This check is performed before the certificate is
issued and signed. Like all the other checks
regarding validity, extensions and other things.
Issuing certificates that violate the Name Constraints
of any CA in the chain is still be possible.
But there will be a warning now with the name of the affected
CA-Certificate and the violated constraint.
The Issuer can then decide whether to issue the
certificate or not.
Conversion of name constraints from certificate to Template
(Advanced Tab) and using them from there was working since long.
Now there is an additional input line, like (and next to)
SubjectAlternativeName with live validation and edit button
with guided input.
The conversion from cert to template now puts the extension
into the correct LineEdit and not on the Advanced Tab anymore.
However, XCA does NOT follow the constraints, yet.
It is still possible to issue certificates with arbitrary
names, independent of any "Name Constraints" in the CA.
This is what issue #239 asks for.
Replace "UPN:" by "otherName:msUPN;UTF8:" when generating
the extension from the Subject- and IssuerAlternativeName.
Extend the Edit dialog of the SAN and IAN by the "UPN" prefix.
Replace "otherName:msUPN;UTF8:" by "UPN:" when creating a template
from an existing certificate or request.
The OpenSSL config file export, the configuration display
and edit on the "Advanced Tab" are not afffected, since
this is an XCA syntax sugar, not supported by OpenSSL.
Update documentation
Previously the request extensions were ignored
when they also existed on one of the other tabs.
Now they are correctly listed and marked as duplicated.
The validation icon (check-mark or exclamation mark)
were not displayed correctly when using "email:copy" or
"issuer:copy" in the alternative names.
Setup the temporary X509V3_CTX before evaluating the
validity of "Subject Alternative Name" and "Issuer Alternative Name"
Until now XCA templates could not be viewed during import.
But this is necessary to skip the multi-import dialog.
The NewX509 dialog is used with almost everything disabled.
When XCA started in 2002, there were no C++ initializers.
Drop explicit initializers from the constructors.
- Fix indentations of section declarators.
- Replace NULL by nullptr when feasible.
- Sort private section: properties first, then methods.
There were 2 slots to trigger the switchHashAlgo()
whenever the selected key or request changes.
But their signature for automatic connect()ion was wrong.
After fixing the methods signature, they are connected
and get called whenever the keylist changes and especially,
when a new key is inserted.
XCA now supports both, Qt6 and Qt5 down to Qt-5.2
Use CMAKE_PREFIX_PATH to point to the QT dompiler directory like
$ cmake -B build -DCMAKE_PREFIX_PATH=$HOME/6.3.1/gcc_64
instead of calling it indirectly through signal-slot
mechanism.
This way we can set ourselves as parent to work
properly with Qt::WindowModal modality.
All dialogs get the "Qt::WindowModal" modality to
operate the Help window in parallel
while also blocking the dialog parent windows.
The manageRevocations() moved from model to view
The Details dialogs become more self-sufficient.
There is a statc start method that shows the dialog and
updates name and comment after accept().
This allows recursive starts of certificate details and
independence of mainwin.
It is necessary to set the current toplevel widget as parent
for the next dialog to not block the application.
The global variable "Database" of class xca_db
can be used by any other class to access. No need
to provide it.
The "xca_db" class managed the "database_model" pointer.
Accessing the name of the current database has been unified.
also fixes "#46 AIA, simultaneous OCSP and caIssuers"
Move "OCSP/caIssuers" index from a separate drop down
into the single dropdown of URI/IP/DNS...
This change not only fixes the bug, but also removes some
special handling for the AIA extension.
Adding features by deleting code is highly appreciated :-)
also fixes "#46 AIA, simultaneous OCSP and caIssuers"
Move "OCSP/caIssuers" index from a separate drop down
into the single dropdown of URI/IP/DNS...
This change not only fixes the bug, but also removes some
special handling for the AIA extension.
Adding features by deleting code is highly appreciated :-)
in the past it was used to connect the NewX509 dialog
with requests keys and certs.
The NewX509 dialog knows mainwin since some time
and thus can connect itself to models and views
mainwin: use model<T>() instead of models->model<T>()
New classes:
- database_model: Manage the database tables (keys, req, cert, crl, templ)
extracted from widgets/MW_database.cpp
- arguments: parse commandline, dynamically create help text
When transforming certificate or request extensions
into a template, the (e)keyusage critical flags storage
had a typo:
"eKyUseCritical" instead of "ekuCritical" and
"keyUseCritical" instead of "kuCritical"
Also the eKeyUse value was not transformed completely.
Since the first support of extensions for CSR (2005),
the Subject Key Identifier has been skipped.
Enable it, while still removing issuer extensions.
Better fix "Automatic X509v3 extensions for CSR"
When editing a template or applying a template during
certificate or request generation, the explicit entries
are reordered by the current order of the template subject.
All entries that are mentioned in the explicit DN entry
configuration setting, but not part of the template DN
are appended.
