Improve error- and password handling:
- Also identify: (ERR_LIB_PROV:PROV_R_BAD_DECRYPT) as password error.
- Do not use the OpenSSL internal bitfield definition (0xff000fff)
but the official API: ERR_GET_LIB(), ERR_GET_REASON()
Especially ERR_LIB_OFFSET changed from 24 to 23 in Openssl 3.0.0
- First check for "Cancel", then for invalid password to avoid
an "Invalid Password" message after aborting the password input dialog.
Evaluate --name argument when generating the CRL.
Add --import-names option. This allows to name the imported items
individually, even if one PEM file contains multiple items.
Support loading OpenSSH ED25519 private key
Improve private key verification in general.
ED25519 does not support EVP_PKEY_sign(), so use
EVP_DigestSign(), which in turn only works since OpenSSL 1.1.1
resulting in a backward compatibility quirk in openssl_compat.
If we have a QByteArray (ba) and must provide it to
a BIO* expecting OpenSSL function, the following
construct provides it: BioByteArray(ba).ro()
directly providing the QByteArray buffer as BIO
It also supports mixed writes:
BIO_write(bba, buf, size)
bba += QByteArray
And ImportMulti handles pki_multi sufficiently
and does not need to know about pkcs12 or pkcs7
pkcs12 and pkcs7 don't need: print() getCa() addCaCert() numCa()
it is handled by pki_multi()
Take advantage of the power of dynamic_cast<>() instead of using
typeid()
Passwd::cleanse() also resets the password size
db_base::flushLookup() now deletes all items
and pki_base does not anymore.
Drop TRACE
Colorize pki_base::print()
Set and inherit filename of loaded items
Add print() method to pki_pkcs12
and constify its methods
New classes:
- database_model: Manage the database tables (keys, req, cert, crl, templ)
extracted from widgets/MW_database.cpp
- arguments: parse commandline, dynamically create help text
This is a large squash of many small commits.
Allow porting data from the legacy format to SQL.
Store Binaries base64 encoded and use db->transaction
Update password hash to be 8000 x SHA512 with 8 byte Salt
Add revocations table and fixup CRL generation
Add comment and insertion date columns
Fix column saving, remove trust, add XcaDialog
Allow changing the internal name and comment in Cert/Req details view
Extend Comment functionality, Replace About.ui by XcaDialog.ui
Better support multiple selections
- Export all selected items into one PEM file
- Batch Revoke/unrevoke/renew of many selected certificates
of the same issuer
- allow exporting templates as PEM
Add Feat. Reg. #83 Option to revoke old certificate when renewing
Always put all signed certificate to the newest CA.
If a CA certificate is renewed, all certificates issued by
the old CA are now shown as signed by the new one.
change storage type of passwords from char[] to QByteArray
Create PwDialog class and drop passWrite and passRead
Create Passwd class derived from QBytearray
move PKCS12 password input to PwDialog
