25#include <ksslconfig.h>
30#include <QtCore/QString>
31#include <QtCore/QStringList>
32#include <QtCore/QFile>
42#include <QtCore/QDate>
54#define crypt _openssl_crypt
55#include <openssl/ssl.h>
56#include <openssl/x509.h>
57#include <openssl/x509v3.h>
58#include <openssl/x509_vfy.h>
59#include <openssl/pem.h>
69static char hv[] = {
'0',
'1',
'2',
'3',
'4',
'5',
'6',
'7',
'8',
'9',
'A',
'B',
'C',
'D',
'E',
'F'};
72class KSSLCertificatePrivate {
74 KSSLCertificatePrivate() {
75 kossl = KOSSL::self();
79 ~KSSLCertificatePrivate() {
94 d =
new KSSLCertificatePrivate;
95 d->m_stateCached =
false;
104 d =
new KSSLCertificatePrivate;
105 d->m_stateCached =
false;
121 d->kossl->X509_free(d->m_cert);
138 n->
setCert(KOSSL::self()->X509_dup(x5));
148 if (cert.isEmpty()) {
152 QByteArray qba = QByteArray::fromBase64(cert);
153 unsigned char *qbap =
reinterpret_cast<unsigned char *
>(qba.data());
154 X509 *x5c = KOSSL::self()->d2i_X509(NULL, &qbap, qba.size());
171 char *t = d->kossl->X509_NAME_oneline(d->kossl->X509_get_subject_name(d->m_cert), 0, 0);
176 d->kossl->OPENSSL_free(t);
186 ASN1_INTEGER *aint = d->kossl->X509_get_serialNumber(d->m_cert);
188 rc = ASN1_INTEGER_QString(aint);
203 const X509_ALGOR *algor;
204 const ASN1_BIT_STRING *sig;
205 d->kossl->X509_get0_signature(&sig, &algor, d->m_cert);
206 i = d->kossl->OBJ_obj2nid(algor->algorithm);
207 rc =
i18n(
"Signature Algorithm: ");
208 rc += (i == NID_undef)?
i18n(
"Unknown"):QString(d->kossl->OBJ_nid2ln(i));
211 rc +=
i18n(
"Signature Contents:");
213 s = (
char *)sig->data;
214 for (i = 0; i < n; ++i) {
221 rc.append(QChar(
hv[(s[i]&0xf0)>>4]));
222 rc.append(QChar(
hv[s[i]&0x0f]));
238 STACK *s = d->kossl->X509_get1_email(d->m_cert);
239 const int size = d->kossl->OPENSSL_sk_num(s);
241 for(
int n=0; n < size; n++) {
242 to.append(d->kossl->OPENSSL_sk_value(s,n));
244 d->kossl->X509_email_free(s);
257 int pos = k.lastIndexOf(
'(');
259 unsigned int len = k.length();
260 if (k.at(len-1) ==
')') {
261 rc = k.mid(pos+1, len-pos-2);
273 unsigned char md[EVP_MAX_MD_SIZE];
275 if (!d->kossl->X509_digest(d->m_cert, d->kossl->EVP_md5(), md, &n)) {
279 for (
unsigned int j = 0; j < n; j++) {
283 rc.append(QChar(
hv[(md[j]&0xf0)>>4]));
284 rc.append(QChar(
hv[md[j]&0x0f]));
299 unsigned char md[EVP_MAX_MD_SIZE];
301 if (!d->kossl->X509_digest(d->m_cert, d->kossl->EVP_md5(), md, &n)) {
305 for (
unsigned int j = 0; j < n; j++) {
306 rc.append(QLatin1Char(
hv[(md[j]&0xf0)>>4]));
307 rc.append(QLatin1Char(
hv[md[j]&0x0f]));
321 EVP_PKEY *pkey = d->kossl->X509_get_pubkey(d->m_cert);
324 if (d->kossl->EVP_PKEY_base_id(pkey) == EVP_PKEY_RSA) {
330 if (d->kossl->EVP_PKEY_base_id(pkey) == EVP_PKEY_DSA) {
336 d->kossl->EVP_PKEY_free(pkey);
350 EVP_PKEY *pkey = d->kossl->X509_get_pubkey(d->m_cert);
352 rc =
i18nc(
"Unknown",
"Unknown key algorithm");
354 if (d->kossl->EVP_PKEY_base_id(pkey) == EVP_PKEY_RSA) {
356 d->kossl->RSA_get0_key(d->kossl->EVP_PKEY_get0_RSA(pkey), &n, &e, NULL);
357 x = d->kossl->BN_bn2hex(n);
358 rc =
i18n(
"Key type: RSA (%1 bit)", strlen(x)*4) +
'\n';
360 rc +=
i18n(
"Modulus: ");
361 for (
unsigned int i = 0; i < strlen(x); i++) {
362 if (i%40 != 0 && i%2 == 0) {
365 else if (i%40 == 0) {
371 d->kossl->OPENSSL_free(x);
373 x = d->kossl->BN_bn2hex(e);
374 rc +=
i18n(
