Extend all 3 templates.
Skip AKID for self-signed certificates.
Visualize this by disabling the AKID checkbox
if a self-signed certificate is going to be created.
This check is performed before the certificate is
issued and signed. Like all the other checks
regarding validity, extensions and other things.
Issuing certificates that violate the Name Constraints
of any CA in the chain is still be possible.
But there will be a warning now with the name of the affected
CA-Certificate and the violated constraint.
The Issuer can then decide whether to issue the
certificate or not.
A new tab on the certificate details dialog
shows the result of the OpenSSL validation process
and the calculated OpenSSL Purpose.
The translation of the OpenSSL X509_V_ERR.... messsages
back to strings is done by grepping them from "openssl/x509_vfy.h"
and wrapping them into a macro-call.
Additionally guard them by an #ifdef (Zombieland rule #2: Double-Tap)
This way:
- I don't need to test and check in which versions of OpenSSL
which errors are available or not
- New errors will be picked up automatically, as long as they
match the "X509_V_ERR_" pattern
Introduced with 7f5bdb7dec
Templates now export again completely and
not only the internal name and comment.
Also protect against an empty internal name
by setting it to "Pasted" as last resort.
Conversion of name constraints from certificate to Template
(Advanced Tab) and using them from there was working since long.
Now there is an additional input line, like (and next to)
SubjectAlternativeName with live validation and edit button
with guided input.
The conversion from cert to template now puts the extension
into the correct LineEdit and not on the Advanced Tab anymore.
However, XCA does NOT follow the constraints, yet.
It is still possible to issue certificates with arbitrary
names, independent of any "Name Constraints" in the CA.
This is what issue #239 asks for.
Use the provided plural mechanisms of QT.
The "PO" translation also works smoothly and
the translation mechanisms between .po <-> .qt
was tested successfully.
The new english translation file translates
the single phrase:
"Delete the %n revocation list(s): '%1'?"
into
"Delete the revocation list: '%1'?" for one item
and
"Delete the %n revocation lists: '%1'?" otherwise
- Still ask before overwriting files.
- Error out if file name exists, but is not a file.
- Ask to create non-existing directories
- Check if an expected directory either really
is a directory or does not exist.
When exporting items into encrypted files, the checkbox
"Same encryption password for all items" may be used to enter
one password once for all items.
Otherwise a new password dialog opens for each exported entry.
Extend the ExportFile dialog by a checkbox to
switch between "all-in-one-file" or every item in a separate
file. It is only visible if more than one file is selected.
Activating the checkbox will:
- Change the file-input into a directory-input and cut off the
file name
- Disabling all formats that are intended for multiple items.
De-activating the checkbox will:
- Change the directory-input back into a file-input
and append the previously erased file name again.
- Disabling all export-formats that are only useful for single items.
Do not resolve symlinks of PKCS#11 library paths.
However the native file dialogs for example on MAC OS
do always resolve symbolic links.
In this case xca may be started with the --no-native-dialogs
commandline option when specifying new libraries.
coreApp->setOrganizationDomain() expects the domain
in DNS order (hohnstaedt.de) and not reversed.
Change the WM_CLASS property to "de.hohnstaedt.xca"
via setApplicationName().
While Qt6 prepends the reversed "OrganizationDomain",
Qt5 does not and setting the complete name with
domain-prefix works for both.
Also adopt the ".desktop" file name to follow the application-name
and fix issues found by "desktop-file-validate"
Changing RST files in doc now result in a recreation
of the HTML and QtHelp files during build.
The sphinx-html and sphinx-qthelp targets need to
depend on sphinx-src to create that target files only once
(and not twice in parallel during parellel builds)
and also on all output files sphinx-src depends on.
.
Replace "UPN:" by "otherName:msUPN;UTF8:" when generating
the extension from the Subject- and IssuerAlternativeName.
Extend the Edit dialog of the SAN and IAN by the "UPN" prefix.
Replace "otherName:msUPN;UTF8:" by "UPN:" when creating a template
from an existing certificate or request.
The OpenSSL config file export, the configuration display
and edit on the "Advanced Tab" are not afffected, since
this is an XCA syntax sugar, not supported by OpenSSL.
Update documentation
Use the probably modified internal name of the template
in the template-details dialog before import.
Therefore the name of the qlineedit of the internal name of
all other details dialogs changed from "descr" to "description"
to match the name in the NewX509 dialog and to be found
by the "XcaDetails" class.
When exporting the template data, add the internal name and the comment
to the exported data.
The XCA template data is defined by us and can be modified.
This change is backwards and upwards compatible:
New versions of XCA can read an old Template export and vice-versa.
