This check is performed before the certificate is
issued and signed. Like all the other checks
regarding validity, extensions and other things.
Issuing certificates that violate the Name Constraints
of any CA in the chain is still be possible.
But there will be a warning now with the name of the affected
CA-Certificate and the violated constraint.
The Issuer can then decide whether to issue the
certificate or not.
A new tab on the certificate details dialog
shows the result of the OpenSSL validation process
and the calculated OpenSSL Purpose.
The translation of the OpenSSL X509_V_ERR.... messsages
back to strings is done by grepping them from "openssl/x509_vfy.h"
and wrapping them into a macro-call.
Additionally guard them by an #ifdef (Zombieland rule #2: Double-Tap)
This way:
- I don't need to test and check in which versions of OpenSSL
which errors are available or not
- New errors will be picked up automatically, as long as they
match the "X509_V_ERR_" pattern
Introduced with 7f5bdb7dec
Templates now export again completely and
not only the internal name and comment.
Also protect against an empty internal name
by setting it to "Pasted" as last resort.
Conversion of name constraints from certificate to Template
(Advanced Tab) and using them from there was working since long.
Now there is an additional input line, like (and next to)
SubjectAlternativeName with live validation and edit button
with guided input.
The conversion from cert to template now puts the extension
into the correct LineEdit and not on the Advanced Tab anymore.
However, XCA does NOT follow the constraints, yet.
It is still possible to issue certificates with arbitrary
names, independent of any "Name Constraints" in the CA.
This is what issue #239 asks for.
Use the provided plural mechanisms of QT.
The "PO" translation also works smoothly and
the translation mechanisms between .po <-> .qt
was tested successfully.
The new english translation file translates
the single phrase:
"Delete the %n revocation list(s): '%1'?"
into
"Delete the revocation list: '%1'?" for one item
and
"Delete the %n revocation lists: '%1'?" otherwise
Extend the ExportFile dialog by a checkbox to
switch between "all-in-one-file" or every item in a separate
file. It is only visible if more than one file is selected.
Activating the checkbox will:
- Change the file-input into a directory-input and cut off the
file name
- Disabling all formats that are intended for multiple items.
De-activating the checkbox will:
- Change the directory-input back into a file-input
and append the previously erased file name again.
- Disabling all export-formats that are only useful for single items.
coreApp->setOrganizationDomain() expects the domain
in DNS order (hohnstaedt.de) and not reversed.
Change the WM_CLASS property to "de.hohnstaedt.xca"
via setApplicationName().
While Qt6 prepends the reversed "OrganizationDomain",
Qt5 does not and setting the complete name with
domain-prefix works for both.
Also adopt the ".desktop" file name to follow the application-name
and fix issues found by "desktop-file-validate"
Replace "UPN:" by "otherName:msUPN;UTF8:" when generating
the extension from the Subject- and IssuerAlternativeName.
Extend the Edit dialog of the SAN and IAN by the "UPN" prefix.
Replace "otherName:msUPN;UTF8:" by "UPN:" when creating a template
from an existing certificate or request.
The OpenSSL config file export, the configuration display
and edit on the "Advanced Tab" are not afffected, since
this is an XCA syntax sugar, not supported by OpenSSL.
Update documentation
Use the probably modified internal name of the template
in the template-details dialog before import.
Therefore the name of the qlineedit of the internal name of
all other details dialogs changed from "descr" to "description"
to match the name in the NewX509 dialog and to be found
by the "XcaDetails" class.
When exporting the template data, add the internal name and the comment
to the exported data.
The XCA template data is defined by us and can be modified.
This change is backwards and upwards compatible:
New versions of XCA can read an old Template export and vice-versa.
--no-native-dialogs disables QTs feature to display
OS specific dialogs for message-boxes and file-open dialogs.
This is currently necessary for flatpak, but may be helpful in other
occasions, too.
Allow exporting encrypted ED25519 keys.
The crypt flag was disallowed to support SSH2 export.
But since the SSH2 key is written unencrypted,
this restriction makes no sense anymore.
Move writeSSH2private() and write_SSH2_ed25519_private()
from pki_key.cpp (base class for public keys)
to pki_evp.cpp (derived class for private keys)
Extend the function to write RSA/DSA/EC in traditional
format.
Remove the PEM flag from the export format to not be catched
by (PEM | PRIVATE) selector in db_key::exportItem().
Stay with QT 6.6.3 on Windows, because windeployqt
does not deploy the gcc libs with QT 6.7.2
Stay with QT 6.6.3 on MacOS, because the info/warning
message does not show an icon
Generalize the Clipboard format selection
and extend it to certificates.
Certificates may now be exported as chain
or together with private key.
The clipboard format selection also
affects the Drag&Drop content.
The Export->Clipboard men now also shows the
currently selected format export.
Also look in the directory of the application
if no other translation was found.
Add search path for qt5 or qt6 library translations
depending on the compiletime library version
Use static initializers while at it.
The "takeys" table was only created for existing databases.
New databases were immediately marked as version "8" databases
and the tykeys table creation was skipped.
Setting in opensc.conf:
reader_driver pcsc {
enable_pinpad = true;
}
Only call login once and return an empty pin
instead of a NULL pin, which indicated a failure
while an empty (non-NULL) return-value
indicates success.
Show the insecure algorithms with the postfix (insecure)
in the dropdown menu.
Since the "insecure" is translateable, put the algorithm NID
into the data field of the combo-box entry to
reliably find the correct entry by NID instead of text.
Put it into the "PlugIns" directory and load it from there.
Show whether the legacy-provider was loaded in the About-Dialog.
CmakeLists.txt: Improve OpenSSL Major version detection
and replace the foreach() loop in misc/CMakeLists.txt
by the simpler list(TRANSFORM ...)
The ta-key will be generated on-demand and assigned to the
issuing CA. All issued certificates of this CA will use the
same ta-key.
It can be exported as single file and will also be part of the
exported openvpn configuration file.
Extend export tests to validate the output of ta-keys
and adapt the OpenVPN conf file export test to also check the ta-key.