"Exponent: 0x") + QLatin1String(x) +
376 d->kossl->OPENSSL_free(x);
380 if (d->kossl->EVP_PKEY_base_id(pkey) == EVP_PKEY_DSA) {
381 DSA *dsa = d->kossl->EVP_PKEY_get0_DSA(pkey);
382 const BIGNUM *p, *q, *g;
383 d->kossl->DSA_get0_pqg(dsa, &p, &q, &g);
384 x = d->kossl->BN_bn2hex(p);
386 rc =
i18n(
"Key type: DSA (%1 bit)", strlen(x)*4) +
'\n';
388 rc +=
i18n(
"Prime: ");
389 for (
unsigned int i = 0; i < strlen(x); i++) {
390 if (i%40 != 0 && i%2 == 0) {
393 else if (i%40 == 0) {
399 d->kossl->OPENSSL_free(x);
401 x = d->kossl->BN_bn2hex(q);
402 rc +=
i18n(
"160 bit prime factor: ");
403 for (
unsigned int i = 0; i < strlen(x); i++) {
404 if (i%40 != 0 && i%2 == 0) {
407 else if (i%40 == 0) {
413 d->kossl->OPENSSL_free(x);
415 x = d->kossl->BN_bn2hex(g);
416 rc += QString(
"g: ");
417 for (
unsigned int i = 0; i < strlen(x); i++) {
418 if (i%40 != 0 && i%2 == 0) {
421 else if (i%40 == 0) {
427 d->kossl->OPENSSL_free(x);
429 const BIGNUM *pub_key;
430 d->kossl->DSA_get0_key(dsa, &pub_key, NULL);
431 x = d->kossl->BN_bn2hex(pub_key);
432 rc +=
i18n(
"Public key: ");
433 for (
unsigned int i = 0; i < strlen(x); i++) {
434 if (i%40 != 0 && i%2 == 0) {
437 else if (i%40 == 0) {
443 d->kossl->OPENSSL_free(x);
446 d->kossl->EVP_PKEY_free(pkey);
459 char *t = d->kossl->X509_NAME_oneline(d->kossl->X509_get_issuer_name(d->m_cert), 0, 0);
466 d->kossl->OPENSSL_free(t);
474 d->_chain.setChain(c);
476 d->m_stateCached =
false;
484 d->_extensions.flags = 0;
485 d->kossl->X509_check_purpose(c, -1, 0);
488 kDebug(7029) <<
"---------------- Certificate ------------------"
493 for (
int j = 0; j < d->kossl->X509_PURPOSE_get_count(); j++) {
494 X509_PURPOSE *ptmp = d->kossl->X509_PURPOSE_get0(j);
495 int id = d->kossl->X509_PURPOSE_get_id(ptmp);
496 for (
int ca = 0; ca < 2; ca++) {
497 int idret = d->kossl->X509_check_purpose(c,
id, ca);
498 if (idret == 1 || idret == 2) {
501 d->_extensions.flags |= (1L <<(
id-1));
503 else d->_extensions.flags |= (1L <<(16+
id-1));
506 d->_extensions.flags &= ~(1L <<(
id-1));
508 else d->_extensions.flags &= ~(1L <<(16+
id-1));
514 kDebug(7029) <<
"flags: " << QString::number(c->ex_flags, 2)
515 <<
"\nkeyusage: " << QString::number(c->ex_kusage, 2)
516 <<
"\nxkeyusage: " << QString::number(c->ex_xkusage, 2)
517 <<
"\nnscert: " << QString::number(c->ex_nscert, 2)
519 if (c->ex_flags & EXFLAG_KUSAGE)
520 kDebug(7029) <<
" --- Key Usage extensions found";
521 else kDebug(7029) <<
" --- Key Usage extensions NOT found";
523 if (c->ex_flags & EXFLAG_XKUSAGE)
524 kDebug(7029) <<
" --- Extended key usage extensions found";
525 else kDebug(7029) <<
" --- Extended key usage extensions NOT found";
527 if (c->ex_flags & EXFLAG_NSCERT)
528 kDebug(7029) <<
" --- NS extensions found";
529 else kDebug(7029) <<
" --- NS extensions NOT found";
531 if (d->_extensions.certTypeSSLCA())
532 kDebug(7029) <<
"NOTE: this is an SSL CA file.";
533 else kDebug(7029) <<
"NOTE: this is NOT an SSL CA file.";
535 if (d->_extensions.certTypeEmailCA())
536 kDebug(7029) <<
"NOTE: this is an EMAIL CA file.";
537 else kDebug(7029) <<
"NOTE: this is NOT an EMAIL CA file.";
539 if (d->_extensions.certTypeCodeCA())
540 kDebug(7029) <<
"NOTE: this is a CODE CA file.";
541 else kDebug(7029) <<
"NOTE: this is NOT a CODE CA file.";
543 if (d->_extensions.certTypeSSLClient())
544 kDebug(7029) <<
