The API changed heavily. New functions arrived, old functions
disappeared and many structures became opaque.
This version of the patch implements pkcs11 signing as follows:
- openssl < 1.0.0: rsa & dsa without engine
- openssl 1.0.x: rsa, dsa & ec with engine
- openssl >= 1.1.0: rsa, dsa & ec without engine
In the operation, we therefore also gain implementation of dsa signing for openssl < 1.0.0 (ec disabled because EC_KEY_METHOD was not yet invented!).
I've given up trying to use a PKEY_ENGINE with openssl 1.1: seems not possible anymore.
I've succeeded compiling the patched xca with openssl 0.9.8n, 1.0.2j and 1.1.0e.
I've successfully tested pkcs11 signing using softhsm with openssl 1.0.2j and 1.1.0e.
The patch also removes gcc7 new warnings.
Updated patch adds another export option automating the creation
of multiple index.txt files to be used with multiple ocsp responders.
New export option is available via command line (-I index.txt) and
the Extras menu (Extra->Export Certificate Index hierarchy).
The option causes the creation of an index.txt file containing
index records for all the children certificates of a parent.
The filenames are generated using the supplied name as prefix
and append a dot and the simplified Internal Name
(the Internal Name stripped of non-alphanumeric characters except underscores).
XCA currently lacks support for generating an index.txt.
Such a file gets created and maintained when using CA
features in openssl. As mentioned here:
https://sourceforge.net/p/xca/discussion/209946/thread/6cbc727c/#2310
such a file can be used by Openssl's built-in OCSP responder.
Additionally, it can be used for configuring a cron job for
reminding of certificate expiration.
Certificate index export is added in 3 places:
- command line (-i index.txt),
- the Extras menu (Extra->Export Certificate Index) and
- the selected file(s) export option in the context menu
on the Certificates tab (Export->File, Export Format:
Certificate Index file).
Please note that SubjectDN generated by this feature has
different formatting than the one generated by openssl.
Better support multiple selections
- Export all selected items into one PEM file
- Batch Revoke/unrevoke/renew of many selected certificates
of the same issuer
- allow exporting templates as PEM
Add Feat. Reg. #83 Option to revoke old certificate when renewing
Always put all signed certificate to the newest CA.
If a CA certificate is renewed, all certificates issued by
the old CA are now shown as signed by the new one.
Before exporting the private key an acknowledge is
required. Here you may opt to only export the public key.
While at it, display the internal Name in export dialogs
change storage type of passwords from char[] to QByteArray
Create PwDialog class and drop passWrite and passRead
Create Passwd class derived from QBytearray
move PKCS12 password input to PwDialog
right-align numeric columns and make them monospaced.
Save their current state in the database.
Also add column-menu to the other context menu
fix minor bugs
Support for "Unstructured Name" and "challange password" columns
in the request-table
Support for name hash as used by OpenSSL to lookup certs.
As table column and as distinguished name information
Keys: Sort Keysize numerical
Certs: CA, fingerprints, start date (notBefore)
Crl: CRL number , Last update
Requests, Crls, Templates, Certs: All subject items and the full name
Extract public key from cert and request
Show public keys in requests- and cert-details in red
Allow using public keys for certs. Useful if not selfsigning
- Only once set notBefore to "now" when creating Cert-renewal
or NewCert dialog.
- Apply-time button now always uses the current value from notBefore
and adds the time-span without resetting notBefore
- Checking "midnight" now immediately modifies the dates.
Unchecking "midnight" now recovers the old value
- The seconds are always set to 00, since they can't be set via
the DateTime dialog anyway
- CRL generation now too allows to use midnight and time ranges
and uses GENERALIZED time if the date is out of range for UTCTIME
(same logic as for certificates)
- extended russian translation by Pavel Belly
- dropped approach to create sentences from different parts
like "Successfully created %1 '%2'" with %1 being "the certificate"
and %2 being the name. This leads to trouble for other languages.
Therefore I decided to mention the whole sentences and accept
the many, almost duplicated sentences.
- Consolidate german translation:
. Smart card/Smartcard -> Chipkarte
. Besitzer -> Inhaber
. Unterschriftsanfrage/Zertifikatsanfrage -> Zertifikatsantrag
- Support translations for pki_*.cpp by adding Q_OBJECT
- replace occurances of "Smart Card" by "Token"
- Support for creating keys on a token
- Store existing keys on a token
- delete keys and certs from a token
- update docs
- fixes to not crash if Smart card support is missing
- select correct list of hash algos by
reading PKCS11 mechanisms per slot and save them among with
the card in the db
- remove debugging code
- allow to configure the path to the PKCS#11 library
- copy pkcs11 header-file into XCA lib
- add support to store a certificate on the card
(did not work with my TCOS card, but in theory....)
- init PIN via PUK
- be more robust regarding card changes
- improve PIN handling
- while taking extensions from the request, the advanced tab
and the other tabs, extensions may be duplicated.
They will be now diplayed in
detail and duplicates are found and shown clearly.
Warning message will allow for modifications.
- Fixes
[ 1881482 ] Copy extensions from request seems to fail
[ 1998815 ] xca adds basic constraint "CA" twice resulting in invalid CA
This patchset adds:
- configure.mac now looks for qmake, backs up xcode project, uses xca.pro to generate a new one, generates a different local.h
- mac-package.sh generates a standalone .app bundle for distribution using deployqt from trolltech labs, packages up manual, COPYRIGHT, etc into a .dmg
- mac packaging niceties in the qmake project
- mac icon file
- usability fixes for OS X:
- look for user configured oids and such in ~/Library/Preferences/xca if it exists
- look for original ones in app bundle/Contents/Resources (it tried to do this before...)
- more robust code for getting bundle location (less likely to be broken by Apple in OS revisions)
- start browsing for files in ~/Documents
- fix wildcards on mac so files without extensions will be opened
- fix save behavior for .xdb files so that it's hard to get one that doesn't end in .xdb, as this causes difficulty w/Qt
Notes:
- one of the compilation fixes was in the new revocation data function that replaced the old macros... I didn't have time to verify that my fix doesn't break when used with 0.9.8.
- QStringToAsn1() is clearly incorrect but I haven't yet determined what callers expect, so I just called it out in a comment and did not yet fix it
- I added some code that I haven't tested on Windows because I thought it might be a nice function to have there too. I have not added anything to call that function, however, since I don't currently have a machine I can test on :). The code is clearly marked in comments.
- remove extension and attribute tab in details dialog if
no extensions or attributes available
- documentation updated
X509 request attributes (like challange password) can be set and viewed.
fix database dump
extend Cert and key export possibilities
enhance autoIntName and req and cert loading
fix ImportMulti->details
erase default password on database close
