Conversion of name constraints from certificate to Template
(Advanced Tab) and using them from there was working since long.
Now there is an additional input line, like (and next to)
SubjectAlternativeName with live validation and edit button
with guided input.
The conversion from cert to template now puts the extension
into the correct LineEdit and not on the Advanced Tab anymore.
However, XCA does NOT follow the constraints, yet.
It is still possible to issue certificates with arbitrary
names, independent of any "Name Constraints" in the CA.
This is what issue #239 asks for.
Replace "UPN:" by "otherName:msUPN;UTF8:" when generating
the extension from the Subject- and IssuerAlternativeName.
Extend the Edit dialog of the SAN and IAN by the "UPN" prefix.
Replace "otherName:msUPN;UTF8:" by "UPN:" when creating a template
from an existing certificate or request.
The OpenSSL config file export, the configuration display
and edit on the "Advanced Tab" are not afffected, since
this is an XCA syntax sugar, not supported by OpenSSL.
Update documentation
When XCA started in 2002, there were no C++ initializers.
Drop explicit initializers from the constructors.
- Fix indentations of section declarators.
- Replace NULL by nullptr when feasible.
- Sort private section: properties first, then methods.
When analysing and translating the AuthorityKeyIdentifier
extension to OpenSSL syntax, take an existing DirName
as "issuer:always", because openssle otherwise ignores it,
when the keyid succeeds.
If we have a QByteArray (ba) and must provide it to
a BIO* expecting OpenSSL function, the following
construct provides it: BioByteArray(ba).ro()
directly providing the QByteArray buffer as BIO
It also supports mixed writes:
BIO_write(bba, buf, size)
bba += QByteArray
Translate the special text "DNS:copycn" in the SAN to
the final common name.
Add checkobox "Copy Common Name" to the SAN Edit box,
for a user-friendly editing of the "DNS:copycn"
During certificate creation, an empty common name together with
"DNS:copycn" in the SAN will raise a warning message and the
opportunity to change the settings.
Change the SAN in the HTTP-server XCA template from
"DNS:your.server.name.here" to "DNS:copycn" to already
take advantage of this feature in the default template.
The API changed heavily. New functions arrived, old functions
disappeared and many structures became opaque.
This version of the patch implements pkcs11 signing as follows:
- openssl < 1.0.0: rsa & dsa without engine
- openssl 1.0.x: rsa, dsa & ec with engine
- openssl >= 1.1.0: rsa, dsa & ec without engine
In the operation, we therefore also gain implementation of dsa signing for openssl < 1.0.0 (ec disabled because EC_KEY_METHOD was not yet invented!).
I've given up trying to use a PKEY_ENGINE with openssl 1.1: seems not possible anymore.
I've succeeded compiling the patched xca with openssl 0.9.8n, 1.0.2j and 1.1.0e.
I've successfully tested pkcs11 signing using softhsm with openssl 1.0.2j and 1.1.0e.
The patch also removes gcc7 new warnings.
Extract public key from cert and request
Show public keys in requests- and cert-details in red
Allow using public keys for certs. Useful if not selfsigning
Add a button to the certificate detila dialog to show the
extensions as OpenSSL config
improve AuthKeyId
Allow selecting public keys for certificates.
This works if it is signed by an other cert.
get rid of ext_str_new() and ext_str_free()
use d2i() and XX_free() instead
support for unrecognized extensions as DER stream
improve altName: otherName
Support Bitfields: keyUsage and ns_certType
- add input validators
- add information about valid characters and length
- add translations
- untranslate X509 specific expressions
- add 'critical' checkbox to SAN IAN AIA CDP edit box
- while taking extensions from the request, the advanced tab
and the other tabs, extensions may be duplicated.
They will be now diplayed in
detail and duplicates are found and shown clearly.
Warning message will allow for modifications.
- Fixes
[ 1881482 ] Copy extensions from request seems to fail
[ 1998815 ] xca adds basic constraint "CA" twice resulting in invalid CA
