Extend all 3 templates.
Skip AKID for self-signed certificates.
Visualize this by disabling the AKID checkbox
if a self-signed certificate is going to be created.
Conversion of name constraints from certificate to Template
(Advanced Tab) and using them from there was working since long.
Now there is an additional input line, like (and next to)
SubjectAlternativeName with live validation and edit button
with guided input.
The conversion from cert to template now puts the extension
into the correct LineEdit and not on the Advanced Tab anymore.
However, XCA does NOT follow the constraints, yet.
It is still possible to issue certificates with arbitrary
names, independent of any "Name Constraints" in the CA.
This is what issue #239 asks for.
Previously the request extensions were ignored
when they also existed on one of the other tabs.
Now they are correctly listed and marked as duplicated.
If we have a QByteArray (ba) and must provide it to
a BIO* expecting OpenSSL function, the following
construct provides it: BioByteArray(ba).ro()
directly providing the QByteArray buffer as BIO
It also supports mixed writes:
BIO_write(bba, buf, size)
bba += QByteArray
also fixes "#46 AIA, simultaneous OCSP and caIssuers"
Move "OCSP/caIssuers" index from a separate drop down
into the single dropdown of URI/IP/DNS...
This change not only fixes the bug, but also removes some
special handling for the AIA extension.
Adding features by deleting code is highly appreciated :-)
Add settings class to access the settings table in the database
Cache values and improve database writes.
Options dialog simplified
Replace getSetting / storeSetting
Unpack option flags to rows in the settings
The API changed heavily. New functions arrived, old functions
disappeared and many structures became opaque.
This version of the patch implements pkcs11 signing as follows:
- openssl < 1.0.0: rsa & dsa without engine
- openssl 1.0.x: rsa, dsa & ec with engine
- openssl >= 1.1.0: rsa, dsa & ec without engine
In the operation, we therefore also gain implementation of dsa signing for openssl < 1.0.0 (ec disabled because EC_KEY_METHOD was not yet invented!).
I've given up trying to use a PKEY_ENGINE with openssl 1.1: seems not possible anymore.
I've succeeded compiling the patched xca with openssl 0.9.8n, 1.0.2j and 1.1.0e.
I've successfully tested pkcs11 signing using softhsm with openssl 1.0.2j and 1.1.0e.
The patch also removes gcc7 new warnings.
become more userfriendly:
- by indicating the validity with an appropriate
icon in front of AIA, SAN IAN and CDP.
- by checking the validity before creating the real certificate.
- by improving the edit button, to automatically add an "URI"
as type, if the type is missing, or is for example "http"
Add a button to the certificate detila dialog to show the
extensions as OpenSSL config
improve AuthKeyId
Allow selecting public keys for certificates.
This works if it is signed by an other cert.
get rid of ext_str_new() and ext_str_free()
use d2i() and XX_free() instead
support for unrecognized extensions as DER stream
improve altName: otherName
Support Bitfields: keyUsage and ns_certType
- while taking extensions from the request, the advanced tab
and the other tabs, extensions may be duplicated.
They will be now diplayed in
detail and duplicates are found and shown clearly.
Warning message will allow for modifications.
- Fixes
[ 1881482 ] Copy extensions from request seems to fail
[ 1998815 ] xca adds basic constraint "CA" twice resulting in invalid CA
- remove extension and attribute tab in details dialog if
no extensions or attributes available
- documentation updated
X509 request attributes (like challange password) can be set and viewed.
