Merge "upd: improve digest explanation and make SHA512 default"

[gigi.git] / src / org / cacert / gigi / pages / account / certs / CertificateRequest.java

diff --git a/src/org/cacert/gigi/pages/account/certs/CertificateRequest.java b/src/org/cacert/gigi/pages/account/certs/CertificateRequest.java
index ad915d7da370f4b0163ed456a38bc4539a9431fb..5edf362e4877ef2c505ca5c6636e60b91b9b0b42 100644 (file)
--- a/src/org/cacert/gigi/pages/account/certs/CertificateRequest.java
+++ b/src/org/cacert/gigi/pages/account/certs/CertificateRequest.java
@@ -14,8 +14,6 @@ import java.util.LinkedHashSet;
 import java.util.Set;
 import java.util.TreeSet;
 
-import javax.servlet.http.HttpServletRequest;
-
 import org.cacert.gigi.GigiApiException;
 import org.cacert.gigi.crypto.SPKAC;
 import org.cacert.gigi.dbObjects.Certificate;
@@ -60,7 +58,7 @@ import sun.security.x509.X500Name;
 
 public class CertificateRequest {
 
-    public static final String DEFAULT_CN = "CAcert WoT User";
+    public static final String DEFAULT_CN = "SomeCA User";
 
     public static final ObjectIdentifier OID_KEY_USAGE_SSL_SERVER = ObjectIdentifier.newInternal(new int[] {
             1, 3, 6, 1, 5, 5, 7, 3, 1
@@ -227,6 +225,8 @@ public class CertificateRequest {
             selectedDigest = Digest.SHA512;
         } else if (sign.toLowerCase().startsWith("sha384")) {
             selectedDigest = Digest.SHA384;
+        } else if (sign.toLowerCase().startsWith("sha256")) {
+            selectedDigest = Digest.SHA256;
         }
     }
 
@@ -300,7 +300,7 @@ public class CertificateRequest {
         return profile;
     }
 
-    public synchronized boolean update(String nameIn, String hashAlg, String profileStr, String newOrgStr, String ou, String SANsStr, PrintWriter out, HttpServletRequest req) throws GigiApiException {
+    public synchronized boolean update(String nameIn, String hashAlg, String profileStr, String newOrgStr, String ou, String SANsStr) throws GigiApiException {
         GigiApiException error = new GigiApiException();
         this.name = nameIn;
         if (hashAlg != null) {
@@ -338,18 +338,19 @@ public class CertificateRequest {
                     try {
                         DomainAssessment.checkCertifiableDomain(san.getName(), user.isInGroup(Group.CODESIGNING), false);
                         valid = true;
+                        if ( !valid || !CAA.verifyDomainAccess(owner, p, san.getName()) || (pDNS != null && !domainTemp.isMultiple())) {
+                            // remove
+                        } else {
+                            if (pDNS == null) {
+                                pDNS = san.getName();
+                            }
+                            filteredSANs.add(san);
+                            continue;
+                        }
                     } catch (GigiApiException e) {
+                        error.mergeInto(e);
                         valid = false;
                     }
-                    if ( !valid || !CAA.verifyDomainAccess(owner, p, san.getName()) || (pDNS != null && !domainTemp.isMultiple())) {
-                        // remove
-                    } else {
-                        if (pDNS == null) {
-                            pDNS = san.getName();
-                        }
-                        filteredSANs.add(san);
-                        continue;
-                    }
                 }
             } else if (san.getType() == SANType.EMAIL) {
                 if (emailTemp != null && owner.isValidEmail(san.getName())) {
@@ -365,7 +366,7 @@ public class CertificateRequest {
                 }
             }
             error.mergeInto(new GigiApiException(SprintfCommand.createSimple(//
-                    "The requested Subject alternate name \"{0}\" has been removed.", san.getType().toString().toLowerCase() + ":" + san.getName())));
+                    "The requested subject alternate name (SAN) \"{0}\" has been removed.", san.getType().toString().toLowerCase() + ":" + san.getName())));
         }
         SANs = filteredSANs;
     }
@@ -425,7 +426,7 @@ public class CertificateRequest {
         if (ctx.getTarget() instanceof Organisation) {
             Organisation org = (Organisation) ctx.getTarget();
             subject.put("O", org.getName());
-            subject.put("C", org.getState());
+            subject.put("C", org.getCountry().getCode());
             subject.put("ST", org.getProvince());
             subject.put("L", org.getCity());
             if (ou != null) {
@@ -499,7 +500,7 @@ public class CertificateRequest {
                     if (nullIsOK) {
                         name = "";
                     } else if (realIsOK) {
-                        name = u.getName().toString();
+                        name = u.getPreferredName().toString();
                     }
                 }
             } else if (name == null || name.equals("")) {
@@ -510,7 +511,7 @@ public class CertificateRequest {
                     if (defaultIsOK) {
                         name = DEFAULT_CN;
                     } else if (realIsOK) {
-                        name = u.getName().toString();
+                        name = u.getPreferredName().toString();
                     }
                 }
             } else {
@@ -543,12 +544,12 @@ public class CertificateRequest {
                         verifiedCN = name;
                     } else {
                         if (nameTemp.isRequired()) {
-                            error.mergeInto(new GigiApiException("The name entered, does not match the details in your account. You cannot issue certificates with this name. Enter a name that matches the one that has been assured in your account, because a name is required for this certificate type."));
+                            error.mergeInto(new GigiApiException("The name entered, does not match the details in your account. You cannot issue certificates with this name. Enter a name that matches the one that has been verified in your account, because a name is required for this certificate type."));
                         } else if (name.equals(DEFAULT_CN)) {
                             verifiedCN = DEFAULT_CN;
                         } else {
                             name = DEFAULT_CN;
-                            error.mergeInto(new GigiApiException("The name entered, does not match the details in your account. You cannot issue certificates with this name. Enter a name that matches the one that has been assured in your account or keep the default name."));
+                            error.mergeInto(new GigiApiException("The name entered, does not match the details in your account. You cannot issue certificates with this name. Enter a name that matches the one that has been verified in your account or keep the default name."));
                         }
                     }
                 } else {