XCA-2.x stores the "request signed" information permanently
in the database.
XCA-1.x dynamically calculated this information by looking
for certificates with the same public key.
When converting an XCA-1.x database, requests with a matching cert
are marked signed in the XCA-2.x database.
(XCA 2.x - Relationship CSR <-> issued Certificate broken)
This counter is dynamic and not stored in the DB.
In comparison to the signed flag, which is stored and
remains set in the DB, even if all certificates
issued by signing this request are deleted.
Since the first support of extensions for CSR (2005),
the Subject Key Identifier has been skipped.
Enable it, while still removing issuer extensions.
Better fix "Automatic X509v3 extensions for CSR"
Allow displaying the public key of a certificate
or request without importing it.
When importing certificates or CRLs,
display the issuer if it exists in the database.
This is a large squash of many small commits.
Allow porting data from the legacy format to SQL.
Store Binaries base64 encoded and use db->transaction
Update password hash to be 8000 x SHA512 with 8 byte Salt
Add revocations table and fixup CRL generation
Add comment and insertion date columns
Fix column saving, remove trust, add XcaDialog
Allow changing the internal name and comment in Cert/Req details view
Extend Comment functionality, Replace About.ui by XcaDialog.ui
The API changed heavily. New functions arrived, old functions
disappeared and many structures became opaque.
This version of the patch implements pkcs11 signing as follows:
- openssl < 1.0.0: rsa & dsa without engine
- openssl 1.0.x: rsa, dsa & ec with engine
- openssl >= 1.1.0: rsa, dsa & ec without engine
In the operation, we therefore also gain implementation of dsa signing for openssl < 1.0.0 (ec disabled because EC_KEY_METHOD was not yet invented!).
I've given up trying to use a PKEY_ENGINE with openssl 1.1: seems not possible anymore.
I've succeeded compiling the patched xca with openssl 0.9.8n, 1.0.2j and 1.1.0e.
I've successfully tested pkcs11 signing using softhsm with openssl 1.0.2j and 1.1.0e.
The patch also removes gcc7 new warnings.
0.9.0 behaved like "openssl req -asn1-kludge"
See: http://www.openssl.org/docs/apps/req.html
Now the PKCS#10 request comntains the non-optional, empty SET OF Attribute
Thanks to Kalev Toots (kalev.toots at eepos.ee) for spotting this.
right-align numeric columns and make them monospaced.
Save their current state in the database.
Also add column-menu to the other context menu
fix minor bugs
Support for "Unstructured Name" and "challange password" columns
in the request-table
Support for name hash as used by OpenSSL to lookup certs.
As table column and as distinguished name information
Keys: Sort Keysize numerical
Certs: CA, fingerprints, start date (notBefore)
Crl: CRL number , Last update
Requests, Crls, Templates, Certs: All subject items and the full name
- extended russian translation by Pavel Belly
- dropped approach to create sentences from different parts
like "Successfully created %1 '%2'" with %1 being "the certificate"
and %2 being the name. This leads to trouble for other languages.
Therefore I decided to mention the whole sentences and accept
the many, almost duplicated sentences.
- Consolidate german translation:
. Smart card/Smartcard -> Chipkarte
. Besitzer -> Inhaber
. Unterschriftsanfrage/Zertifikatsanfrage -> Zertifikatsantrag
- Support translations for pki_*.cpp by adding Q_OBJECT
