CUPS 2.2.0.

for system-wide trust of printer certs.

.gitignore

@@ -44,6 +44,7 @@ cups/testadmin
 cups/testarray
 cups/testcache
 cups/testconflicts
+cups/testcreds
 cups/testcups
 cups/testdest
 cups/testfile

CHANGES.txt

@@ -1,5 +1,16 @@
-CHANGES.txt - 2.2rc1 - 2016-08-08
----------------------------------
+CHANGES.txt - 2.2.0 - 2016-09-13
+--------------------------------
+
+CHANGES IN CUPS V2.2.0
+
+	- Normalized the TLS certificate validation code and added additional
+	  error messages to aid troubleshooting.
+	- http*Connect did not work on Linux when cupsd was not running
+	  (Issue #4870)
+	- The --no-remote-any option of cupsctl had no effect (Issue #4866)
+	- http*Connect did not return early when all addresses failed
+	  (Issue #4870)
+
 
 CHANGES IN CUPS V2.2rc1
 

INSTALL.txt

@@ -1,5 +1,5 @@
-INSTALL - CUPS v2.2rc1 - 2016-08-08
------------------------------------
+INSTALL - CUPS v2.2.0 - 2016-09-13
+----------------------------------
 
 This file describes how to compile and install CUPS from source code. For more
 information on CUPS see the file called "README.txt".  A complete change log can
@@ -30,7 +30,7 @@ BEFORE YOU BEGIN
     make does not support "include".
 
     Besides these tools you'll want ZLIB library for compression support, the
-    GNU TLS library for encryption support on platforms other then iOS, macOS,
+    GNU TLS library for encryption support on platforms other than iOS, macOS,
     or Windows, and either MIT (1.6.3 or higher) or Heimdal Kerberos for
     Kerberos support.  CUPS will compile and run without these, however you'll
     miss out on many of the features provided by CUPS.

README.txt

@@ -1,5 +1,5 @@
-README - CUPS v2.2rc1 - 2016-08-08
-----------------------------------
+README - CUPS v2.2.0 - 2016-09-13
+---------------------------------
 
 Looking for compile instructions?  Read the file "INSTALL.txt" instead...
 

backend/ipp.c

@@ -848,7 +848,7 @@ main(int  argc,				/* I - Number of command-line args */
       trust = httpCredentialsGetTrust(creds, hostname);
       httpCredentialsString(creds, credinfo, sizeof(credinfo));
 
-      fprintf(stderr, "DEBUG: %s\n", trust_msgs[trust]);
+      fprintf(stderr, "DEBUG: %s (%s)\n", trust_msgs[trust], cupsLastErrorString());
       fprintf(stderr, "DEBUG: Printer credentials: %s\n", credinfo);
 
       if (!httpLoadCredentials(NULL, &lcreds, hostname))

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.68 for CUPS 2.2rc1.
+# Generated by GNU Autoconf 2.68 for CUPS 2.2.0.
 #
 # Report bugs to <https://github.com/apple/cups/issues>.
 #
@@ -560,8 +560,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='CUPS'
 PACKAGE_TARNAME='cups'
-PACKAGE_VERSION='2.2rc1'
-PACKAGE_STRING='CUPS 2.2rc1'
+PACKAGE_VERSION='2.2.0'
+PACKAGE_STRING='CUPS 2.2.0'
 PACKAGE_BUGREPORT='https://github.com/apple/cups/issues'
 PACKAGE_URL='https://www.cups.org/'
 
@@ -1448,7 +1448,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures CUPS 2.2rc1 to adapt to many kinds of systems.
+\`configure' configures CUPS 2.2.0 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1509,7 +1509,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of CUPS 2.2rc1:";;
+     short | recursive ) echo "Configuration of CUPS 2.2.0:";;
    esac
   cat <<\_ACEOF
 
@@ -1689,7 +1689,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-CUPS configure 2.2rc1
+CUPS configure 2.2.0
 generated by GNU Autoconf 2.68
 
 Copyright (C) 2010 Free Software Foundation, Inc.
@@ -2153,7 +2153,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by CUPS $as_me 2.2rc1, which was
+It was created by CUPS $as_me 2.2.0, which was
 generated by GNU Autoconf 2.68.  Invocation command line was
 
   $ $0 $@
@@ -2527,7 +2527,7 @@ esac
 ac_config_headers="$ac_config_headers config.h"
 
 
-CUPS_VERSION="2.2rc1"
+CUPS_VERSION="2.2.0"
 CUPS_REVISION=""
 CUPS_BUILD="cups-$CUPS_VERSION"
 
@@ -10755,7 +10755,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by CUPS $as_me 2.2rc1, which was
+This file was extended by CUPS $as_me 2.2.0, which was
 generated by GNU Autoconf 2.68.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -10818,7 +10818,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-CUPS config.status 2.2rc1
+CUPS config.status 2.2.0
 configured by $0, generated by GNU Autoconf 2.68,
   with options \\"\$ac_cs_config\\"
 

configure.ac

@@ -15,7 +15,7 @@ dnl We need at least autoconf 2.60...
 AC_PREREQ(2.60)
 
 dnl Package name and version...
-AC_INIT([CUPS], [2.2rc1], [https://github.com/apple/cups/issues], [cups], [https://www.cups.org/])
+AC_INIT([CUPS], [2.2.0], [https://github.com/apple/cups/issues], [cups], [https://www.cups.org/])
 
 sinclude(config-scripts/cups-opsys.m4)
 sinclude(config-scripts/cups-common.m4)

cups/Dependencies

@@ -261,6 +261,11 @@ testcache.o: testcache.c ppd-private.h ../cups/cups.h file.h versioning.h \
   thread-private.h
 testconflicts.o: testconflicts.c cups.h file.h versioning.h ipp.h http.h \
   array.h language.h pwg.h ppd.h raster.h string-private.h ../config.h
+testcreds.o: testcreds.c cups-private.h string-private.h ../config.h \
+  debug-private.h ../cups/versioning.h array-private.h ../cups/array.h \
+  ipp-private.h ../cups/ipp.h http.h http-private.h ../cups/language.h \
+  md5-private.h language-private.h ../cups/transcode.h pwg-private.h \
+  ../cups/cups.h file.h pwg.h thread-private.h
 testcups.o: testcups.c string-private.h ../config.h cups.h file.h \
   versioning.h ipp.h http.h array.h language.h pwg.h ppd.h raster.h
 testdest.o: testdest.c cups.h file.h versioning.h ipp.h http.h array.h \

cups/Makefile

@@ -85,6 +85,7 @@ TESTOBJS	= \
 		testarray.o \
 		testcache.o \
 		testconflicts.o \
+		testcreds.o \
 		testcups.o \
 		testdest.o \
 		testfile.o \
@@ -153,6 +154,7 @@ UNITTARGETS =	\
 		testarray \
 		testcache \
 		testconflicts \
+		testcreds \
 		testcups \
 		testdest \
 		testfile \
@@ -417,6 +419,16 @@ testconflicts:	testconflicts.o $(LIBCUPSSTATIC)
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
 