"NOTE: this is an SSL client.";
545 else kDebug(7029) <<
"NOTE: this is NOT an SSL client.";
547 if (d->_extensions.certTypeSSLServer())
548 kDebug(7029) <<
"NOTE: this is an SSL server.";
549 else kDebug(7029) <<
"NOTE: this is NOT an SSL server.";
551 if (d->_extensions.certTypeNSSSLServer())
552 kDebug(7029) <<
"NOTE: this is a NETSCAPE SSL server.";
553 else kDebug(7029) <<
"NOTE: this is NOT a NETSCAPE SSL server.";
555 if (d->_extensions.certTypeSMIME())
556 kDebug(7029) <<
"NOTE: this is an SMIME certificate.";
557 else kDebug(7029) <<
"NOTE: this is NOT an SMIME certificate.";
559 if (d->_extensions.certTypeSMIMEEncrypt())
560 kDebug(7029) <<
"NOTE: this is an SMIME encrypt cert.";
561 else kDebug(7029) <<
"NOTE: this is NOT an SMIME encrypt cert.";
563 if (d->_extensions.certTypeSMIMESign())
564 kDebug(7029) <<
"NOTE: this is an SMIME sign cert.";
565 else kDebug(7029) <<
"NOTE: this is NOT an SMIME sign cert.";
567 if (d->_extensions.certTypeCRLSign())
568 kDebug(7029) <<
"NOTE: this is a CRL signer.";
569 else kDebug(7029) <<
"NOTE: this is NOT a CRL signer.";
571 kDebug(7029) <<
"-----------------------------------------------"
576 d->m_stateCached =
false;
590#include "ksslcallback.c"
607 rc = X509_PURPOSE_SSL_SERVER;
609 rc = X509_PURPOSE_SSL_CLIENT;
611 rc = X509_PURPOSE_SMIME_ENCRYPT;
613 rc = X509_PURPOSE_SMIME_SIGN;
615 rc = X509_PURPOSE_ANY;
630 if (result.isEmpty()) {
634 return result.first();
650 if (ca || (d->_lastPurpose != purpose)) {
651 d->m_stateCached =
false;
654 if (!d->m_stateCached) {
655 d->_lastPurpose = purpose;
659 X509_STORE *certStore;
660 X509_LOOKUP *certLookup;
661 X509_STORE_CTX *certStoreCTX;
669 if (d->m_stateCached) {
670 errors << d->m_stateCache;
683 for (QStringList::ConstIterator j = qsl.begin(); j != qsl.end(); ++j) {
685 QString _j = (*j) +
"ca-bundle.crt";
686 if (-1 == KDE_stat(_j.toLatin1().constData(), &sb)) {
690 certStore = d->kossl->X509_STORE_new();
696 d->kossl->X509_STORE_set_verify_cb(certStore, X509Callback);
698 certLookup = d->kossl->X509_STORE_add_lookup(certStore, d->kossl->X509_LOOKUP_file());
701 d->kossl->X509_STORE_free(certStore);
705 if (!d->kossl->X509_LOOKUP_load_file(certLookup, _j.toLatin1().constData(), X509_FILETYPE_PEM)) {
707 kDebug(7029) <<
"KSSL couldn't read CA root: "
710 d->kossl->X509_STORE_free(certStore);
715 certStoreCTX = d->kossl->X509_STORE_CTX_new();
720 kDebug(7029) <<
"KSSL couldn't create an X509 store context.";
721 d->kossl->X509_STORE_free(certStore);
725 d->kossl->X509_STORE_CTX_init(certStoreCTX, certStore, d->m_cert, NULL);
726 if (d->_chain.isValid()) {
727 d->kossl->X509_STORE_CTX_set_chain(certStoreCTX, (
STACK_OF(X509)*)d->_chain.rawChain());
733 d->kossl->X509_STORE_CTX_set_purpose(certStoreCTX, purposeToOpenSSL(purpose));
735 KSSL_X509CallBack_ca = ca ? ca->d->m_cert : 0;
736 KSSL_X509CallBack_ca_found =
false;
738 d->kossl->X509_STORE_CTX_set_error(certStoreCTX, X509_V_OK);
739 rc = d->kossl->X509_verify_cert(certStoreCTX);
740 int errcode = d->kossl->X509_STORE_CTX_get_error(certStoreCTX);
741 if (ca && !KSSL_X509CallBack_ca_found) {
750 d->kossl->X509_STORE_CTX_set_purpose(certStoreCTX,
751 X509_PURPOSE_NS_SSL_SERVER);
753 d->kossl->X509_STORE_CTX_set_error(certStoreCTX, X509_V_OK);
754 rc = d->kossl->X509_verify_cert(certStoreCTX);
