diff --git a/MainWindowX509.cpp b/MainWindowX509.cpp
index 41d383fe..a661a7b2 100644
--- a/MainWindowX509.cpp
+++ b/MainWindowX509.cpp
@@ -142,6 +142,10 @@ void MainWindow::newCert(NewX509 *dlg)
 	// increase serial here	
 	if (dlg->foreignSignRB->isChecked()) {
 		serial = signcert->getIncCaSerial();
+		// get own serial to avoid having the same
+		if (serial == atoi(signcert->getSerial().c_str())) { // FIXME: anybody tell me the string method for this ?
+			serial = signcert->getIncCaSerial(); // just take the next one
+		}
 		certs->updatePKI(signcert);  // not so pretty ....
 		CERR("serial is: " << serial );
 	}	
diff --git a/NewX509.cpp b/NewX509.cpp
index 97677e9c..d6599932 100644
--- a/NewX509.cpp
+++ b/NewX509.cpp
@@ -82,6 +82,7 @@ NewX509::NewX509(QWidget *parent , const char *name, db_key *key, db_x509req *re
 #else
 	//setFont( tFont );
 #endif	
+	serialNr->setValidator( new QIntValidator(0, 32767, this));
 	QStringList strings;
 	// are there any useable private keys  ?
 	if (keys) {
@@ -177,6 +178,11 @@ void NewX509::setRequest()
 	setup();
 }
 
+NewX509::~NewX509()
+{
+
+}
+
 void NewX509::setTemp(pki_temp *temp)
 {
 	setAppropriate(page1, false);
@@ -332,7 +338,7 @@ void NewX509::toggleFromRequest()
 void NewX509::dataChangeP2()
 {
 	CERR( "Data changed" );
-	if ((description->text() != "" || fromReqCB->isChecked()) &&
+	if (description->text() != ""  && countryName->text().length() !=1 &&
 	    (keyList->count() > 0  || !keyList->isEnabled())){
 		setNextEnabled(page2,true);
 	}
@@ -458,4 +464,5 @@ void NewX509::newKeyDone(QString name)
 {
 	keyList->insertItem(name,0);
 	keyList->setCurrentItem(0);
+	dataChangeP2();	
 }
diff --git a/NewX509.h b/NewX509.h
index fd68ac80..21350dd5 100644
--- a/NewX509.h
+++ b/NewX509.h
@@ -86,6 +86,7 @@ class NewX509: public NewX509_UI
 	QString startText, endText, tText;
    public:	
 	NewX509(QWidget *parent, const char *name, db_key *key, db_x509req *req, db_x509 *cert, db_temp *temp, QPixmap *image, QPixmap *ns);
+	~NewX509();
 	void setRequest(); // reduce to request form 	
 	void setTemp(pki_temp *temp); // reduce to template form 	
 	void setCert(); // reduce to certificate form 	
diff --git a/NewX509_UI.ui b/NewX509_UI.ui
index ff81a612..b5e7fcbb 100644
--- a/NewX509_UI.ui
+++ b/NewX509_UI.ui
@@ -11,7 +11,7 @@
         <rect>
             <x>0</x>
             <y>0</y>
-            <width>576</width>
+            <width>572</width>
             <height>520</height>
         </rect>
     </property>
@@ -732,10 +732,6 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"</
                             <name>name</name>
                             <cstring>organisationName</cstring>
                         </property>
-                        <property stdset="1">
-                            <name>text</name>
-                            <string></string>
-                        </property>
                     </widget>
                     <widget row="1"  column="2" >
                         <class>QLabel</class>
@@ -772,10 +768,6 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"</
                             <name>name</name>
                             <cstring>localityName</cstring>
                         </property>
-                        <property stdset="1">
-                            <name>text</name>
-                            <string></string>
-                        </property>
                     </widget>
                     <widget row="2"  column="2" >
                         <class>QLabel</class>
@@ -2271,12 +2263,6 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"</
         <receiver>NewX509_UI</receiver>
         <slot>switchExtended()</slot>
     </connection>
-    <connection>
-        <sender>keyList</sender>
-        <signal>textChanged(const QString&amp;)</signal>
-        <receiver>NewX509_UI</receiver>
-        <slot>dataChangeP2()</slot>
-    </connection>
     <connection>
         <sender>tempList</sender>
         <signal>activated(int)</signal>
@@ -2313,6 +2299,18 @@ For a SSL servercertificate choose the DNS name of the server as "Common name"</
         <receiver>NewX509_UI</receiver>
         <slot>signerChanged()</slot>
     </connection>
+    <connection>
+        <sender>keyList</sender>
+        <signal>activated(int)</signal>
+        <receiver>NewX509_UI</receiver>
+        <slot>dataChangeP2()</slot>
+    </connection>
+    <connection>
+        <sender>countryName</sender>
+        <signal>textChanged(const QString&amp;)</signal>
+        <receiver>NewX509_UI</receiver>
+        <slot>dataChangeP2()</slot>
+    </connection>
     <slot access="public">dataChangeP2()</slot>
     <slot access="public">newKey()</slot>
     <slot access="public">signerChanged()</slot>
diff --git a/lib/pki_x509.cpp b/lib/pki_x509.cpp
index a4bcfbf6..3eb6eb98 100644
--- a/lib/pki_x509.cpp
+++ b/lib/pki_x509.cpp
@@ -63,10 +63,14 @@ pki_x509::pki_x509(string d,pki_key *clientKey, pki_x509req *req, pki_x509 *sign
 	openssl_error();
 	if (signer) {
   		issn = X509_get_subject_name(signer->cert);
+		trust =1;
+		efftrust=1;
 	}
 	else {
   		issn = X509_REQ_get_subject_name(req->request);
 		signer = this;
+		trust = 2;
+		efftrust=2; // always trust our self created certs
 	}
 	
 	// copy Requestinfo to New cert