should not be used at the same time. Actually "Keep serial number"
should generally be used with care.
When checking "Keep serial number", "Revoke old certificate" is disabled
and unchecked and "Replace old certificate" is disabled and checked.
Extend all 3 templates.
Skip AKID for self-signed certificates.
Visualize this by disabling the AKID checkbox
if a self-signed certificate is going to be created.
This check is performed before the certificate is
issued and signed. Like all the other checks
regarding validity, extensions and other things.
Issuing certificates that violate the Name Constraints
of any CA in the chain is still be possible.
But there will be a warning now with the name of the affected
CA-Certificate and the violated constraint.
The Issuer can then decide whether to issue the
certificate or not.
A new tab on the certificate details dialog
shows the result of the OpenSSL validation process
and the calculated OpenSSL Purpose.
The translation of the OpenSSL X509_V_ERR.... messsages
back to strings is done by grepping them from "openssl/x509_vfy.h"
and wrapping them into a macro-call.
Additionally guard them by an #ifdef (Zombieland rule #2: Double-Tap)
This way:
- I don't need to test and check in which versions of OpenSSL
which errors are available or not
- New errors will be picked up automatically, as long as they
match the "X509_V_ERR_" pattern
Conversion of name constraints from certificate to Template
(Advanced Tab) and using them from there was working since long.
Now there is an additional input line, like (and next to)
SubjectAlternativeName with live validation and edit button
with guided input.
The conversion from cert to template now puts the extension
into the correct LineEdit and not on the Advanced Tab anymore.
However, XCA does NOT follow the constraints, yet.
It is still possible to issue certificates with arbitrary
names, independent of any "Name Constraints" in the CA.
This is what issue #239 asks for.
Use the provided plural mechanisms of QT.
The "PO" translation also works smoothly and
the translation mechanisms between .po <-> .qt
was tested successfully.
The new english translation file translates
the single phrase:
"Delete the %n revocation list(s): '%1'?"
into
"Delete the revocation list: '%1'?" for one item
and
"Delete the %n revocation lists: '%1'?" otherwise
- Still ask before overwriting files.
- Error out if file name exists, but is not a file.
- Ask to create non-existing directories
- Check if an expected directory either really
is a directory or does not exist.
When exporting items into encrypted files, the checkbox
"Same encryption password for all items" may be used to enter
one password once for all items.
Otherwise a new password dialog opens for each exported entry.
Extend the ExportFile dialog by a checkbox to
switch between "all-in-one-file" or every item in a separate
file. It is only visible if more than one file is selected.
Activating the checkbox will:
- Change the file-input into a directory-input and cut off the
file name
- Disabling all formats that are intended for multiple items.
De-activating the checkbox will:
- Change the directory-input back into a file-input
and append the previously erased file name again.
- Disabling all export-formats that are only useful for single items.
Do not resolve symlinks of PKCS#11 library paths.
However the native file dialogs for example on MAC OS
do always resolve symbolic links.
In this case xca may be started with the --no-native-dialogs
commandline option when specifying new libraries.
Replace "UPN:" by "otherName:msUPN;UTF8:" when generating
the extension from the Subject- and IssuerAlternativeName.
Extend the Edit dialog of the SAN and IAN by the "UPN" prefix.
Replace "otherName:msUPN;UTF8:" by "UPN:" when creating a template
from an existing certificate or request.
The OpenSSL config file export, the configuration display
and edit on the "Advanced Tab" are not afffected, since
this is an XCA syntax sugar, not supported by OpenSSL.
Update documentation
Use the probably modified internal name of the template
in the template-details dialog before import.
Therefore the name of the qlineedit of the internal name of
all other details dialogs changed from "descr" to "description"
to match the name in the NewX509 dialog and to be found
by the "XcaDetails" class.
When exporting the template data, add the internal name and the comment
to the exported data.
The XCA template data is defined by us and can be modified.
This change is backwards and upwards compatible:
New versions of XCA can read an old Template export and vice-versa.
The QT provided QM files in QM_FILES got overwritten by the
invokation of the translation function.
Put them into a different variable.
And their name is qtbase_XX.qm, not qt_XX.qm
This fix also translates the "Finder Menu"
Generalize the Clipboard format selection
and extend it to certificates.
Certificates may now be exported as chain
or together with private key.
The clipboard format selection also
affects the Drag&Drop content.
The Export->Clipboard men now also shows the
currently selected format export.
Also look in the directory of the application
if no other translation was found.
Add search path for qt5 or qt6 library translations
depending on the compiletime library version
Use static initializers while at it.
Test the correct behavior of the "Midnight" and setDiff methods.
Especially to keep the time when switching from hidden time (midnoght)
back to shown time.
Previously the request extensions were ignored
when they also existed on one of the other tabs.
Now they are correctly listed and marked as duplicated.
Show the insecure algorithms with the postfix (insecure)
in the dropdown menu.
Since the "insecure" is translateable, put the algorithm NID
into the data field of the combo-box entry to
reliably find the correct entry by NID instead of text.
Put it into the "PlugIns" directory and load it from there.
Show whether the legacy-provider was loaded in the About-Dialog.
CmakeLists.txt: Improve OpenSSL Major version detection
and replace the foreach() loop in misc/CMakeLists.txt
by the simpler list(TRANSFORM ...)
If the current file extension does not match the first entry
in the "filter" section of the file dialog, the first extension
is erroneosuly appended to the file name.
Moving "All Files ( * )" in front as first entry avoids this.
Create/copy from README.md documentation about remote databases.
Add Help button to Remote database dialog.
Extend documentation in the Windows msi installer
Improve the timer interval maintenance process:
- Do not fire every second,
but at most 1 second after the last run
- Reduce the fired events.
- Every container now only evaluates its own elements
(keys, certs,etc.) instead of each container evaluating all
items and duplicating work
Disable sorting and resizing in the view during initialization,
to speed up opening the database
Before this change, the export format descriptions were created
statically before any translation has been setup.
Now it is created after the translation is setup and after every
language change.
The validation icon (check-mark or exclamation mark)
were not displayed correctly when using "email:copy" or
"issuer:copy" in the alternative names.
Setup the temporary X509V3_CTX before evaluating the
validity of "Subject Alternative Name" and "Issuer Alternative Name"
