-signed certificates are CA certificates. -Self-signed non-CA certificates are unusual although -they are possible. + Set this to TRUE if you want to create a CA certificate that signs other certificates. +This is always set to FALSE for client or server certificates. In most cases self-signed certificates are CA certificates. +Self-signed non-CA certificates are unusual although they are possible. @@ -1181,14 +1174,8 @@ they are possible. whatsThis - If this is left empty the pathlen is not included in the -certificate. -Otherwise it distinguishes the count of chained CA certificates below this one. - -A pathlen of 0 means, that this certificate may not issue -other sub-CA certificates. -Although it can do it, all chain-checking algorithms in -e.g. your browser or openssl will (should) fail. + If this is left empty the pathlen is not included in the certificate. Otherwise it distinguishes the count of chained CA certificates below this one. +A pathlen of 0 means, that this certificate may not issue other sub-CA certificates. Although it can do it, all chain-checking algorithms in e.g. your browser or openssl will (should) fail. @@ -1258,11 +1245,8 @@ e.g. your browser or openssl will (should) fail. whatsThis - If this box is checked an attempt is made to copy the subject key -identifier from the signing certificate. - -It also copies the issuer and serial number from the issuer -certificate. Normally this will only be done if the keyid option fails. + If this box is checked an attempt is made to copy the subject key identifier from the signing certificate. +It also copies the issuer and serial number from the issuer certificate. Normally this will only be done if the keyid option fails. @@ -1277,6 +1261,15 @@ certificate. Normally this will only be done if the keyid option fails. title Validity + + toolTip + Number of validity + + + whatsThis + The validation time period is counted from "now" of your system clock the amount of time entered here. +It is not possible to adjust the starting time of a certificate. This is a weakness of this program based on the laziness of the programmer and not a weakness of certificates or OpenSSL. + margin @@ -1303,20 +1296,6 @@ certificate. Normally this will only be done if the keyid option fails. text 365 - - toolTip - Number of validity - - - whatsThis - The validation time period is counted from "now" of your -system clock the amount of time entered here. - -It is not possible to adjust the starting time of a certificate. -This is a weakness of this program based on the laziness -of the programmer and not a weakness of certificates -or OpenSSL. - QComboBox @@ -1458,13 +1437,8 @@ or OpenSSL. whatsThis - The issuer alternative name extension allows various literal values to be used. -These include "email" (an email address) -"URI" a uniform resource indicator, "DNS" (a DNS domain name), RID (a -registered ID: OBJECT IDENTIFIER) and IP (an IP address). - + The issuer alternative name extension allows various literal values to be used. These include "email" (an email address) , "URI" a uniform resource indicator, "DNS" (a DNS domain name), RID (a registered ID: OBJECT IDENTIFIER) and IP (an IP address). Examples: - email:my@other.address, IP: 1.1.1.1 , URI:http://my.url.here/ email:my@other.address, RID:1.2.3.4, DNS: ns.server.tld @@ -1481,13 +1455,8 @@ email:my@other.address, RID:1.2.3.4, DNS: ns.server.tld whatsThis - The subject alternative name extension allows various literal values to be used. -These include "email" (an email address) -"URI" a uniform resource indicator, "DNS" (a DNS domain name), RID (a -registered ID: OBJECT IDENTIFIER) and IP (an IP address). - + The subject alternative name extension allows various literal values to be used. These include "email" (an email address) , "URI" a uniform resource indicator, "DNS" (a DNS domain name) , RID (a registered ID: OBJECT IDENTIFIER) and IP (an IP address). Examples: - email:my@other.address, IP: 1.1.1.1 , URI:http://my.url.here/ email:my@other.address, RID:1.2.3.4, DNS: ns.server.tld @@ -1500,22 +1469,11 @@ email:my@other.address, RID:1.2.3.4, DNS: ns.server.tld whatsThis - This is a multi-valued extension that supports all the literal options of -subject alternative name. Of the few software packages that currently interpret -this extension most only interpret the URI option. - -Currently each option will set a new DistributionPoint with the fullName -field set to the given value. - -Other fields like cRLissuer and reasons cannot currently be set or displayed: -at this time no examples were available that used these fields. - -If you see this extension with <UNSUPPORTED> when you attempt to print it out -or it doesn't appear to display correctly then let me know, including the -certificate (mail me at steve@openssl.org) . - + This is a multi-valued extension that supports all the literal options of subject alternative name. Of the few software packages that currentlyi nterpret this extension most only interpret the URI option. +Currently each option will set a new DistributionPoint with the fullName field set to the given value. +Other fields like cRLissuer and reasons cannot currently be set or displayed: at this time no examples were available that used these fields. +If you see this extension with <UNSUPPORTED> when you attempt to print it out or it doesn't appear to display correctly then let me know,i ncluding the certificate (mail steve at openssl dot org) . Examples: - URI:http://www.myhost.com/myca.crl URI:http://www.my.com/my.crl, URI:http://www.oth.com/my.crl diff --git a/lib/pki_crl.cpp b/lib/pki_crl.cpp index 6f6ee69b..7973c608 100644 --- a/lib/pki_crl.cpp +++ b/lib/pki_crl.cpp @@ -92,6 +92,14 @@ pki_crl::pki_crl(const string fname ) crl = d2i_X509_CRL_fp(fp, &crl); } fclose(fp); + int r = fname.rfind('.'); +#ifdef WIN32 + int l = fname.rfind('\\'); +#else + int l = fname.rfind('/'); +#endif + CERR( fname << "r,l: "<< r <<","<< l ); + setDescription(fname.substr(l+1,r-l-1)); openssl_error(); } else fopen_error(fname); @@ -274,3 +282,42 @@ bool pki_crl::verify(pki_key *key) } return ret ; } + +string pki_crl::printV3ext() +{ +#define V3_BUF 100 + ASN1_OBJECT *obj; + BIO *bio = BIO_new(BIO_s_mem()); + int i, len, n = X509_CRL_get_ext_count(crl); + char buffer[V3_BUF+1]; + X509_EXTENSION *ex; + string text=""; + for (i=0; i V3_BUF) openssl_error("V3 buffer too small, this is a bug!"); + buffer[len] = '\0'; + CERR("extension: "<< buffer <<", length: " << len); + text += buffer; + text += ": "; + if (X509_EXTENSION_get_critical(ex)) { + text += " critical:"; + } + if(!X509V3_EXT_print(bio, ex, 0, 0)) { + M_ASN1_OCTET_STRING_print(bio,ex->value); + } + text+="
"; + do { + len = BIO_read(bio, buffer, V3_BUF); + buffer[len] = '\0'; + text+=buffer; + CERR("extension-length: "<< len); + } while (len == V3_BUF); + text+="
"; + } + BIO_free(bio); + openssl_error(); + return text; +} diff --git a/lib/pki_crl.h b/lib/pki_crl.h index 641a2f62..9ec07b33 100644 --- a/lib/pki_crl.h +++ b/lib/pki_crl.h @@ -87,6 +87,7 @@ class pki_crl: public pki_base X509_NAME *getIssuerX509_NAME(); bool verify(pki_key *pkey); long getSerial(int num); + string printV3ext(); };