Extend all 3 templates.
Skip AKID for self-signed certificates.
Visualize this by disabling the AKID checkbox
if a self-signed certificate is going to be created.
A new tab on the certificate details dialog
shows the result of the OpenSSL validation process
and the calculated OpenSSL Purpose.
The translation of the OpenSSL X509_V_ERR.... messsages
back to strings is done by grepping them from "openssl/x509_vfy.h"
and wrapping them into a macro-call.
Additionally guard them by an #ifdef (Zombieland rule #2: Double-Tap)
This way:
- I don't need to test and check in which versions of OpenSSL
which errors are available or not
- New errors will be picked up automatically, as long as they
match the "X509_V_ERR_" pattern
Conversion of name constraints from certificate to Template
(Advanced Tab) and using them from there was working since long.
Now there is an additional input line, like (and next to)
SubjectAlternativeName with live validation and edit button
with guided input.
The conversion from cert to template now puts the extension
into the correct LineEdit and not on the Advanced Tab anymore.
However, XCA does NOT follow the constraints, yet.
It is still possible to issue certificates with arbitrary
names, independent of any "Name Constraints" in the CA.
This is what issue #239 asks for.
When exporting items into encrypted files, the checkbox
"Same encryption password for all items" may be used to enter
one password once for all items.
Otherwise a new password dialog opens for each exported entry.
Extend the ExportFile dialog by a checkbox to
switch between "all-in-one-file" or every item in a separate
file. It is only visible if more than one file is selected.
Activating the checkbox will:
- Change the file-input into a directory-input and cut off the
file name
- Disabling all formats that are intended for multiple items.
De-activating the checkbox will:
- Change the directory-input back into a file-input
and append the previously erased file name again.
- Disabling all export-formats that are only useful for single items.
Use the probably modified internal name of the template
in the template-details dialog before import.
Therefore the name of the qlineedit of the internal name of
all other details dialogs changed from "descr" to "description"
to match the name in the NewX509 dialog and to be found
by the "XcaDetails" class.
When exporting the template data, add the internal name and the comment
to the exported data.
The XCA template data is defined by us and can be modified.
This change is backwards and upwards compatible:
New versions of XCA can read an old Template export and vice-versa.
The ImportMulti dialog does not show up if there is only
one item to display, but the item is displayed directly.
The displayed items have a new "Import" button to import
directly from the viewed item.
If XCA is called with certs, crls, keys etc. from the commandline
XCA only displays and optionally imports the item if a default
database is given. Afterwards XCA exits.
Collect all export formats in pki_export.
Each export format has assigned acouple of flags, indicating,
whether they are text, concatenateable, encrypted, usable for
multiple selections or only for a single item.
This commit also changes the default state of
the "Revoke old certificate" checkbox to unchecked.
The reasoning for this is that by renewing a certificate
its lifetime and subsequently validity are prolonged,
which therefore implies equal trustworthiness
for both new and old certificates, which does not intend
the revocation of the latter.
Why?
- QT will switch from qmake to cmake sooner or later.
- autotools are good for unix-ish systems, cmake also for
macOS and Xcode as well as Windows and VS-code
- Cross compiling the windows-binaries on linux
is not very helpful to attract windows-centric
developers.
Also drop qmake's xca.pro
Generate man-page and sphinx sources of commandline arguments
during build by executing xca (xcadoc.cpp).
Generating Version-patchlevel and git hash is now also
OS independent.
Reduce UI from QDialog to QWidget and display it in the XcaDialog frame.
Also move user interface specific code from the db_x509 class
into the CertTreeView class
All dialogs get the "Qt::WindowModal" modality to
operate the Help window in parallel
while also blocking the dialog parent windows.
The manageRevocations() moved from model to view
The Details dialogs become more self-sufficient.
There is a statc start method that shows the dialog and
updates name and comment after accept().
This allows recursive starts of certificate details and
independence of mainwin.
It is necessary to set the current toplevel widget as parent
for the next dialog to not block the application.
Change pkcs11List from QListWidget to QListView
The pkcs11_lib_list holds the data of the loaded libraries.
For the model a QList "model_data" is used to
hold indexes into QList dirs to allow duplicates,
moves and removes.
On windows it now displays the paths with \ separators.
also fixes "#46 AIA, simultaneous OCSP and caIssuers"
Move "OCSP/caIssuers" index from a separate drop down
into the single dropdown of URI/IP/DNS...
This change not only fixes the bug, but also removes some
special handling for the AIA extension.
Adding features by deleting code is highly appreciated :-)
also fixes "#46 AIA, simultaneous OCSP and caIssuers"
Move "OCSP/caIssuers" index from a separate drop down
into the single dropdown of URI/IP/DNS...
This change not only fixes the bug, but also removes some
special handling for the AIA extension.
Adding features by deleting code is highly appreciated :-)
New classes:
- database_model: Manage the database tables (keys, req, cert, crl, templ)
extracted from widgets/MW_database.cpp
- arguments: parse commandline, dynamically create help text
Add ODBC QSQL Database driver
Column "public" in public_keys table is a keyword in
MSSQL. Double quote it.
Double quotes are invalid on MySQL in non-ANSI mode.
Force ANSI mode for MySQL/MariaDB databases.
MSSQL also has a maximum VARCHAR of 8000
Schema updates are not performed for each new database.
New databases are immediately created conforming to schema:7
Schema 5 and 6 get updated to 7.
Schemas < 5 never have been released officially. (pre 2.0.0)
Switch "Database name" label to "DSN" for ODBC databases.
With this commit PKCS#11 libraries may be reordered
and enabled or disabled.
The slot selection dialog iterates over all enabled and successfully
loaded libraries in the configured order and collects the slots
of each of them.
In the options dialog the library info is shown in the tool-tip
Print digest of public keys in the key details in different formats:
Print SHA256 SSH digest as used to by SSH users:
ssh-keygen -l -f ~/.ssh/id_rsa.pub
Print SHA1 X509 key digest as shown in the
Subject key identifier of a certificate
Print SHA256 digest as in:
openssl pkey -pubout -outform DER < key.pem | sha256sum
as requested by this issue.
Refactored digesting functionality by a generic Digest()
function working with QByteArrays.
The function formatHash() now also expects a QByteArray input.
Allow displaying the public key of a certificate
or request without importing it.
When importing certificates or CRLs,
display the issuer if it exists in the database.
Translate the special text "DNS:copycn" in the SAN to
the final common name.
Add checkobox "Copy Common Name" to the SAN Edit box,
for a user-friendly editing of the "DNS:copycn"
During certificate creation, an empty common name together with
"DNS:copycn" in the SAN will raise a warning message and the
opportunity to change the settings.
Change the SAN in the HTTP-server XCA template from
"DNS:your.server.name.here" to "DNS:copycn" to already
take advantage of this feature in the default template.
Add configuration values in the Options dialog to
control the time when certificates get marked yellow and
the expiration alarm time in calendar entries.
No need to translate "X Certificate and Key management",
"Form", "Dialog" or "TimeInput"
"Select Token" and "New Key" window titles were never shown.
Remove them.