 
+#
+# testcreds (dependency on static CUPS library is intentional)
+#
+
+testcreds:	testcreds.o $(LIBCUPSSTATIC)
+	echo Linking $@...
+	$(CC) $(ARCHFLAGS) $(LDFLAGS) -o $@ testcreds.o $(LIBCUPSSTATIC) \
+		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+
+
 #
 # testcups (dependency on static CUPS library is intentional)
 #

cups/adminutil.c

@@ -1,7 +1,7 @@
 /*
  * Administration utility API definitions for CUPS.
  *
- * Copyright 2007-2015 by Apple Inc.
+ * Copyright 2007-2016 by Apple Inc.
  * Copyright 2001-2007 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -1194,6 +1194,7 @@ cupsAdminSetServerSettings(
   int		cupsd_num_settings;	/* New number of settings */
   int		old_share_printers,	/* Share local printers */
 		old_remote_admin,	/* Remote administration allowed? */
+		old_remote_any,		/* Remote access from anywhere? */
 		old_user_cancel_any,	/* Cancel-job policy set? */
 		old_debug_logging;	/* LogLevel debug set? */
   cups_option_t	*cupsd_settings,	/* New settings */
@@ -1259,12 +1260,12 @@ cupsAdminSetServerSettings(
 
   if ((val = cupsGetOption(CUPS_SERVER_REMOTE_ANY, cupsd_num_settings,
                            cupsd_settings)) != NULL)
-    remote_any = atoi(val);
+    old_remote_any = atoi(val);
   else
-    remote_any = 0;
+    old_remote_any = 0;
 
   DEBUG_printf(("1cupsAdminSetServerSettings: old remote_any=%d",
-                remote_any));
+                old_remote_any));
 
   if ((val = cupsGetOption(CUPS_SERVER_SHARE_PRINTERS, cupsd_num_settings,
                            cupsd_settings)) != NULL)
@@ -1310,12 +1311,23 @@ cupsAdminSetServerSettings(
   DEBUG_printf(("1cupsAdminSetServerSettings: debug_logging=%d",
                 debug_logging));
 
-  if ((val = cupsGetOption(CUPS_SERVER_REMOTE_ANY, num_settings,
-                           settings)) != NULL)
+  if ((val = cupsGetOption(CUPS_SERVER_REMOTE_ANY, num_settings, settings)) != NULL)
+  {
     remote_any = atoi(val);
 
-  DEBUG_printf(("1cupsAdminSetServerSettings: remote_any=%d",
-                remote_any));
+    if (remote_any == old_remote_any)
+    {
+     /*
+      * No change to this setting...
+      */
+
+      remote_any = -1;
+    }
+  }
+  else
+    remote_any = -1;
+
+  DEBUG_printf(("1cupsAdminSetServerSettings: remote_any=%d", remote_any));
 
   if ((val = cupsGetOption(CUPS_SERVER_REMOTE_ADMIN, num_settings,
                            settings)) != NULL)
@@ -1430,7 +1442,7 @@ cupsAdminSetServerSettings(
   while (cupsFileGetConf(cupsd, line, sizeof(line), &value, &linenum))
   {
     if ((!_cups_strcasecmp(line, "Port") || !_cups_strcasecmp(line, "Listen")) &&
-        (remote_admin >= 0 || remote_any > 0 || share_printers >= 0))
+        (remote_admin >= 0 || remote_any >= 0 || share_printers >= 0))
     {
       if (!wrote_port_listen)
       {
@@ -1616,7 +1628,7 @@ cupsAdminSetServerSettings(
 	                 remote_any > 0 ? "all" : "@LOCAL");
       }
       else if (in_root_location &&
-               (remote_admin >= 0 || remote_any > 0 || share_printers >= 0))
+               (remote_admin >= 0 || remote_any >= 0 || share_printers >= 0))
       {
 	wrote_root_location = 1;
 
@@ -1719,7 +1731,7 @@ cupsAdminSetServerSettings(
       in_cancel_job = 0;
     }
     else if ((((in_admin_location || in_conf_location || in_root_location) &&
-               (remote_admin >= 0 || remote_any > 0)) ||
+               (remote_admin >= 0 || remote_any >= 0)) ||
               (in_root_location && share_printers >= 0)) &&
              (!_cups_strcasecmp(line, "Allow") || !_cups_strcasecmp(line, "Deny") ||
 	      !_cups_strcasecmp(line, "Order")))
@@ -1811,7 +1823,7 @@ cupsAdminSetServerSettings(
   }
 
   if (!wrote_port_listen &&
-      (remote_admin >= 0 || remote_any > 0 || share_printers >= 0))
+      (remote_admin >= 0 || remote_any >= 0 || share_printers >= 0))
   {
     if (remote_admin > 0 || remote_any > 0 || share_printers > 0)
     {
@@ -1832,7 +1844,7 @@ cupsAdminSetServerSettings(
   }
 
   if (!wrote_root_location &&
-      (remote_admin >= 0 || remote_any > 0 || share_printers >= 0))
+      (remote_admin >= 0 || remote_any >= 0 || share_printers >= 0))
   {
     if (remote_admin > 0 && share_printers > 0)
       cupsFilePuts(temp,
@@ -2009,9 +2021,14 @@ cupsAdminSetServerSettings(
                                 	 old_remote_admin ? "1" : "0",
 					 cupsd_num_settings, &cupsd_settings);
 
-    cupsd_num_settings = cupsAddOption(CUPS_SERVER_REMOTE_ANY,
-                                       remote_any ? "1" : "0",
-				       cupsd_num_settings, &cupsd_settings);
+    if (remote_any >= 0)
+      cupsd_num_settings = cupsAddOption(CUPS_SERVER_REMOTE_ANY,
+					 remote_any ? "1" : "0",
+					 cupsd_num_settings, &cupsd_settings);
+    else
+      cupsd_num_settings = cupsAddOption(CUPS_SERVER_REMOTE_ANY,
+					 old_remote_any ? "1" : "0",
+					 cupsd_num_settings, &cupsd_settings);
 
     if (share_printers >= 0)
       cupsd_num_settings = cupsAddOption(CUPS_SERVER_SHARE_PRINTERS,

cups/http-addrlist.c

@@ -78,7 +78,8 @@ httpAddrConnect2(
   struct pollfd		pfds[100];	/* Polled file descriptors */
 #  else
   fd_set		input_set,	/* select() input set */
-			output_set;	/* select() output set */
+			output_set,	/* select() output set */
+			error_set;	/* select() error set */
   struct timeval	timeout;	/* Timeout */
 #  endif /* HAVE_POLL */
 #endif /* O_NONBLOCK */
@@ -238,6 +239,9 @@ httpAddrConnect2(
       addrlist = addrlist->next;
     }
 
+    if (!addrlist && nfds == 0)
+      break;
+
    /*
     * See if we can connect to any of the addresses so far...
     */
@@ -282,11 +286,12 @@ httpAddrConnect2(
       for (i = 0; i < nfds; i ++)
 	FD_SET(fds[i], &input_set);
       output_set = input_set;
+      error_set  = input_set;
 
       timeout.tv_sec  = 0;
       timeout.tv_usec = (addrlist ? 100 : remaining > 250 ? 250 : remaining) * 1000;
 
-      result = select(max_fd + 1, &input_set, &output_set, NULL, &timeout);
+      result = select(max_fd + 1, &input_set, &output_set, &error_set, &timeout);
 
       DEBUG_printf(("1httpAddrConnect2: select() returned %d (%d)", result, errno));
 #  endif /* HAVE_POLL */
@@ -303,9 +308,9 @@ httpAddrConnect2(
       {
 #  ifdef HAVE_POLL
 	DEBUG_printf(("pfds[%d].revents=%x\n", i, pfds[i].revents));
-	if (pfds[i].revents)
+	if (pfds[i].revents && !(pfds[i].revents & (POLLERR | POLLHUP)))
 #  else
-	if (FD_ISSET(fds[i], &input))
+	if (FD_ISSET(fds[i], &input) && !FD_ISSET(fds[i], &error))
 #  endif /* HAVE_POLL */
 	{
 	  *sock    = fds[i];

cups/ipp-support.c

@@ -209,7 +209,7 @@ static const char * const ipp_std_ops[] =
 		  "Close-Job",
 		  "Identify-Printer",
 		  "Validate-Document",
-		  "Send-Hardcopy-Document",
+		  "Add-Document-Images",
 		  "Acknowledge-Document",
 
