qgis/QGIS — pull request #1588 by dakcarto (2014-09-22 23:10:27+00:00)
Title: [FEATURE] SSL PKI integration for OWS connections

Sponsored by [Boundless Spatial, US](http://boundlessgeo.com/)

Adds the following SSL PKI support
------------------------------------------------
- Reusable SSL PKI setup widget (`QgsSslCertificateWidget`, here inside WMS connection setup dialog):

![ssl-cert_widget_cert-missing-sm](https://cloud.githubusercontent.com/assets/1295919/4365066/227b10cc-42a8-11e4-92ed-e00646ef73d4.png)
It does lightweight validation (dates, etc., see [QSslCertificate.isValid()](http://qt-project.org/doc/qt-4.8/qsslcertificate.html#isValid) )

- SSL certificate settings (QgsSslCertSettings) and utilities (QgsSslUtils) classes

- Configures a local QGIS Store `~/.qgis2/cert_store`

```sh
$ ls -l ~/.qgis2/cert_store
drwx------ certs <-- client certificates, e.g. name.pem
drwx------ issuers <-- certificate issuers (not in OpenSSL store, allows for self-signed bypass)
drwx------ private <-- client certificate private keys
```
- Add `QgsCredentials` key passphrase support, with stacked widget to rotate between inputs (username/password or key passphrase).

- Add SSL Certificate widget to new OWS connections (tabbed widget with Authentication).

- Cache key passphrases in `QgsNetworkManager` singleton, since it did not work with `QgsCredentials`.

**The Good Stuff**

* Support for private keys with passphrase-protection.

* Memory-caching of key passphrase, so it only needs input once per session.

* Key passphrase NOT stored in project file.

* Key passphrase can be input by user via GUI, or via console, when projects/layers are loaded, and across provider/GUI threads (via `QgsCredentials`).

* Support for auto-ignoring self-signed certificate issuer's certificate (per cert or cert chain, but not globally).

* Full Python bindings, where appropriate (e.g. no access to in-memory key passphrase).

* All additions have finally been encapsulated enough to allow for easier addition of different certificate store setups later

**Caveats**

* **Only works for the WMS provider at this time.** Need some feedback on whether this approach is sound, before adding PKI for other OWS connections ... should be fairly easy to do this week. ( @jef-n , @mhugent ?)

*NOTE:* the other OWS services do show the certificate GUI, but are not yet functional.

* Base security is not so great. Since the QGIS local store is a know location, any plugin running with user-rights can find private keys, so those should always be passphrase-protected. (Important to note in the users guide).

**Future Improvements**

* Adding additional certificate stores, e.g. the native platform stores (like Apple's keychain), can be done using the robust [Qt Cryptographic Architecture (QCA)](http://delta.affinix.com/qca/). The cross-platform library does have a couple of issues, though:

* No stable release that works with post-HeartBleed OpenSSL releases. Current development versions work well, though.

* QCA adds a significant dependency to QGIS. The build should probably be optional, e.g. a '-D WITH-QCA'. May, or may not, be difficult for QCA to become a core requirement, due to the older systems that QGIS continues to support.

* Better certificate validation, including info dialogs to inspect the cert chain of trust.

* Better SSL hanshake error reporting.

* Add some cert conversion functions to allow users to import certs of other varieties, not just PEM-based. (Still stored locally as PEM)

**Testing**

You will need an HTTPS web mapping service with user authentication via PKI turned on. [See this page for some info](https://github.com/dakcarto/QGIS-PKI-Test) on an `OpenGeo Suite` setup with `GeoServer`.