755 errcode = d->kossl->X509_STORE_CTX_get_error(certStoreCTX);
758 d->kossl->X509_STORE_CTX_free(certStoreCTX);
759 d->kossl->X509_STORE_free(certStore);
771 d->m_stateCached =
true;
772 d->m_stateCache = ksslv;
794 d->m_stateCached =
false;
815 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
820 case X509_V_ERR_UNABLE_TO_GET_CRL:
825 case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
830 case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
835 case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
840 case X509_V_ERR_CERT_SIGNATURE_FAILURE:
845 case X509_V_ERR_CRL_SIGNATURE_FAILURE:
850 case X509_V_ERR_CERT_NOT_YET_VALID:
855 case X509_V_ERR_CERT_HAS_EXPIRED:
857 kDebug(7029) <<
"KSSL apparently this is expired. Not after: "
862 case X509_V_ERR_CRL_NOT_YET_VALID:
867 case X509_V_ERR_CRL_HAS_EXPIRED:
872 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
877 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
882 case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
887 case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
892 case X509_V_ERR_OUT_OF_MEM:
897 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
902 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
907 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
912 case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
917 case X509_V_ERR_CERT_CHAIN_TOO_LONG:
922 case X509_V_ERR_CERT_REVOKED:
927 case X509_V_ERR_INVALID_CA:
932 case X509_V_ERR_PATH_LENGTH_EXCEEDED:
937 case X509_V_ERR_INVALID_PURPOSE:
942 case X509_V_ERR_CERT_UNTRUSTED:
947 case X509_V_ERR_CERT_REJECTED:
952 case X509_V_ERR_SUBJECT_ISSUER_MISMATCH:
957 case X509_V_ERR_AKID_SKID_MISMATCH:
962 case X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH:
967 case X509_V_ERR_KEYUSAGE_NO_CERTSIGN:
973 case X509_V_ERR_APPLICATION_VERIFICATION:
983 d->m_stateCache = rc;
984 d->m_stateCached =
true;
992 return ASN1_UTCTIME_QString(d->kossl->X509_getm_notBefore(d->m_cert));
1001 return ASN1_UTCTIME_QString(d->kossl->X509_getm_notAfter(d->m_cert));
1010 return ASN1_UTCTIME_QDateTime(d->kossl->X509_getm_notBefore(d->m_cert), NULL);
1012 return QDateTime::currentDateTime();
1019 return ASN1_UTCTIME_QDateTime(d->kossl->X509_getm_notAfter(d->m_cert), NULL);
1021 return QDateTime::currentDateTime();
1027#ifndef KSSL_HAVE_SSL
1054 return toDer().toBase64();
1062 return i18n(
"The certificate is valid.");
1064 return i18n(
"Retrieval of the issuer certificate failed. This means the CA's (Certificate Authority) certificate can not be found.");
1066 return i18n(
"Retrieval of the CRL (Certificate Revocation List) failed. This means the CA's (Certificate Authority) CRL can not be found.");
1068 return i18n(
"The decryption of the certificate's signature failed. This means it could not even be calculated as opposed to just not matching the expected result.");
1070 return i18n(
"The decryption of the CRL's (Certificate Revocation List) signature failed. This means it could not even be calculated as opposed to just not matching the expected result.");
1072 return i18n(
"The decoding of the public key of the issuer failed. This means that the CA's (Certificate Authority) certificate can not be used to verify the certificate you wanted to use.");
1074 return i18n(
