When using PKCS11 library to manage smart cards the code assumes
that all slots returned by the library call are not empty.
In some cases Gemalto's library returns list of slots in which the
first one is empty and the second one is occupied by the smart card,
this causes xca to report an error and isn't able to use the smart card.
- Remove all aia.txt from the Code, Documentation and ToolTip
- Add an Operating system dependent help hint
- Replace unix LF by DOS CR-LF for windows installation
Depending on the OpenSSL version some OIDs are known, some are not.
When reading "oids.txt" file and adding the new OID definitions:
- Silently skip definitions that are 100% identical to the OpenSSL values.
- Give a hint to change identifiers that are used for a different OID
- Give a hint about definitions that differ to remove them from the file.
Also accept them as Alias when reading dn.txt and eku.txt
If the database password is empty, dumping private keys
resulted in an error message.
Fix this by setting the encryption algorithm to NULL if
the password is empty.
Additionally throw the error after closing the filedescriptor.
The API changed heavily. New functions arrived, old functions
disappeared and many structures became opaque.
This version of the patch implements pkcs11 signing as follows:
- openssl < 1.0.0: rsa & dsa without engine
- openssl 1.0.x: rsa, dsa & ec with engine
- openssl >= 1.1.0: rsa, dsa & ec without engine
In the operation, we therefore also gain implementation of dsa signing for openssl < 1.0.0 (ec disabled because EC_KEY_METHOD was not yet invented!).
I've given up trying to use a PKEY_ENGINE with openssl 1.1: seems not possible anymore.
I've succeeded compiling the patched xca with openssl 0.9.8n, 1.0.2j and 1.1.0e.
I've successfully tested pkcs11 signing using softhsm with openssl 1.0.2j and 1.1.0e.
The patch also removes gcc7 new warnings.
Updated patch adds another export option automating the creation
of multiple index.txt files to be used with multiple ocsp responders.
New export option is available via command line (-I index.txt) and
the Extras menu (Extra->Export Certificate Index hierarchy).
The option causes the creation of an index.txt file containing
index records for all the children certificates of a parent.
The filenames are generated using the supplied name as prefix
and append a dot and the simplified Internal Name
(the Internal Name stripped of non-alphanumeric characters except underscores).
XCA currently lacks support for generating an index.txt.
Such a file gets created and maintained when using CA
features in openssl. As mentioned here:
https://sourceforge.net/p/xca/discussion/209946/thread/6cbc727c/#2310
such a file can be used by Openssl's built-in OCSP responder.
Additionally, it can be used for configuring a cron job for
reminding of certificate expiration.
Certificate index export is added in 3 places:
- command line (-i index.txt),
- the Extras menu (Extra->Export Certificate Index) and
- the selected file(s) export option in the context menu
on the Certificates tab (Export->File, Export Format:
Certificate Index file).
Please note that SubjectDN generated by this feature has
different formatting than the one generated by openssl.
