The API changed heavily. New functions arrived, old functions
disappeared and many structures became opaque.
This version of the patch implements pkcs11 signing as follows:
- openssl < 1.0.0: rsa & dsa without engine
- openssl 1.0.x: rsa, dsa & ec with engine
- openssl >= 1.1.0: rsa, dsa & ec without engine
In the operation, we therefore also gain implementation of dsa signing for openssl < 1.0.0 (ec disabled because EC_KEY_METHOD was not yet invented!).
I've given up trying to use a PKEY_ENGINE with openssl 1.1: seems not possible anymore.
I've succeeded compiling the patched xca with openssl 0.9.8n, 1.0.2j and 1.1.0e.
I've successfully tested pkcs11 signing using softhsm with openssl 1.0.2j and 1.1.0e.
The patch also removes gcc7 new warnings.
Updated patch adds another export option automating the creation
of multiple index.txt files to be used with multiple ocsp responders.
New export option is available via command line (-I index.txt) and
the Extras menu (Extra->Export Certificate Index hierarchy).
The option causes the creation of an index.txt file containing
index records for all the children certificates of a parent.
The filenames are generated using the supplied name as prefix
and append a dot and the simplified Internal Name
(the Internal Name stripped of non-alphanumeric characters except underscores).
XCA currently lacks support for generating an index.txt.
Such a file gets created and maintained when using CA
features in openssl. As mentioned here:
https://sourceforge.net/p/xca/discussion/209946/thread/6cbc727c/#2310
such a file can be used by Openssl's built-in OCSP responder.
Additionally, it can be used for configuring a cron job for
reminding of certificate expiration.
Certificate index export is added in 3 places:
- command line (-i index.txt),
- the Extras menu (Extra->Export Certificate Index) and
- the selected file(s) export option in the context menu
on the Certificates tab (Export->File, Export Format:
Certificate Index file).
Please note that SubjectDN generated by this feature has
different formatting than the one generated by openssl.
The removed people did not add any code since more than 10 years.
cwUsersPeople having questions also write them,
which could be annoying.
Anyway: Thanks for your collaboration!
Additionally set the toolTip with the internal name
of the revoked certificate for all columns
Thanks to Patrick Monnerat <Patrick.Monnerat@datasphere.ch>
Better support multiple selections
- Export all selected items into one PEM file
- Batch Revoke/unrevoke/renew of many selected certificates
of the same issuer
- allow exporting templates as PEM
Add Feat. Reg. #83 Option to revoke old certificate when renewing
Always put all signed certificate to the newest CA.
If a CA certificate is renewed, all certificates issued by
the old CA are now shown as signed by the new one.
.. between subject alternative names, spaces break the editor
The spaces are not recognized correctly, when editing with
the v3ext editor.
It now peoperly removes spaces at the beginning and end
of each part.
On startup use "/dev/random" and "/dev/hwrng"
as additional entropy for the OpenSSL random pool.
Collect mouse position and key press time entropy
for seeding the openssl random pool before generating keys.
When using Smartcards, use the Smartcard RNG
as additional entropy source.