"The certificate's signature is invalid. This means that the certificate can not be verified.");
1076 return i18n(
"The CRL's (Certificate Revocation List) signature is invalid. This means that the CRL can not be verified.");
1078 return i18n(
"The certificate is not valid, yet.");
1080 return i18n(
"The certificate is not valid, any more.");
1082 return i18n(
"The CRL (Certificate Revocation List) is not valid, yet.");
1084 return i18n(
"The CRL (Certificate Revocation List) is not valid, yet.");
1086 return i18n(
"The time format of the certificate's 'notBefore' field is invalid.");
1088 return i18n(
"The time format of the certificate's 'notAfter' field is invalid.");
1090 return i18n(
"The time format of the CRL's (Certificate Revocation List) 'lastUpdate' field is invalid.");
1092 return i18n(
"The time format of the CRL's (Certificate Revocation List) 'nextUpdate' field is invalid.");
1094 return i18n(
"The OpenSSL process ran out of memory.");
1096 return i18n(
"The certificate is self-signed and not in the list of trusted certificates. If you want to accept this certificate, import it into the list of trusted certificates.");
1099 return i18n(
"The certificate is self-signed. While the trust chain could be built up, the root CA's (Certificate Authority) certificate can not be found.");
1101 return i18n(
"The CA's (Certificate Authority) certificate can not be found. Most likely, your trust chain is broken.");
1103 return i18n(
"The certificate can not be verified as it is the only certificate in the trust chain and not self-signed. If you self-sign the certificate, make sure to import it into the list of trusted certificates.");
1105 return i18n(
"The certificate chain is longer than the maximum depth specified.");
1108 return i18n(
"The certificate has been revoked.");
1110 return i18n(
"The certificate's CA (Certificate Authority) is invalid.");
1112 return i18n(
"The length of the trust chain exceeded one of the CA's (Certificate Authority) 'pathlength' parameters, making all subsequent signatures invalid.");
1114 return i18n(
"The certificate has not been signed for the purpose you tried to use it for. This means the CA (Certificate Authority) does not allow this usage.");
1117 return i18n(
"The root CA (Certificate Authority) is not trusted for the purpose you tried to use this certificate for.");
1120 return i18n(
"The root CA (Certificate Authority) has been marked to be rejected for the purpose you tried to use it for.");
1122 return i18n(
"The certificate's CA (Certificate Authority) does not match the CA name of the certificate.");
1124 return i18n(
"The CA (Certificate Authority) certificate's key ID does not match the key ID in the 'Issuer' section of the certificate you are trying to use.");
1126 return i18n(
"The CA (Certificate Authority) certificate's key ID and name do not match the key ID and name in the 'Issuer' section of the certificate you are trying to use.");
1128 return i18n(
"The certificate's CA (Certificate Authority) is not allowed to sign certificates.");
1130 return i18n(
"OpenSSL could not be verified.");
1135 return i18n(
"The signature test for this certificate failed. This could mean that the signature of this certificate or any in its trust path are invalid, could not be decoded or that the CRL (Certificate Revocation List) could not be verified. If you see this message, please let the author of the software you are using know that he or she should use the new, more specific error messages.");