 		  /* 0x0040 - 0x004a */

cups/ipp.h

@@ -302,7 +302,7 @@ typedef enum ipp_op_e			/**** IPP operations ****/
   IPP_OP_CLOSE_JOB,			/* Close-Job */
   IPP_OP_IDENTIFY_PRINTER,		/* Identify-Printer */
   IPP_OP_VALIDATE_DOCUMENT,		/* Validate-Document */
-  IPP_OP_SEND_HARDCOPY_DOCUMENT,	/* Send-Hardcopy-Document */
+  IPP_OP_ADD_DOCUMENT_IMAGES,		/* Add-Document-Images */
   IPP_OP_ACKNOWLEDGE_DOCUMENT,		/* Acknowledge-Document */
   IPP_OP_ACKNOWLEDGE_IDENTIFY_PRINTER,	/* Acknowledge-Identify-Printer */
   IPP_OP_ACKNOWLEDGE_JOB,		/* Acknowledge-Job */
@@ -397,6 +397,7 @@ typedef enum ipp_op_e			/**** IPP operations ****/
 #    define IPP_CLOSE_JOB			IPP_OP_CLOSE_JOB
 #    define IPP_IDENTIFY_PRINTER		IPP_OP_IDENTIFY_PRINTER
 #    define IPP_VALIDATE_DOCUMENT		IPP_OP_VALIDATE_DOCUMENT
+#    define IPP_OP_SEND_HARDCOPY_DOCUMENT	IPP_OP_ADD_DOCUMENT_IMAGES
 #    define IPP_PRIVATE				IPP_OP_PRIVATE
 #    define CUPS_GET_DEFAULT			IPP_OP_CUPS_GET_DEFAULT
 #    define CUPS_GET_PRINTERS			IPP_OP_CUPS_GET_PRINTERS

cups/testcreds.c

@@ -0,0 +1,124 @@
+/*
+ * HTTP credentials test program for CUPS.
+ *
+ * Copyright 2007-2016 by Apple Inc.
+ * Copyright 1997-2006 by Easy Software Products.
+ *
+ * These coded instructions, statements, and computer programs are the
+ * property of Apple Inc. and are protected by Federal copyright
+ * law.  Distribution and use rights are outlined in the file "LICENSE.txt"
+ * which should have been included with this file.  If this file is
+ * file is missing or damaged, see the license at "http://www.cups.org/".
+ *
+ * This file is subject to the Apple OS-Developed Software exception.
+ */
+
+/*
+ * Include necessary headers...
+ */
+
+#include "cups-private.h"
+
+
+/*
+ * 'main()' - Main entry.
+ */
+
+int					/* O - Exit status */
+main(int  argc,				/* I - Number of command-line arguments */
+     char *argv[])			/* I - Command-line arguments */
+{
+  http_t	*http;			/* HTTP connection */
+  char		scheme[HTTP_MAX_URI],	/* Scheme from URI */
+		hostname[HTTP_MAX_URI],	/* Hostname from URI */
+		username[HTTP_MAX_URI],	/* Username:password from URI */
+		resource[HTTP_MAX_URI];	/* Resource from URI */
+  int		port;			/* Port number from URI */
+  http_trust_t	trust;			/* Trust evaluation for connection */
+  cups_array_t	*hcreds,		/* Credentials from connection */
+		*tcreds;		/* Credentials from trust store */
+  char		hinfo[1024],		/* String for connection credentials */
+		tinfo[1024];		/* String for trust store credentials */
+  static const char *trusts[] =		/* Trust strings */
+  { "OK", "Invalid", "Changed", "Expired", "Renewed", "Unknown" };
+
+
+ /*
+  * Check command-line...
+  */
+
+  if (argc != 2)
+  {
+    puts("Usage: ./testcreds hostname");
+    puts("       ./testcreds https://hostname[:port]");
+    return (1);
+  }
+
+  if (!strncmp(argv[1], "https://", 8))
+  {
+   /*
+    * Connect to the host and validate credentials...
+    */
+
+    if (httpSeparateURI(HTTP_URI_CODING_MOST, argv[1], scheme, sizeof(scheme), username, sizeof(username), hostname, sizeof(hostname), &port, resource, sizeof(resource)) < HTTP_URI_STATUS_OK)
+    {
+      printf("ERROR: Bad URI \"%s\".\n", argv[1]);
+      return (1);
+    }
+
+    if ((http = httpConnect2(hostname, port, NULL, AF_UNSPEC, HTTP_ENCRYPTION_ALWAYS, 1, 30000, NULL)) == NULL)
+    {
+      printf("ERROR: Unable to connect to \"%s\" on port %d: %s\n", hostname, port, cupsLastErrorString());
+      return (1);
+    }
+
+    puts("HTTP Credentials:");
+    if (!httpCopyCredentials(http, &hcreds))
+    {
+      trust = httpCredentialsGetTrust(hcreds, hostname);
+
+      httpCredentialsString(hcreds, hinfo, sizeof(hinfo));
+
+      printf("    Certificate Count: %d\n", cupsArrayCount(hcreds));
+      if (trust == HTTP_TRUST_OK)
+        puts("    Trust: OK");
+      else
+        printf("    Trust: %s (%s)\n", trusts[trust], cupsLastErrorString());
+      printf("    Expiration: %s\n", httpGetDateString(httpCredentialsGetExpiration(hcreds)));
+      printf("    IsValidName: %d\n", httpCredentialsAreValidForName(hcreds, hostname));
+      printf("    String: \"%s\"\n", hinfo);
+
+      httpFreeCredentials(hcreds);
+    }
+    else
+      puts("    Not present (error).");
+
+    puts("");
+  }
+  else
+  {
+   /*
+    * Load stored credentials...
+    */
+
+    strlcpy(hostname, argv[1], sizeof(hostname));
+  }
+
+  printf("Trust Store for \"%s\":\n", hostname);
+
+  if (!httpLoadCredentials(NULL, &tcreds, hostname))
+  {
+    httpCredentialsString(tcreds, tinfo, sizeof(tinfo));
+
+    printf("    Certificate Count: %d\n", cupsArrayCount(tcreds));
+    printf("    Expiration: %s\n", httpGetDateString(httpCredentialsGetExpiration(tcreds)));
+    printf("    IsValidName: %d\n", httpCredentialsAreValidForName(tcreds, hostname));
+    printf("    String: \"%s\"\n", tinfo);
+
+    httpFreeCredentials(tcreds);
+  }
+  else
+    puts("    Not present.");
+
+  return (0);
+}

cups/tls-darwin.c

@@ -24,6 +24,14 @@
 extern char **environ;
 
 
+/*
+ * Constants, very secure stuff...
+ */
+
+#define _CUPS_CDSA_PASSWORD	"42"	/* CUPS keychain password */
+#define _CUPS_CDSA_PASSLEN	2	/* Length of keychain password */
+
+
 /*
  * Local globals...
  */
@@ -54,6 +62,8 @@ static CFArrayRef	http_cdsa_copy_server(const char *common_name);
 static SecCertificateRef http_cdsa_create_credential(http_credential_t *credential);
 #ifdef HAVE_SECKEYCHAINOPEN
 static const char	*http_cdsa_default_path(char *buffer, size_t bufsize);
+static SecKeychainRef	http_cdsa_open_keychain(const char *path, char *filename, size_t filesize);
+static SecKeychainRef	http_cdsa_open_system_keychain(void);
 #endif /* HAVE_SECKEYCHAINOPEN */
 static OSStatus		http_cdsa_read(SSLConnectionRef connection, void *data, size_t *dataLength);
 static int		http_cdsa_set_credentials(http_t *http);
@@ -354,18 +364,12 @@ cupsSetServerCredentials(
   DEBUG_printf(("cupsSetServerCredentials(path=\"%s\", common_name=\"%s\", auto_create=%d)", path, common_name, auto_create));
 
