KDE Certification Authority Tool » kCA certificate helper library

Definitely required is the following API:

namespace Kca {
namespace OpenSSL {

enum Digest;
enum RevocationReason;

struct X509Extension {
  bool replace;
  bool critical;
  QString name;
  QString value;
};
typedef QList< X509Extension > ExtensionList;

struct CRLEntry {
  quint64 serial;
  RevocationReason reason;
  QDateTime revoked;
};
typedef QList< CRLEntry > CRL;

quint64 random();
const QSslKey generateKeyPair(const int length=2048);
const ExtensionList emailCertExtensions();

const QString requestSubject(const QByteArray& request);
const ExtensionList requestExtensions(const QByteArray& request);

class Certificate : public QSslCertificate
{
  public:
    struct SignatureDetails {
      quint64 serial;
      Digest digest;
      QDateTime effectiveDate;
      QDateTime expiryDate;
    };

    const QSslCertificate sign(const QByteArray& request, const QSslKey& signingKey,
                               const SignatureDetails& details,
                               const ExtensionList& extensions) const;
    const QByteArray sign(const CRL& crl, const QSslKey& signingkey,
                          const SignatureDetails& details,
                          const ExtensionList& extensions) const;
}; // End class Certificate

}; // End namespace OpenSSL
}; // End namespace Kca

Added methods to extract information from certificate signing requests, see #34-1 (comment 1).

It might be a good idea - based on what can wrong during signing operations to create an exception which carries detailed information back to the caller about what went wrong.

Something like this:

namespace Kca {
namespace OpenSSL {
class SignatureException : public exception {
public:
  enum Operation {
    signCsr,
    signCrl,
  };
  enum Failure {
    KeyMismatch,
    Timeconstraint,
    ObjectError,
  };

  Operation operation();
  Failure failure();
  char* description();
};

};
};

Applied in changeset libkca_ossl|78c84fee87923588145b88d82092f3201842c7e2.