The ta-key will be generated on-demand and assigned to the
issuing CA. All issued certificates of this CA will use the
same ta-key.
It can be exported as single file and will also be part of the
exported openvpn configuration file.
Extend export tests to validate the output of ta-keys
and adapt the OpenVPN conf file export test to also check the ta-key.
It results in CKR_SLOT_ID_INVALID error.
Use CK_SLOT_ID definition (unsigned long)
consistently. It is 64 bit on Linux.
Especially don't mangle it through an 'int'
in line 226 of lib/pkcs11_lib.cpp
Yubikey defines and enforces 4 (NEO) or 24 (YubiKey YK4, YubiKey YK5)
slots with special, fixed names.
Add a dropdown box if "fixed_ids" are present and let the user select
the slot during key generation.
Improve the timer interval maintenance process:
- Do not fire every second,
but at most 1 second after the last run
- Reduce the fired events.
- Every container now only evaluates its own elements
(keys, certs,etc.) instead of each container evaluating all
items and duplicating work
Disable sorting and resizing in the view during initialization,
to speed up opening the database
This actually needs a more sophisticated solution with
schema major.minor version, incrementing the major version
for breaking changes, where old releases should not open newer
databases.
In the past, schema changes were always backward compatible,
i.e. older releases could open newer databases without breaking them.
Before this change, the export format descriptions were created
statically before any translation has been setup.
Now it is created after the translation is setup and after every
language change.
Enable legacy provider to allow loading keys
encrypted with an ancient, insecure
algorithm like "pbeWithSHA1And40BitRC2-CBC" for PKCS#12/PFX
Install the dynamic.dll in the portable app and WIX installer.
Create ovpn file with "ca", "cert" and "key"
Additionally put all intermediate CAs (if any)
tagged as "extra-certs".
"tls-auth" "OpenVPN Static key V1" not supported (yet)
Extend export-test by OpenVPN test case
When opening the database Find legacy encrypted keys and:
- update them automatically when encrypted with the
database password or
- inform the user about a required action when encrypted with an
individual passphrase
Related issues #458#511#503#500#494#484#482#475
Remember a complete transformation of all keys
in the Settings["legacy-keys-updated"]
to avoid analyzing all keys each tim a database is opened.
With 2.5.0 support for decrypting pre 2.0.0 keys was dropped.
However, the database update in 2.0.0 and later did not convert the
keys.
Related issues #458#511#503#500#494#484#482#475
When requesting revocation AND deletion of certificates while renewing
them, revocation occurs after deletion, causing a use-after-free
error/crash.
This commit delays the certificates deletion after they have been
revoked.
Because generally using QString.arg() results in an error for
strings without %1
Also use the static database() function instead of creating
a temporary instance during close.
Improve error- and password handling:
- Also identify: (ERR_LIB_PROV:PROV_R_BAD_DECRYPT) as password error.
- Do not use the OpenSSL internal bitfield definition (0xff000fff)
but the official API: ERR_GET_LIB(), ERR_GET_REASON()
Especially ERR_LIB_OFFSET changed from 24 to 23 in Openssl 3.0.0
- First check for "Cancel", then for invalid password to avoid
an "Invalid Password" message after aborting the password input dialog.
If a CA certificate is deleted, all issued certificates must be moved to
an other issuer or the top-level list.
The CA cert will be taken from the model together with the issued certs
first. Then the issued certs are re-inserted.
To make this work correctly, the issuer must be erased from the issued certs
to be interpreted as insertion and not as move.