 #ifdef HAVE_SECKEYCHAINOPEN
-  char			filename[1024];	/* Filename for keychain */
-  SecKeychainRef	keychain = NULL;/* Temporary keychain */
-  OSStatus		status;		/* Status code */
+  char		filename[1024];		/* Keychain filename */
+  SecKeychainRef keychain = http_cdsa_open_keychain(path, filename, sizeof(filename));
 
-
-  if (!path)
-    path = http_cdsa_default_path(filename, sizeof(filename));
-
-  if ((status = SecKeychainOpen(path, &keychain)) != noErr)
+  if (!keychain)
   {
-    /* TODO: Set cups last error string */
-    DEBUG_printf(("1cupsSetServerCredentials: Unable to open keychain (%d), returning 0.", (int)status));
+    DEBUG_puts("1cupsSetServerCredentials: Unable to open keychain.");
     return (0);
   }
 
@@ -389,7 +393,7 @@ cupsSetServerCredentials(
   */
 
   tls_keychain    = keychain;
-  tls_keypath     = _cupsStrAlloc(path);
+  tls_keypath     = _cupsStrAlloc(filename);
   tls_auto_create = auto_create;
   tls_common_name = _cupsStrAlloc(common_name);
 
@@ -600,10 +604,16 @@ httpCredentialsGetTrust(
 
 
   if (!common_name)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("No common name specified."), 1);
     return (HTTP_TRUST_UNKNOWN);
+  }
 
   if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create credentials from array."), 1);
     return (HTTP_TRUST_UNKNOWN);
+  }
 
   if (cg->any_root < 0)
     _cupsSetDefaults();
@@ -635,15 +645,28 @@ httpCredentialsGetTrust(
         * Do not trust certificates on first use...
 	*/
 
+        _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
+
         trust = HTTP_TRUST_INVALID;
       }
-      else if (httpCredentialsGetExpiration(credentials) <= httpCredentialsGetExpiration(tcreds) || !httpCredentialsAreValidForName(credentials, common_name))
+      else if (httpCredentialsGetExpiration(credentials) <= httpCredentialsGetExpiration(tcreds))
       {
        /*
-        * Either the new credentials are not newly issued, or the common name
-	* does not match the issued certificate...
+        * The new credentials are not newly issued...
 	*/
 
+        _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("New credentials are older than stored credentials."), 1);
+
+        trust = HTTP_TRUST_INVALID;
+      }
+      else if (!httpCredentialsAreValidForName(credentials, common_name))
+      {
+       /*
+        * The common name does not match the issued certificate...
+	*/
+
+        _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("New credentials are not valid for name."), 1);
+
         trust = HTTP_TRUST_INVALID;
       }
       else if (httpCredentialsGetExpiration(tcreds) < time(NULL))
@@ -661,14 +684,65 @@ httpCredentialsGetTrust(
     httpFreeCredentials(tcreds);
   }
   else if (cg->validate_certs && !httpCredentialsAreValidForName(credentials, common_name))
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("No stored credentials, not valid for name."), 1);
     trust = HTTP_TRUST_INVALID;
-
-  if (!cg->expired_certs && !SecCertificateIsValid(secCert, CFAbsoluteTimeGetCurrent()))
-    trust = HTTP_TRUST_EXPIRED;
-  else if (!cg->any_root && cupsArrayCount(credentials) == 1)
-    trust = HTTP_TRUST_INVALID;
+  }
   else if (!cg->trust_first)
+  {
+   /*
+    * See if we have a site CA certificate we can compare...
+    */
+
+    if (!httpLoadCredentials(NULL, &tcreds, "site"))
+    {
+      if (cupsArrayCount(credentials) != (cupsArrayCount(tcreds) + 1))
+      {
+       /*
+        * Certificate isn't directly generated from the CA cert...
+	*/
+
+        trust = HTTP_TRUST_INVALID;
+      }
+      else
+      {
+       /*
+        * Do a tail comparison of the two certificates...
+	*/
+
+        http_credential_t	*a, *b;		/* Certificates */
+
+        for (a = (http_credential_t *)cupsArrayFirst(tcreds), b = (http_credential_t *)cupsArrayIndex(credentials, 1);
+	     a && b;
+	     a = (http_credential_t *)cupsArrayNext(tcreds), b = (http_credential_t *)cupsArrayNext(credentials))
+	  if (a->datalen != b->datalen || memcmp(a->data, b->data, a->datalen))
+	    break;
+
+        if (a || b)
+	  trust = HTTP_TRUST_INVALID;
+      }
+
+      if (trust != HTTP_TRUST_OK)
+	_cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Credentials do not validate against site CA certificate."), 1);
+    }
+    else
+    {
+      _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
+      trust = HTTP_TRUST_INVALID;
+    }
+  }
+
+  if (trust == HTTP_TRUST_OK && !cg->expired_certs && !SecCertificateIsValid(secCert, CFAbsoluteTimeGetCurrent()))
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Credentials have expired."), 1);
+    trust = HTTP_TRUST_EXPIRED;
+  }
+
+  if (trust == HTTP_TRUST_OK && !cg->any_root && cupsArrayCount(credentials) == 1)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Self-signed credentials are blocked."), 1);
     trust = HTTP_TRUST_INVALID;
+  }
 
   CFRelease(secCert);
 
@@ -789,7 +863,8 @@ httpLoadCredentials(
   OSStatus		err;		/* Error info */
 #ifdef HAVE_SECKEYCHAINOPEN
   char			filename[1024];	/* Filename for keychain */
-  SecKeychainRef	keychain = NULL;/* Keychain reference */
+  SecKeychainRef	keychain = NULL,/* Keychain reference */
+			syschain = NULL;/* System keychain */
   CFArrayRef		list;		/* Keychain list */
 #endif /* HAVE_SECKEYCHAINOPEN */
   SecCertificateRef	cert = NULL;	/* Certificate */
@@ -808,12 +883,13 @@ httpLoadCredentials(
   *credentials = NULL;
 
 #ifdef HAVE_SECKEYCHAINOPEN
-  if (!path)
-    path = http_cdsa_default_path(filename, sizeof(filename));
+  keychain = http_cdsa_open_keychain(path, filename, sizeof(filename));
 
-  if ((err = SecKeychainOpen(path, &keychain)) != noErr)
+  if (!keychain)
     goto cleanup;
 
+  syschain = http_cdsa_open_system_keychain();
+
 #else
   if (path)
     return (-1);
@@ -838,7 +914,14 @@ httpLoadCredentials(
   CFDictionaryAddValue(query, kSecMatchLimit, kSecMatchLimitOne);
 
