This is a large squash of many small commits.
Allow porting data from the legacy format to SQL.
Store Binaries base64 encoded and use db->transaction
Update password hash to be 8000 x SHA512 with 8 byte Salt
Add revocations table and fixup CRL generation
Add comment and insertion date columns
Fix column saving, remove trust, add XcaDialog
Allow changing the internal name and comment in Cert/Req details view
Extend Comment functionality, Replace About.ui by XcaDialog.ui
The API changed heavily. New functions arrived, old functions
disappeared and many structures became opaque.
This version of the patch implements pkcs11 signing as follows:
- openssl < 1.0.0: rsa & dsa without engine
- openssl 1.0.x: rsa, dsa & ec with engine
- openssl >= 1.1.0: rsa, dsa & ec without engine
In the operation, we therefore also gain implementation of dsa signing for openssl < 1.0.0 (ec disabled because EC_KEY_METHOD was not yet invented!).
I've given up trying to use a PKEY_ENGINE with openssl 1.1: seems not possible anymore.
I've succeeded compiling the patched xca with openssl 0.9.8n, 1.0.2j and 1.1.0e.
I've successfully tested pkcs11 signing using softhsm with openssl 1.0.2j and 1.1.0e.
The patch also removes gcc7 new warnings.
Better support multiple selections
- Export all selected items into one PEM file
- Batch Revoke/unrevoke/renew of many selected certificates
of the same issuer
- allow exporting templates as PEM
Add Feat. Reg. #83 Option to revoke old certificate when renewing
Always put all signed certificate to the newest CA.
If a CA certificate is renewed, all certificates issued by
the old CA are now shown as signed by the new one.
On startup use "/dev/random" and "/dev/hwrng"
as additional entropy for the OpenSSL random pool.
Collect mouse position and key press time entropy
for seeding the openssl random pool before generating keys.
When using Smartcards, use the Smartcard RNG
as additional entropy source.
- Delete invalid items (on demand)
- Be more tolerant against database errors
- Gracefully handle and repair corrupt databases
- Add "db_dump(.exe)" binary to all installations
Undefined end dates are described in RFC-5280
Invalid dates should never ever arise in certificates.
Add configuration option to disable the colorization of expired dates.
Since OpenSC is not part of XCA anymore, set the default
PKCS#11 lib on windows to C:\WINDOWS\system32\opensc-pkcs11.dll
Also disable Token menu after closing a database.
change storage type of passwords from char[] to QByteArray
Create PwDialog class and drop passWrite and passRead
Create Passwd class derived from QBytearray
move PKCS12 password input to PwDialog
- replace occurances of "Smart Card" by "Token"
- Support for creating keys on a token
- Store existing keys on a token
- delete keys and certs from a token
- update docs
- allow "umlauts" and other non ASCII char in database filenames
using the OS dependent handling QString2filename, using
8Bit codepage encoding on Windows and UTF8 on linux and OS X
- if PublicKey or Cert CKA_LABEL fails, try CKA_SUBJECT
- don't use CKA_VALUE attribute on PUBLIC_KEY,
because not everyone supports it.
While being at it, add code for DSA and EC Cards.
- load PKCS#11 engine only after database open.
- avoid reloading the DLL on windows, because it is not supported.
Windows users need to restart XCA after changing the PKCS#11 path
- fix getSlotList() and return a QList<unsigned long>
- fixes to not crash if Smart card support is missing
- select correct list of hash algos by
reading PKCS11 mechanisms per slot and save them among with
the card in the db
- remove debugging code
- allow to configure the path to the PKCS#11 library
- copy pkcs11 header-file into XCA lib
