pfSense

Update the Copyright year of the files owned by Rubicon/Netgate.

Revert "Certmanager mvc"

This reverts commit 033c3ae82d20ca5760ed483cf8d0c947764b2371

Certmanager mvc

Revert "Clean up some messy HTML in the cert/ca display code. Prep for future MVC changes."

This reverts commit 8d4fcd7ac1167894136e337fc619e63fa7200fa0.

Clean up some messy HTML in the cert/ca display code. Prep for future MVC changes.

Small fixes for expiredays comparing

Add setting for ignore revoked certificates. Fix Bug #12109

Merge branch 'pfsense:master' into master

Merge branch 'pfsense:master' into master

certs.inc closing parenthesis fix. Issue #11831

Certificate Revocation page improvements. Issue #11831

Exclude revoked certs from expiration notification. Fix Bug #12109

Do not show CA as In Use if LDAP Server transport is not TLS/SSL. Fixes #11922

Certmanager UTF8 DN support. Fixes #12041

Do not read cert key details if parsing key failed. Fixes #11859

Show Unbound used certificate on the Certificate Manager page. Fixes #11678

Fix cert type handling during renewal. Fixes #11706

Fix handling of renewing cert w/o SAN. Fixes #11652

Improve CA/Self-Signed serial handling. Fixes #11514

Try parsing four digit years in cert timestamps. Fixes #11504

Improve handling of broken/invalid certs. Fixes #11489

Update the Copyright year.

A subsequent commit will deal with .po's.

Allow import of PKCS12 (pfx) certificates. Issue #8645

Renew cert with IP Address SAN. Issue #10362

Require service-utils.inc before using a function from it. Fixes #10360

Server cert lifetime reduced to 398. Fixes #9825

New requirements coming this fall will require new certs to be valid for at most
398 days. Setup this new requirement now, rather than waiting.

While here, reduce usage of hardcoded value where possible.

This is 2020. Issue #9245

Merge pull request #4132 from vktg/hidenoprvcerts

parenthesis fix

fix

Merge pull request #4122 from vktg/ecdsarenew

do not show certs without prv by default

curve_compatible_list - array of all compat curves

typo

prime256v1 ec curve for renew

When refreshing CRLs, increment suffix, do not clean up. Fixes #9915

While here, fix a bug with refresh path.

Correctly populate CRL issuer in crl_contains_cert. Fixes #9924

Add 'none' option to cert_build_list. Issue #9923

Restructure OpenVPN settings directory layout

• Changed from /var/etc/openvpn[-csc]/<mode><id>.<file> to
  /var/etc/openvpn/<mode><id>/<x>
• This keeps all settings for each client and server in a clean
  structure
• Move to CApath style CA structure for OpenVPN, which implements #9915...

Add select_source compatible output to cert_build_list(). Implements #9923

Update OpenVPN EC list based on testing. Issue #9744

OpenVPN ECDH/ECDSA filtering. Fixes #9744

Can be revisited in the future if the corresponding OpenVPN bug is
resolved.

Move CA random serial option to upper section. Issue #9883

This allows it to be set when creating a new CA, so it doesn't have to
be edited in later.

Also show the next serial/random status in the CA info block
Hide trust store line from non-CA entries since it's not relevant to...

Rename IPsec "RSA" options to "Certificate". Implements #9903

Attempt to fetch EC curve OID if name is blank. Issue #9745

Certificate date calculation changes. Fixes #9899

Make the certificate date calculation more general and also try multiple ways
to determine the date (both timestamp and unix timestamp).

Catch cases where one or the other date fails to calculate to avoid errors....

GUI improvements for ECDSA certificate handling

• Make central functions to check and test ECDSA compatibility. Issue #9843
• Filter incompatible certificates from being offered for the GUI or Captive Portal. Implements #9897
• Do the same for IPsec, which implements #4991...

Change default ECSDA curve to prime256v1. Issue #9843

Previous default was brainpool, but brainpool curves are not (widely?)
supported by browsers and were deprecated by IETF for TLS v1.3

Use more accurate date calculations for CA/Cert operations.

Otherwise calculations could fail on ARM

Validate CA/CRL serial input. Issue #9883 Issue #9869

Enforce a max lifetime for CA/Cert/CRL. Issue #3956

Add support for randomized cert serial numbers. Implements #9883

CRL management overhaul

• Allow revoking by serial number or cert. Implements #9869
• Allow revoking multiple entries at a time. Implements #3258
• Declutter the main CRL list screen
• Move the create control to the bottom under the list
• Various other efficiency/style improvements

Add option to trust local CA entries. Implements #4068

Similar to closed PR #3558 from overhacked, but with a number of
changes.