 #ifdef HAVE_SECKEYCHAINOPEN
-  list = CFArrayCreate(kCFAllocatorDefault, (const void **)&keychain, 1, &kCFTypeArrayCallBacks);
+  if (syschain)
+  {
+    const void *values[2] = { syschain, keychain };
+
+    list = CFArrayCreate(kCFAllocatorDefault, (const void **)values, 2, &kCFTypeArrayCallBacks);
+  }
+  else
+    list = CFArrayCreate(kCFAllocatorDefault, (const void **)&keychain, 1, &kCFTypeArrayCallBacks);
   CFDictionaryAddValue(query, kSecMatchSearchList, list);
   CFRelease(list);
 #endif /* HAVE_SECKEYCHAINOPEN */
@@ -865,6 +948,9 @@ httpLoadCredentials(
 #ifdef HAVE_SECKEYCHAINOPEN
   if (keychain)
     CFRelease(keychain);
+
+  if (syschain)
+    CFRelease(syschain);
 #endif /* HAVE_SECKEYCHAINOPEN */
   if (cert)
     CFRelease(cert);
@@ -919,14 +1005,10 @@ httpSaveCredentials(
   }
 
 #ifdef HAVE_SECKEYCHAINOPEN
-  if (!path)
-    path = http_cdsa_default_path(filename, sizeof(filename));
+  keychain = http_cdsa_open_keychain(path, filename, sizeof(filename));
 
-  if ((err = SecKeychainOpen(path, &keychain)) != noErr)
-  {
-    DEBUG_printf(("1httpSaveCredentials: SecKeychainOpen returned %d.", (int)err));
+  if (!keychain)
     goto cleanup;
-  }
 
 #else
   if (path)
@@ -1664,6 +1746,7 @@ http_cdsa_copy_server(
 					/* Server name */
   CFMutableDictionaryRef query = NULL;	/* Query qualifiers */
   CFArrayRef		list = NULL;	/* Keychain list */
+  SecKeychainRef	syschain = NULL;/* System keychain */
 
 
   DEBUG_printf(("3http_cdsa_copy_server(common_name=\"%s\")", common_name));
@@ -1691,7 +1774,17 @@ http_cdsa_copy_server(
   CFDictionaryAddValue(query, kSecReturnRef, kCFBooleanTrue);
   CFDictionaryAddValue(query, kSecMatchLimit, kSecMatchLimitOne);
 
-  list = CFArrayCreate(kCFAllocatorDefault, (const void **)&tls_keychain, 1, &kCFTypeArrayCallBacks);
+  syschain = http_cdsa_open_system_keychain();
+
+  if (syschain)
+  {
+    const void *values[2] = { syschain, tls_keychain };
+
+    list = CFArrayCreate(kCFAllocatorDefault, (const void **)values, 2, &kCFTypeArrayCallBacks);
+  }
+  else
+    list = CFArrayCreate(kCFAllocatorDefault, (const void **)&tls_keychain, 1, &kCFTypeArrayCallBacks);
+
   CFDictionaryAddValue(query, kSecMatchSearchList, list);
   CFRelease(list);
 
@@ -1719,6 +1812,8 @@ http_cdsa_copy_server(
 
   cleanup :
 
+  if (syschain)
+    CFRelease(syschain);
   if (identity)
     CFRelease(identity);
   if (policy)
@@ -1768,15 +1863,164 @@ http_cdsa_default_path(char   *buffer,	/* I - Path buffer */
   const char *home = getenv("HOME");	/* HOME environment variable */
 
 
+ /*
+  * Determine the default keychain path.  Note that the login and system
+  * keychains are no longer accessible to user applications starting in macOS
+  * 10.11.4 (!), so we need to create our own keychain just for CUPS.
+  */
+
   if (getuid() && home)
-    snprintf(buffer, bufsize, "%s/Library/Keychains/login.keychain", home);
+    snprintf(buffer, bufsize, "%s/.cups/ssl.keychain", home);
   else
-    strlcpy(buffer, "/Library/Keychains/System.keychain", bufsize);
+    strlcpy(buffer, "/etc/cups/ssl.keychain", bufsize);
 
   DEBUG_printf(("1http_cdsa_default_path: Using default path \"%s\".", buffer));
 
   return (buffer);
 }
+
+
+/*
+ * 'http_cdsa_open_keychain()' - Open (or create) a keychain.
+ */
+
+static SecKeychainRef			/* O - Keychain or NULL */
+http_cdsa_open_keychain(
+    const char *path,			/* I - Path to keychain */
+    char       *filename,		/* I - Keychain filename */
+    size_t     filesize)		/* I - Size of filename buffer */
+{
+  SecKeychainRef	keychain = NULL;/* Temporary keychain */
+  OSStatus		err;		/* Error code */
+  Boolean		interaction;	/* Interaction allowed? */
+  SecKeychainStatus	status = 0;	/* Keychain status */
+
+
+ /*
+  * Get the keychain filename...
+  */
+
+  if (!path)
+    path = http_cdsa_default_path(filename, filesize);
+  else
+    strlcpy(filename, path, filesize);
+
+ /*
+  * Save the interaction setting and disable while we open the keychain...
+  */
+
+  SecKeychainGetUserInteractionAllowed(&interaction);
+  SecKeychainSetUserInteractionAllowed(FALSE);
+
+  if (access(path, R_OK))
+  {
+   /*
+    * Create a new keychain at the given path...
+    */
+
+    err = SecKeychainCreate(path, _CUPS_CDSA_PASSLEN, _CUPS_CDSA_PASSWORD, FALSE, NULL, &keychain);
+  }
+  else
+  {
+   /*
+    * Open the existing keychain and unlock as needed...
+    */
+
+    err = SecKeychainOpen(path, &keychain);
+
+    if (err == noErr)
+      err = SecKeychainGetStatus(keychain, &status);
+
+    if (err == noErr && !(status & kSecUnlockStateStatus))
+      err = SecKeychainUnlock(keychain, _CUPS_CDSA_PASSLEN, _CUPS_CDSA_PASSWORD, TRUE);
+  }
+
+ /*
+  * Restore interaction setting...
+  */
+
+  SecKeychainSetUserInteractionAllowed(interaction);
+
+ /*
+  * Release the keychain if we had any errors...
+  */
+
+  if (err != noErr)
+  {
+    /* TODO: Set cups last error string */
+    DEBUG_printf(("4http_cdsa_open_keychain: Unable to open keychain (%d), returning NULL.", (int)err));
+
+    if (keychain)
+    {
+      CFRelease(keychain);
+      keychain = NULL;
+    }
+  }
+
+ /*
+  * Return the keychain or NULL...
+  */
+
+  return (keychain);
+}
+
+
+/*
+ * 'http_cdsa_open_system_keychain()' - Open the System keychain.
+ */
+
+static SecKeychainRef
+http_cdsa_open_system_keychain(void)
+{
+  SecKeychainRef	keychain = NULL;/* Temporary keychain */
+  OSStatus		err;		/* Error code */
+  Boolean		interaction;	/* Interaction allowed? */
+  SecKeychainStatus	status = 0;	/* Keychain status */
+
+
+ /*
+  * Save the interaction setting and disable while we open the keychain...
+  */
+
+  SecKeychainGetUserInteractionAllowed(&interaction);
+  SecKeychainSetUserInteractionAllowed(TRUE);
+
+  err = SecKeychainOpen("/Library/Keychains/System.keychain", &keychain);
+
+  if (err == noErr)
+    err = SecKeychainGetStatus(keychain, &status);
+
+  if (err == noErr && !(status & kSecUnlockStateStatus))
+    err = errSecInteractionNotAllowed;
+
+ /*
+  * Restore interaction setting...
+  */
+
+  SecKeychainSetUserInteractionAllowed(interaction);
+
+ /*
+  * Release the keychain if we had any errors...
+  */
+
+  if (err != noErr)
+  {
+    /* TODO: Set cups last error string */
+    DEBUG_printf(("4http_cdsa_open_system_keychain: Unable to open keychain (%d), returning NULL.", (int)err));
+
+    if (keychain)
+    {
+      CFRelease(keychain);
+      keychain = NULL;
+    }
+  }
+
+ /*
+  * Return the keychain or NULL...
+  */
+
+  return (keychain);
+}
 #endif /* HAVE_SECKEYCHAINOPEN */
 