1137 return i18n(
"This certificate, any in its trust path or its CA's (Certificate Authority) CRL (Certificate Revocation List) is not valid. Any of them could not be valid yet or not valid any more. If you see this message, please let the author of the software you are using know that he or she should use the new, more specific error messages.");
1143 return i18n(
"Certificate signing authority root files could not be found so the certificate is not verified.");
1145 return i18n(
"SSL support was not found.");
1147 return i18n(
"Private key test failed.");
1149 return i18n(
"The certificate has not been issued for this host.");
1151 return i18n(
"This certificate is not relevant.");
1156 return i18n(
"The certificate is invalid.");
1163 int certlen = d->kossl->i2d_X509(
getCert(), NULL);
1167 char *cert =
new char[certlen];
1168 unsigned char *p = (
unsigned char *)cert;
1170 d->kossl->i2d_X509(
getCert(), &p);
1173 qba = QByteArray(cert, certlen);
1185const char *
header =
"-----BEGIN CERTIFICATE-----\n";
1186const char *footer =
"-----END CERTIFICATE-----\n";
1190 unsigned int xx = thecert.length() - 1;
1191 for (
unsigned int i = 0; i < xx/64; i++) {
1192 thecert.insert(64*(i+1)+i,
'\n');
1197 if (thecert[thecert.length()-1] !=
'\n') {
1201 thecert.append(footer);
1203 qba = thecert.toLocal8Bit();
1208#define NETSCAPE_CERT_HDR "certificate"
1211#if OPENSSL_VERSION_NUMBER < 0x00909000L
1213typedef struct NETSCAPE_X509_st
1215 ASN1_OCTET_STRING *
header;
1225#if KSSL_HAVE_SSL && OPENSSL_VERSION_NUMBER < 0x10100000L
1227 ASN1_OCTET_STRING hdr;
1230 FILE *ktf_fs = fopen(ktf.fileName().toLatin1(),
"r+");
1237 d->kossl->ASN1_item_i2d_fp(ktf_fs,(
unsigned char *)&nx);
1240 QFile qf(ktf.fileName());
1241 if (qf.open(QIODevice::ReadOnly)) {
1255 FILE *ktf_fs = fopen(ktf.fileName().toLatin1(),
"r+");
1257 d->kossl->X509_print(ktf_fs,
getCert());
1260 QFile qf(ktf.fileName());
1261 if (!qf.open(QIODevice::ReadOnly) )
1263 char *buf =
new char[qf.size()+1];
1264 qf.read(buf, qf.size());
1275 QByteArray qba, qbb = cert.toLocal8Bit();
1276 qba = QByteArray::fromBase64(qbb);
1277 unsigned char *qbap =
reinterpret_cast<unsigned char *
>(qba.data());
1278 X509 *x5c = KOSSL::self()->d2i_X509(NULL, &qbap, qba.size());
1289 return d->_extensions;
1294 return d->_extensions.certTypeCA();
1302 names = (
STACK_OF(GENERAL_NAME)*)d->kossl->X509_get_ext_d2i(d->m_cert, NID_subject_alt_name, 0, 0);
1308 int cnt = d->kossl->OPENSSL_sk_num((STACK *)names);
1310 for (
int i = 0; i < cnt; i++) {
1311 const GENERAL_NAME *val = (
const GENERAL_NAME *)d->kossl->OPENSSL_sk_value(names, i);
1312 if (val->type != GEN_DNS) {
1316 QString s = (
const char *)d->kossl->ASN1_STRING_data(val->d.ia5);
1319 s.length() == d->kossl->ASN1_STRING_length(val->d.ia5)) {
1323 d->kossl->OPENSSL_sk_free(names);
1338 s << const_cast<KSSLCertificate&>(r).toString() << qsl;
1350 if (r.
setCert(cert) && !qsl.isEmpty()) {
KDE Certificate Chain Representation Class.
void setCertChain(const QStringList &chain)
Set the certificate chain as a list of base64 encoded X.509 certificates.
void * rawChain()
Read the raw chain in OpenSSL format.
