If we have a QByteArray (ba) and must provide it to
a BIO* expecting OpenSSL function, the following
construct provides it: BioByteArray(ba).ro()
directly providing the QByteArray buffer as BIO
It also supports mixed writes:
BIO_write(bba, buf, size)
bba += QByteArray
also fixes "#46 AIA, simultaneous OCSP and caIssuers"
Move "OCSP/caIssuers" index from a separate drop down
into the single dropdown of URI/IP/DNS...
This change not only fixes the bug, but also removes some
special handling for the AIA extension.
Adding features by deleting code is highly appreciated :-)
Add settings class to access the settings table in the database
Cache values and improve database writes.
Options dialog simplified
Replace getSetting / storeSetting
Unpack option flags to rows in the settings
The API changed heavily. New functions arrived, old functions
disappeared and many structures became opaque.
This version of the patch implements pkcs11 signing as follows:
- openssl < 1.0.0: rsa & dsa without engine
- openssl 1.0.x: rsa, dsa & ec with engine
- openssl >= 1.1.0: rsa, dsa & ec without engine
In the operation, we therefore also gain implementation of dsa signing for openssl < 1.0.0 (ec disabled because EC_KEY_METHOD was not yet invented!).
I've given up trying to use a PKEY_ENGINE with openssl 1.1: seems not possible anymore.
I've succeeded compiling the patched xca with openssl 0.9.8n, 1.0.2j and 1.1.0e.
I've successfully tested pkcs11 signing using softhsm with openssl 1.0.2j and 1.1.0e.
The patch also removes gcc7 new warnings.
become more userfriendly:
- by indicating the validity with an appropriate
icon in front of AIA, SAN IAN and CDP.
- by checking the validity before creating the real certificate.
- by improving the edit button, to automatically add an "URI"
as type, if the type is missing, or is for example "http"
Add a button to the certificate detila dialog to show the
extensions as OpenSSL config
improve AuthKeyId
Allow selecting public keys for certificates.
This works if it is signed by an other cert.
get rid of ext_str_new() and ext_str_free()
use d2i() and XX_free() instead
support for unrecognized extensions as DER stream
improve altName: otherName
Support Bitfields: keyUsage and ns_certType
- while taking extensions from the request, the advanced tab
and the other tabs, extensions may be duplicated.
They will be now diplayed in
detail and duplicates are found and shown clearly.
Warning message will allow for modifications.
- Fixes
[ 1881482 ] Copy extensions from request seems to fail
[ 1998815 ] xca adds basic constraint "CA" twice resulting in invalid CA
- remove extension and attribute tab in details dialog if
no extensions or attributes available
- documentation updated
X509 request attributes (like challange password) can be set and viewed.