 

cups/tls-gnutls.c

@@ -435,10 +435,16 @@ httpCredentialsGetTrust(
 
 
   if (!common_name)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("No common name specified."), 1);
     return (HTTP_TRUST_UNKNOWN);
+  }
 
   if ((cert = http_gnutls_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create credentials from array."), 1);
     return (HTTP_TRUST_UNKNOWN);
+  }
 
   if (cg->any_root < 0)
   {
@@ -473,15 +479,28 @@ httpCredentialsGetTrust(
         * Do not trust certificates on first use...
 	*/
 
+        _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
+
         trust = HTTP_TRUST_INVALID;
       }
-      else if (httpCredentialsGetExpiration(credentials) <= httpCredentialsGetExpiration(tcreds) || !httpCredentialsAreValidForName(credentials, common_name))
+      else if (httpCredentialsGetExpiration(credentials) <= httpCredentialsGetExpiration(tcreds))
       {
        /*
-        * Either the new credentials are not newly issued, or the common name
-	* does not match the issued certificate...
+        * The new credentials are not newly issued...
 	*/
 
+        _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("New credentials are older than stored credentials."), 1);
+
+        trust = HTTP_TRUST_INVALID;
+      }
+      else if (!httpCredentialsAreValidForName(credentials, common_name))
+      {
+       /*
+        * The common name does not match the issued certificate...
+	*/
+
+        _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("New credentials are not valid for name."), 1);
+
         trust = HTTP_TRUST_INVALID;
       }
       else if (httpCredentialsGetExpiration(tcreds) < time(NULL))
@@ -499,7 +518,53 @@ httpCredentialsGetTrust(
     httpFreeCredentials(tcreds);
   }
   else if (cg->validate_certs && !httpCredentialsAreValidForName(credentials, common_name))
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("No stored credentials, not valid for name."), 1);
     trust = HTTP_TRUST_INVALID;
+  }
+  else if (!cg->trust_first)
+  {
+   /*
+    * See if we have a site CA certificate we can compare...
+    */
+
+    if (!httpLoadCredentials(NULL, &tcreds, "site"))
+    {
+      if (cupsArrayCount(credentials) != (cupsArrayCount(tcreds) + 1))
+      {
+       /*
+        * Certificate isn't directly generated from the CA cert...
+	*/
+
+        trust = HTTP_TRUST_INVALID;
+      }
+      else
+      {
+       /*
+        * Do a tail comparison of the two certificates...
+	*/
+
+        http_credential_t	*a, *b;		/* Certificates */
+
+        for (a = (http_credential_t *)cupsArrayFirst(tcreds), b = (http_credential_t *)cupsArrayIndex(credentials, 1);
+	     a && b;
+	     a = (http_credential_t *)cupsArrayNext(tcreds), b = (http_credential_t *)cupsArrayNext(credentials))
+	  if (a->datalen != b->datalen || memcmp(a->data, b->data, a->datalen))
+	    break;
+
+        if (a || b)
+	  trust = HTTP_TRUST_INVALID;
+      }
+
+      if (trust != HTTP_TRUST_OK)
+	_cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Credentials do not validate against site CA certificate."), 1);
+    }
+    else
+    {
+      _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
+      trust = HTTP_TRUST_INVALID;
+    }
+  }
 
   if (trust == HTTP_TRUST_OK && !cg->expired_certs)
   {
@@ -508,11 +573,17 @@ httpCredentialsGetTrust(
     time(&curtime);
     if (curtime < gnutls_x509_crt_get_activation_time(cert) ||
         curtime > gnutls_x509_crt_get_expiration_time(cert))
+    {
+      _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Credentials have expired."), 1);
       trust = HTTP_TRUST_EXPIRED;
+    }
   }
 
   if (trust == HTTP_TRUST_OK && !cg->any_root && cupsArrayCount(credentials) == 1)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Self-signed credentials are blocked."), 1);
     trust = HTTP_TRUST_INVALID;
+  }
 
   gnutls_x509_crt_deinit(cert);
 

locale/cups.pot

@@ -28,7 +28,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 1.6\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-08 12:26-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -3750,6 +3750,14 @@ msgstr ""
 msgid "Created"
 msgstr ""
 
+#: cups/tls-darwin.c:726 cups/tls-gnutls.c:560
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
+#: cups/tls-darwin.c:737 cups/tls-gnutls.c:577
+msgid "Credentials have expired."
+msgstr ""
+
 #: cups/ppd.c:1136 cups/ppd.c:1176 cups/ppd.c:1421 cups/ppd.c:1524
 msgid "Custom"
 msgstr ""
@@ -5151,6 +5159,14 @@ msgstr ""
 msgid "Never"
 msgstr ""
 
+#: cups/tls-darwin.c:668 cups/tls-gnutls.c:502
+msgid "New credentials are not valid for name."
+msgstr ""
+
+#: cups/tls-darwin.c:658 cups/tls-gnutls.c:492
+msgid "New credentials are older than stored credentials."
+msgstr ""
+
 #: cups/ppd.c:1971
 msgid "No"
 msgstr ""
@@ -5196,6 +5212,10 @@ msgstr ""
 msgid "No authentication information provided."
 msgstr ""
 
+#: cups/tls-darwin.c:608 cups/tls-gnutls.c:439
+msgid "No common name specified."
+msgstr ""
+
 #: cups/snmp.c:954
 msgid "No community name"
 msgstr ""
@@ -5269,6 +5289,10 @@ msgstr ""
 msgid "No request-id"
 msgstr ""
 
+#: cups/tls-darwin.c:688 cups/tls-gnutls.c:522
+msgid "No stored credentials, not valid for name."
+msgstr ""
+
 #: scheduler/ipp.c:5679
 msgid "No subscription attributes in request."
 msgstr ""
@@ -5854,7 +5878,7 @@ msgstr ""
 msgid "Roll 9"
 msgstr ""
 
-#: cups/adminutil.c:2083
+#: cups/adminutil.c:2100
 #, c-format
 msgid "Running command: %s %s -N -A %s -c '%s'"
 msgstr ""
@@ -5911,6 +5935,10 @@ msgstr ""
 msgid "Self Adhesive Film"
 msgstr ""
 
+#: cups/tls-darwin.c:743 cups/tls-gnutls.c:584
+msgid "Self-signed credentials are blocked."
+msgstr ""
+
 #: cups/ppd-cache.c:3375
 msgid "Semi-Gloss Fabric"
 msgstr ""
@@ -5947,7 +5975,7 @@ msgstr ""
 msgid "Server Stopped"
 msgstr ""
 
-#: cups/tls-darwin.c:1101 cups/tls-gnutls.c:1192
+#: cups/tls-darwin.c:1183 cups/tls-gnutls.c:1263
 msgid "Server credentials not set."
 msgstr ""
 
@@ -6510,6 +6538,11 @@ msgstr ""
 msgid "Triple Wall Cardboard"
 msgstr ""
 
+#: cups/tls-darwin.c:648 cups/tls-darwin.c:730 cups/tls-gnutls.c:482
+#: cups/tls-gnutls.c:564
+msgid "Trust on first use is disabled."
+msgstr ""
+
 #: cups/http-support.c:1382
 msgid "URI Too Long"
 msgstr ""
@@ -6668,6 +6701,10 @@ msgstr ""
 msgid "Unable to copy Windows 9x printer driver files (%d)."
 msgstr ""
 