Make value of cert notify setting consistent with others. Issue #7332

Certificate strength improvements. Fixes #9825

• Change default GUI cert lifetime to 825 days
• Add notes on CA/Cert pages about using potentially insecure parameter
  chocies
• Add visible warnings on CA/Cert pages if paramers are insecure/not
  recommended.

Add daily certificate expiration notice. Issue #7332

Add missing newline after Must Staple cert info.

Add settings to control certificate expiration notifications. Issue #7332

Note that the notices themselves do not yet exist. Those are still a
work in progress.

Add certificate lifetime to infoblock. Issue #7332

• Adds the total lifetime and lifetime remaining before expiration to
  the info block
• Adds a visual indication to the infoblock and end date when the
  certificate will be expiring soon, or if it has already expired.

Show detailed infoblock on CA and Cert pages. Implements #9856

• Moved info block to common function
• Used that function on CA and Cert pages
• Added more information to the info block

Add GUI code and more backend for CA/Cert Renewal. Issue #9842

Merge pull request #4104 from vktg/geneckey

Add ca/certificate renew function backend (no GUI code yet). Issue #9842

spaces to tabs

fixes

initial version

Fix copyright message years to reflect BSDP -> ESF -> Netgate

Correct OSCP Must-Staple cert check for OpenSSL 1.1.1. Fixes #9408

Update copyright notices to 2019. Happy New Year

If the cert date is negative, use DateTime instead of date. Fixes #9100

Prevent CRL from using too large a lifetime on ARM. Fixes #9098

Change CRL generation to a pure PHP implementation which works with PHP 7.2 (and 5.6)

The old OpenSSL CRL patch we had been using does not work with 7.2, and this way also
opens up some new possibilities for enhancing the CRL settings we can offer in the...

Remove constants that were defined by an OpenSSL patch that has been removed.

Fix function name typo

Add function to detect OCSP Must Staple certs. Ticket #8418 and Ticket #8299

Update the Copyright notice for pfSense.

Change how SANs are generated from the CN, considering that not all CNs will produce a valid SAN. Fixes #8252

When retrieving a public key for a certificate, private key, or signing request, write the certificate data out to a temp file instead of echoing it through a pipe. Fixes #8153

Revert "Mitigate possible vuln in cert manager"

This reverts commit 1a68f4badd58de8694ac6a4208e11d7265c97df3.

Mitigate possible vuln in cert manager

Fix handling of wildcard CN/SAN entries in certificates. Fixes #7994

Add a field to pick a digest algo when signing a CSR, otherwise it ends up with SHA1. Fixes #7853
While here, add the cert serial number and sig digest type to the info block for each cert.

Fix CA reference so serial increases properly. Remove variable for feature that didn't work out. Ticket #7527

Restructure how certificate types and SANs are handled in the cert manager when making a Cert/CSR/Signing, so each section can properly use the controls without duplicating. It is now possible to add SANs and EKUs to certificates when signing using the certificate manager. Fixes #7527 and also Fixes #7677...

Add the ability to set certificate type and SAN attributes in a CSR. Ticket #7527
TODO: They are not carried over after signing in the GUI

Fix some additional cases for CN->SAN handling, and move some code to a function to avoid duplication for other pending uses. Ticket #7666

Allow a wider range of characters to be used in certificate fields, as laid out by RFC 4514. Fixes #7540

Show SAN, KU, and EKU info in the certificate list. Implements #7505
While here, also fix "server" cert detection to key off of the EKU For "TLS Web Server Authentication" since nsCertType has been deprecated.

Merge pull request #3699 from PiBa-NL/20170417-certificatemanager-ca-crl-inuse

certificate manager, allow importing of ECC certificates, change multiple 'if' to 'switch'

certificate manager, show 'in use' also for CA and CRL where certificates are in use by packages.

certificate manager, allow importing of ECC certificates

Remove whirlpool from the list of CA/Cert digest algorithms as it does not work properly. OpenSSL claims it's not valid ("unknown signature algorithm"). Fixes #7370
While I'm here, stop needlessly repeating the algo list, it's a global in certs.inc, so use that single copy of the list.

certificatemanager, link certificate to the proper CA after completing the CSR request

Fix certificate generation for CAs without a serial set on import. Fixes #6952

Add some CA in-use test utility functions. Ticket #6947

Put original match back

Did not mean to remove SSL substring from the check...

Fix nsCertType matching for some certificates (Bug #6877)

See https://redmine.pfsense.org/issues/6877#note-4

Move copyright from ESF to Netgate