Export Selected Certificates

jgrateron commented 7 months ago

I can do this action to export the selected certificates in PEM format and save it to a file, there may also be the option to order from issuer to issuer or not order, I use this a lot to create the full chain.

jgrateron commented 7 months ago

Preview

Is this message ok? "Sort certificates in issued to issuer order?"

The name of the file to export is the same as the name of keystore

Examining generated file

The-Lum commented 7 months ago

Hi @jgrateron and all,

Here is a minor remark:

I'm just having a little trouble with the ? char. on the tooltip...

To debate...

Another question:

You select 3 cert.
And then 4 cert are in the output file?
Why? Depending of the order?

Regards, Th.

jgrateron commented 7 months ago

Hi @jgrateron and all,

Here is a minor remark:

I'm just having a little trouble with ? char. the on the tooltip...

In the tooltip I want to express the intention if the user wants me to sort the certificates according to their hierarchy.

To debate...

Another question:

You select 3 cert.

And then 4 cert are in the output file?

Regards, Th.

The screens are of different tests, but if you select 4, they are 4 PEMs.

kaikramer commented 7 months ago

I like it, just some questions:

Why not always sort them? Either you care about the order, then they should probably be sorted or you don't care about the order then it does not matter that they are always sorted.
Is the order from issued to issuer what for example the Apache webserver wants?
In the example there are only "trusted cert entries" selected for export. What happens when I select a key pair entry (where a single entry might include a whole CA chain)?

jgrateron commented 7 months ago

I like it, just some questions:

Why not always sort them? Either you care about the order, then they should probably be sorted or you don't care about the order then it does not matter that they are always sorted.

At first I was using the X509CertUtil.orderX509CertChain function to create the inheritance structure, but if the certificates were not related then I would only get those that do meet the condition, so I made a new function X509CertUtil.orderX509CertsChain that orders and adds to the end those that are not related to any, so as you mention it is no longer necessary to sort that option since it always returns all certificates.

Is the order from issued to issuer what for example the Apache webserver wants?

Yes, for example SSLCertificateChainFile apache, server.crt postgresql, ssl_trusted_certificate oscp stapling nginx. Intermediate Certificates and Root CA Certificate.

In the example there are only "trusted cert entries" selected for export. What happens when I select a key pair entry (where a single entry might include a whole CA chain)?

I wasn't taking that into consideration, I'll make the adjustments.

Thank you very much for your comments

The-Lum commented 7 months ago

[Just for traceability,] here is the corresponding PR:

490

(Thank @jgrateron)

kaikramer / keystore-explorer

Export Selected Certificates #489

490