KSSLX509V3 & x509V3Extensions()
Access the X.509v3 parameters.
KSSLValidation
Result of the validate() call.
@ KeyMayNotSignCertificate
@ CertificateFieldNotAfterErroneous
@ CRLFieldLastUpdateErroneous
@ CRLFieldNextUpdateErroneous
@ CertificateChainTooLong
@ CertificateFieldNotBeforeErroneous
@ DecryptCertificateSignatureFailed
@ GetIssuerCertLocallyFailed
@ DecodeIssuerPublicKeyFailed
@ CertificateSignatureFailed
@ AuthAndSubjectKeyIDMismatched
@ IssuerSubjectMismatched
@ DecryptCRLSignatureFailed
@ AuthAndSubjectKeyIDAndNameMismatched
@ VerifyLeafSignatureFailed
@ ApplicationVerificationFailed
QString getSignatureText() const
Get the signature.
KSSLValidation revalidate()
Check if this is a valid certificate.
QString getIssuer() const
Get the issuer of the certificate (X.509 map).
bool isValid()
Check if this is a valid certificate.
QString getKeyType() const
Get the key type (RSA, DSA, etc).
QString getNotBefore() const
Get the date that the certificate becomes valid on.
QString getSerialNumber() const
Get the serial number of the certificate.
KSSLValidation processError(int ec)
static QString verifyText(KSSLValidation x)
Obtain the localized message that corresponds to a validation result.
KSSLValidationList validateVerbose(KSSLPurpose p)
Check if this is a valid certificate.
QString getSubject() const
Get the subject of the certificate (X.509 map).
QByteArray toDer()
Convert the certificate to DER (ASN.1) format.
QDateTime getQDTNotAfter() const
Get the date that the certificate is valid until.
QByteArray toNetscape()
Convert the certificate to Netscape format.
QString getPublicKeyText() const
Get the public key.
KSSLValidation validate()
Check if this is a valid certificate.
void getEmails(QStringList &to) const
FIXME: document.
QStringList subjAltNames() const
The alternate subject name.
QString toString()
Convert this certificate to a string.
static KSSLCertificate * fromX509(X509 *x5)
Create an X.509 certificate from the internal representation.
~KSSLCertificate()
Destroy this X.509 certificate.
QString getNotAfter() const
Get the date that the certificate is valid until.
static KSSLCertificate * fromString(const QByteArray &cert)
Create an X.509 certificate from a base64 encoded string.
static QString getMD5DigestFromKDEKey(const QString &k)
Aegypten semantics force us to search by MD5Digest only.
QDateTime getQDTNotBefore() const
Get the date that the certificate becomes valid on.
QByteArray toPem()
Convert the certificate to PEM (base64) format.
QString getMD5DigestText() const
Get the MD5 digest of the certificate.
QString getMD5Digest() const
Get the MD5 digest of the certificate.
KSSLCertChain & chain()
Get a reference to the certificate chain.
KSSLCertificate * replicate()
Explicitly make a copy of this certificate.
bool isSigner()
Check if this is a signer certificate.
QString getKDEKey() const
KDEKey is a concatenation "Subject (MD5)", mostly needed for SMIME.
QString toText()
Convert the certificate to OpenSSL plain text format.
bool setCert(const QString &cert)
Re-set the certificate from a base64 string.
bool addResourceType(const char *type, const char *basetype, const char *relativename, bool priority=true)
QStringList resourceDirs(const char *type) const
QString i18n(const char *text)
QString i18nc(const char *ctxt, const char *text)
QDataStream & operator>>(QDataStream &s, KSSLCertificate &r)
#define NETSCAPE_CERT_HDR
QDataStream & operator<<(QDataStream &s, const KSSLCertificate &r)
int operator==(KSSLCertificate &x, KSSLCertificate &y)