This check is performed before the certificate is
issued and signed. Like all the other checks
regarding validity, extensions and other things.
Issuing certificates that violate the Name Constraints
of any CA in the chain is still be possible.
But there will be a warning now with the name of the affected
CA-Certificate and the violated constraint.
The Issuer can then decide whether to issue the
certificate or not.
A new tab on the certificate details dialog
shows the result of the OpenSSL validation process
and the calculated OpenSSL Purpose.
The translation of the OpenSSL X509_V_ERR.... messsages
back to strings is done by grepping them from "openssl/x509_vfy.h"
and wrapping them into a macro-call.
Additionally guard them by an #ifdef (Zombieland rule #2: Double-Tap)
This way:
- I don't need to test and check in which versions of OpenSSL
which errors are available or not
- New errors will be picked up automatically, as long as they
match the "X509_V_ERR_" pattern
Use the provided plural mechanisms of QT.
The "PO" translation also works smoothly and
the translation mechanisms between .po <-> .qt
was tested successfully.
The new english translation file translates
the single phrase:
"Delete the %n revocation list(s): '%1'?"
into
"Delete the revocation list: '%1'?" for one item
and
"Delete the %n revocation lists: '%1'?" otherwise
Generalize the Clipboard format selection
and extend it to certificates.
Certificates may now be exported as chain
or together with private key.
The clipboard format selection also
affects the Drag&Drop content.
The Export->Clipboard men now also shows the
currently selected format export.
The ta-key will be generated on-demand and assigned to the
issuing CA. All issued certificates of this CA will use the
same ta-key.
It can be exported as single file and will also be part of the
exported openvpn configuration file.
Extend export tests to validate the output of ta-keys
and adapt the OpenVPN conf file export test to also check the ta-key.
When XCA started in 2002, there were no C++ initializers.
Drop explicit initializers from the constructors.
- Fix indentations of section declarators.
- Replace NULL by nullptr when feasible.
- Sort private section: properties first, then methods.
If the base64 decoding fails these function return a null pointer
without setting an openssl error.
Additionally throw an error if the PEM_read_bio functions return NULL.
For interoprability reason.
To enforce it, set "#define OPENSSL_NO_STDIO 1"
All file access is done by reading/writing from/to BioByteArray()
which is filled by QFile:readAll()
Drop CRYPTO_malloc_debug / CRYPTO_mem_leaks
which is unused and disabled since many years.
The global variable "Database" of class xca_db
can be used by any other class to access. No need
to provide it.
The "xca_db" class managed the "database_model" pointer.
Accessing the name of the current database has been unified.
If we have a QByteArray (ba) and must provide it to
a BIO* expecting OpenSSL function, the following
construct provides it: BioByteArray(ba).ro()
directly providing the QByteArray buffer as BIO
It also supports mixed writes:
BIO_write(bba, buf, size)
bba += QByteArray
Change pkcs11List from QListWidget to QListView
The pkcs11_lib_list holds the data of the loaded libraries.
For the model a QList "model_data" is used to
hold indexes into QList dirs to allow duplicates,
moves and removes.
On windows it now displays the paths with \ separators.
New classes:
- database_model: Manage the database tables (keys, req, cert, crl, templ)
extracted from widgets/MW_database.cpp
- arguments: parse commandline, dynamically create help text
Fix finding our unassigned certificates when importing a CA
(issuerSqlId may be QVariant(int, 0) depending on the database)
Reassign certs from an older CA to the imported one.
If Loading the item results in an openssl error,
even if the item is not empty, discard it.
Otherwise loading it from the database later on will fail.
Improve "autoIntName()"
