And ImportMulti handles pki_multi sufficiently
and does not need to know about pkcs12 or pkcs7
pkcs12 and pkcs7 don't need: print() getCa() addCaCert() numCa()
it is handled by pki_multi()
Take advantage of the power of dynamic_cast<>() instead of using
typeid()
New classes:
- database_model: Manage the database tables (keys, req, cert, crl, templ)
extracted from widgets/MW_database.cpp
- arguments: parse commandline, dynamically create help text
Fix finding our unassigned certificates when importing a CA
(issuerSqlId may be QVariant(int, 0) depending on the database)
Reassign certs from an older CA to the imported one.
Translate the special text "DNS:copycn" in the SAN to
the final common name.
Add checkobox "Copy Common Name" to the SAN Edit box,
for a user-friendly editing of the "DNS:copycn"
During certificate creation, an empty common name together with
"DNS:copycn" in the SAN will raise a warning message and the
opportunity to change the settings.
Change the SAN in the HTTP-server XCA template from
"DNS:your.server.name.here" to "DNS:copycn" to already
take advantage of this feature in the default template.
This is a large squash of many small commits.
Allow porting data from the legacy format to SQL.
Store Binaries base64 encoded and use db->transaction
Update password hash to be 8000 x SHA512 with 8 byte Salt
Add revocations table and fixup CRL generation
Add comment and insertion date columns
Fix column saving, remove trust, add XcaDialog
Allow changing the internal name and comment in Cert/Req details view
Extend Comment functionality, Replace About.ui by XcaDialog.ui
The API changed heavily. New functions arrived, old functions
disappeared and many structures became opaque.
This version of the patch implements pkcs11 signing as follows:
- openssl < 1.0.0: rsa & dsa without engine
- openssl 1.0.x: rsa, dsa & ec with engine
- openssl >= 1.1.0: rsa, dsa & ec without engine
In the operation, we therefore also gain implementation of dsa signing for openssl < 1.0.0 (ec disabled because EC_KEY_METHOD was not yet invented!).
I've given up trying to use a PKEY_ENGINE with openssl 1.1: seems not possible anymore.
I've succeeded compiling the patched xca with openssl 0.9.8n, 1.0.2j and 1.1.0e.
I've successfully tested pkcs11 signing using softhsm with openssl 1.0.2j and 1.1.0e.
The patch also removes gcc7 new warnings.
Updated patch adds another export option automating the creation
of multiple index.txt files to be used with multiple ocsp responders.
New export option is available via command line (-I index.txt) and
the Extras menu (Extra->Export Certificate Index hierarchy).
The option causes the creation of an index.txt file containing
index records for all the children certificates of a parent.
The filenames are generated using the supplied name as prefix
and append a dot and the simplified Internal Name
(the Internal Name stripped of non-alphanumeric characters except underscores).
XCA currently lacks support for generating an index.txt.
Such a file gets created and maintained when using CA
features in openssl. As mentioned here:
https://sourceforge.net/p/xca/discussion/209946/thread/6cbc727c/#2310
such a file can be used by Openssl's built-in OCSP responder.
Additionally, it can be used for configuring a cron job for
reminding of certificate expiration.
Certificate index export is added in 3 places:
- command line (-i index.txt),
- the Extras menu (Extra->Export Certificate Index) and
- the selected file(s) export option in the context menu
on the Certificates tab (Export->File, Export Format:
Certificate Index file).
Please note that SubjectDN generated by this feature has
different formatting than the one generated by openssl.