+#: cups/tls-darwin.c:614 cups/tls-gnutls.c:445
+msgid "Unable to create credentials from array."
+msgstr ""
+
 #: cups/ppd-util.c:542 cups/util.c:482
 msgid "Unable to create printer-uri"
 msgstr ""
@@ -6676,7 +6713,7 @@ msgstr ""
 msgid "Unable to create printer."
 msgstr ""
 
-#: cups/tls-darwin.c:1362 cups/tls-gnutls.c:1380
+#: cups/tls-darwin.c:1444 cups/tls-gnutls.c:1451
 msgid "Unable to create server credentials."
 msgstr ""
 
@@ -6700,35 +6737,35 @@ msgstr ""
 msgid "Unable to edit cupsd.conf files larger than 1MB"
 msgstr ""
 
-#: cups/tls-darwin.c:1529
+#: cups/tls-darwin.c:1611
 msgid "Unable to establish a secure connection to host (certificate chain invalid)."
 msgstr ""
 
-#: cups/tls-darwin.c:1519
+#: cups/tls-darwin.c:1601
 msgid "Unable to establish a secure connection to host (certificate not yet valid)."
 msgstr ""
 
-#: cups/tls-darwin.c:1514
+#: cups/tls-darwin.c:1596
 msgid "Unable to establish a secure connection to host (expired certificate)."
 msgstr ""
 
-#: cups/tls-darwin.c:1524
+#: cups/tls-darwin.c:1606
 msgid "Unable to establish a secure connection to host (host name mismatch)."
 msgstr ""
 
-#: cups/tls-darwin.c:1534
+#: cups/tls-darwin.c:1616
 msgid "Unable to establish a secure connection to host (peer dropped connection before responding)."
 msgstr ""
 
-#: cups/tls-darwin.c:1509
+#: cups/tls-darwin.c:1591
 msgid "Unable to establish a secure connection to host (self-signed certificate)."
 msgstr ""
 
-#: cups/tls-darwin.c:1504
+#: cups/tls-darwin.c:1586
 msgid "Unable to establish a secure connection to host (untrusted certificate)."
 msgstr ""
 
-#: cups/tls-darwin.c:1561 cups/tls-sspi.c:1277 cups/tls-sspi.c:1294
+#: cups/tls-darwin.c:1643 cups/tls-sspi.c:1277 cups/tls-sspi.c:1294
 msgid "Unable to establish a secure connection to host."
 msgstr ""
 
@@ -6740,7 +6777,7 @@ msgstr ""
 msgid "Unable to find printer."
 msgstr ""
 
-#: cups/tls-darwin.c:1375
+#: cups/tls-darwin.c:1457
 msgid "Unable to find server credentials."
 msgstr ""
 
@@ -6865,7 +6902,7 @@ msgstr ""
 msgid "Unable to resolve printer-uri."
 msgstr ""
 
-#: cups/adminutil.c:2119
+#: cups/adminutil.c:2136
 #, c-format
 msgid "Unable to run \"%s\": %s"
 msgstr ""
@@ -6993,7 +7030,7 @@ msgstr ""
 msgid "Unknown scheme in URI"
 msgstr ""
 
-#: cups/http-addrlist.c:775
+#: cups/http-addrlist.c:783
 msgid "Unknown service name."
 msgstr ""
 
@@ -8294,7 +8331,7 @@ msgstr ""
 msgid "scheduler is running"
 msgstr ""
 
-#: cups/adminutil.c:2190
+#: cups/adminutil.c:2207
 #, c-format
 msgid "stat of %s failed: %s"
 msgstr ""

locale/cups.strings

@@ -808,6 +808,8 @@
 "Cotton Envelope" = "Cotton Envelope";
 "Cover" = "Cover";
 "Created" = "Created";
+"Credentials do not validate against site CA certificate." = "Credentials do not validate against site CA certificate.";
+"Credentials have expired." = "Credentials have expired.";
 "Custom" = "Custom";
 "CustominCutInterval" = "CustominCutInterval";
 "CustominTearInterval" = "CustominTearInterval";
@@ -1144,6 +1146,8 @@
 "Name OID uses indefinite length" = "Name OID uses indefinite length";
 "Nested classes are not allowed." = "Nested classes are not allowed.";
 "Never" = "Never";
+"New credentials are not valid for name." = "New credentials are not valid for name.";
+"New credentials are older than stored credentials." = "New credentials are older than stored credentials.";
 "No" = "No";
 "No Content" = "No Content";
 "No Finishing" = "No Finishing";
@@ -1155,6 +1159,7 @@
 "No active jobs on %s." = "No active jobs on %s.";
 "No attributes in request." = "No attributes in request.";
 "No authentication information provided." = "No authentication information provided.";
+"No common name specified." = "No common name specified.";
 "No community name" = "No community name";
 "No default printer." = "No default printer.";
 "No destinations added." = "No destinations added.";
@@ -1173,6 +1178,7 @@
 "No request protocol version." = "No request protocol version.";
 "No request sent." = "No request sent.";
 "No request-id" = "No request-id";
+"No stored credentials, not valid for name." = "No stored credentials, not valid for name.";
 "No subscription attributes in request." = "No subscription attributes in request.";
 "No subscriptions found." = "No subscriptions found.";
 "No variable-bindings SEQUENCE" = "No variable-bindings SEQUENCE";
@@ -1330,6 +1336,7 @@
 "See remote printer." = "See remote printer.";
 "Self Adhesive" = "Self Adhesive";
 "Self Adhesive Film" = "Self Adhesive Film";
+"Self-signed credentials are blocked." = "Self-signed credentials are blocked.";
 "Semi-Gloss Fabric" = "Semi-Gloss Fabric";
 "Semi-Gloss Labels" = "Semi-Gloss Labels";
 "Semi-Gloss Optical Disc" = "Semi-Gloss Optical Disc";
@@ -1473,6 +1480,7 @@
 "Triple Staple (Reverse Landscape)" = "Triple Staple (Reverse Landscape)";
 "Triple Staple (Reverse Portrait)" = "Triple Staple (Reverse Portrait)";
 "Triple Wall Cardboard" = "Triple Wall Cardboard";
+"Trust on first use is disabled." = "Trust on first use is disabled.";
 "URI Too Long" = "URI Too Long";
 "URI too large" = "URI too large";
 "US Ledger" = "US Ledger";
@@ -1510,6 +1518,7 @@
 "Unable to copy PPD file." = "Unable to copy PPD file.";
 "Unable to copy Windows 2000 printer driver files (%d)." = "Unable to copy Windows 2000 printer driver files (%d).";
 "Unable to copy Windows 9x printer driver files (%d)." = "Unable to copy Windows 9x printer driver files (%d).";
+"Unable to create credentials from array." = "Unable to create credentials from array.";
 "Unable to create printer-uri" = "Unable to create printer-uri";
 "Unable to create printer." = "Unable to create printer.";
 "Unable to create server credentials." = "Unable to create server credentials.";

locale/cups_ca.po

@@ -32,7 +32,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 1.4.6\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-08 12:26-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2012-09-29 11:21+0200\n"
 "Last-Translator: Àngel Mompó <mecatxis@gmail.com>\n"
 "Language-Team: Catalan <ca@dodds.net>\n"
@@ -3086,6 +3086,12 @@ msgstr ""
 msgid "Created"
 msgstr "Creat"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
+msgid "Credentials have expired."
+msgstr ""
+
 msgid "Custom"
 msgstr "Personalitzat"
 
@@ -4154,6 +4160,12 @@ msgstr "No es permeten les classes imbricades."
 msgid "Never"
 msgstr "Mai"
 
+msgid "New credentials are not valid for name."
+msgstr ""
+
+msgid "New credentials are older than stored credentials."
+msgstr ""
+
 msgid "No"
 msgstr "No"
 
@@ -4188,6 +4200,9 @@ msgstr "No hi ha atributs en demanda."
 msgid "No authentication information provided."
 msgstr "No s'ha donat cap informació d'autenticació."
 
+msgid "No common name specified."
+msgstr ""
+
 msgid "No community name"
 msgstr "Ho hi na cap nom de comunitat"
 
@@ -4244,6 +4259,9 @@ msgstr ""
 msgid "No request-id"
 msgstr "No hi ha cap request-id"
 
+msgid "No stored credentials, not valid for name."
+msgstr ""
+
 msgid "No subscription attributes in request."
 msgstr "No hi ha cap atribut de la subscripció a la sol·licitud."
 
@@ -4728,6 +4746,9 @@ msgstr ""
 msgid "Self Adhesive Film"
 msgstr ""
 
+msgid "Self-signed credentials are blocked."
+msgstr ""
+
 msgid "Semi-Gloss Fabric"
 msgstr ""
 
@@ -5199,6 +5220,9 @@ msgstr ""
 msgid "Triple Wall Cardboard"
 msgstr ""
 
+msgid "Trust on first use is disabled."
+msgstr ""
+
 msgid "URI Too Long"
 msgstr "L'URI és massa llarg"
 
@@ -5328,6 +5352,9 @@ msgid "Unable to copy Windows 9x printer driver files (%d)."
 msgstr ""
 "No es poden copiar els fitxers del controlador d'impressora Windows 9x (%d)."
 
+msgid "Unable to create credentials from array."
+msgstr ""
+
 msgid "Unable to create printer-uri"
 msgstr "No es pot crear el printer-uri"
 

locale/cups_cs.po

@@ -29,7 +29,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 1.6\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-08 12:26-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2012-09-14 10:26+0100\n"
 "Last-Translator: Jan Bartos <jan.bartos@madeta.cz>\n"
 "Language-Team: Czech\n"
@@ -2890,6 +2890,12 @@ msgstr ""
 msgid "Created"
 msgstr "Vytvořeno"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
+msgid "Credentials have expired."
+msgstr ""
+
 msgid "Custom"
 msgstr "Uživatelský"
 
@@ -3944,6 +3950,12 @@ msgstr ""
 msgid "Never"
 msgstr "Nikdy"
 
+msgid "New credentials are not valid for name."
+msgstr ""
+
+msgid "New credentials are older than stored credentials."
+msgstr ""
+
 msgid "No"
 msgstr "Ne"
 
@@ -3978,6 +3990,9 @@ msgstr ""
 msgid "No authentication information provided."
 msgstr ""
 
+msgid "No common name specified."
+msgstr ""
+
 msgid "No community name"
 msgstr "Žádný název komunity"
 
@@ -4032,6 +4047,9 @@ msgstr ""
 msgid "No request-id"
 msgstr "Žádný ID požadavek"
 
+msgid "No stored credentials, not valid for name."
+msgstr ""
+
 msgid "No subscription attributes in request."
 msgstr ""
 
@@ -4514,6 +4532,9 @@ msgstr ""
 msgid "Self Adhesive Film"
 msgstr ""
 
+msgid "Self-signed credentials are blocked."
+msgstr ""
+
 msgid "Semi-Gloss Fabric"
 msgstr ""
 
@@ -4975,6 +4996,9 @@ msgstr ""
 msgid "Triple Wall Cardboard"
 msgstr ""
 
+msgid "Trust on first use is disabled."
+msgstr ""
+
 msgid "URI Too Long"
 msgstr "URI je příliš dlouhá"
 
@@ -5095,6 +5119,9 @@ msgstr ""
 msgid "Unable to copy Windows 9x printer driver files (%d)."
 msgstr ""
 
+msgid "Unable to create credentials from array."
+msgstr ""
+
 msgid "Unable to create printer-uri"
 msgstr ""
 

locale/cups_de.po

@@ -29,7 +29,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 2.0\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-08 12:26-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2016-04-22 12:25+0100\n"
 "Last-Translator: Joachim Schwender <joachim.schwender@web.de>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -2957,6 +2957,12 @@ msgstr ""
 msgid "Created"
 msgstr "Erstellt"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
+msgid "Credentials have expired."
+msgstr ""
+
 msgid "Custom"
 msgstr "Eigene"
 
@@ -4013,6 +4019,12 @@ msgstr "Geschachtelte Klassen sind nicht erlaubt."
 msgid "Never"
 msgstr "Nie"
 
+msgid "New credentials are not valid for name."
+msgstr ""
+
+msgid "New credentials are older than stored credentials."
+msgstr ""
+
 msgid "No"
 msgstr "Nein"
 
@@ -4047,6 +4059,9 @@ msgstr "Keine Attribute in der Anfrage."
 msgid "No authentication information provided."
 msgstr "Keine Authentifizierungsinformation bereitgestellt."
 
+msgid "No common name specified."
+msgstr ""
+
 msgid "No community name"
 msgstr "Kein Community-Name"
 
@@ -4102,6 +4117,9 @@ msgstr "Keine Anfrage gesendet."
 msgid "No request-id"
 msgstr "Keine Anfrage-ID"
 
+msgid "No stored credentials, not valid for name."
+msgstr ""
+
 msgid "No subscription attributes in request."
 msgstr "Keine Subskriptions-Attribute in der Anfrage."
 
@@ -4586,6 +4604,9 @@ msgstr ""
 msgid "Self Adhesive Film"
 msgstr ""
 
+msgid "Self-signed credentials are blocked."
+msgstr ""
+
 msgid "Semi-Gloss Fabric"
 msgstr ""
 
@@ -5060,6 +5081,9 @@ msgstr ""
 msgid "Triple Wall Cardboard"
 msgstr ""
 
+msgid "Trust on first use is disabled."
+msgstr ""
+
 msgid "URI Too Long"
 msgstr "URI zu lang"
 
@@ -5185,6 +5209,9 @@ msgstr ""
 msgid "Unable to copy Windows 9x printer driver files (%d)."
 msgstr "Druckertrieberdateien für Windows 9x können nicht kopiert werden (%d)."
 
+msgid "Unable to create credentials from array."
+msgstr ""
+
 msgid "Unable to create printer-uri"
 msgstr "Drucker-URI kann nicht erzeugt werden"
 

locale/cups_es.po

@@ -16,7 +16,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 2.2\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-08 12:26-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2016-06-26 21:17+0100\n"
 "Last-Translator: Juan Pablo González Riopedre <jpgriopedre@yahoo.es>\n"
 "Language-Team: Spanish\n"
@@ -3161,6 +3161,12 @@ msgstr "Carátula"
 msgid "Created"
 msgstr "Creado"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
+msgid "Credentials have expired."
+msgstr ""
+
 msgid "Custom"
 msgstr "A medida"
 
@@ -4227,6 +4233,12 @@ msgstr "No se permiten clases anidadas."
 msgid "Never"
 msgstr "Nunca"
 
+msgid "New credentials are not valid for name."
+msgstr ""
+
+msgid "New credentials are older than stored credentials."
+msgstr ""
+
 msgid "No"
 msgstr "No"
 
@@ -4261,6 +4273,9 @@ msgstr "No hay atributos en la solicitud."
 msgid "No authentication information provided."
 msgstr "No se ha proporcionado información de autentificación."
 
+msgid "No common name specified."
+msgstr ""
+
 msgid "No community name"
 msgstr "No hay nombre de comunidad"
 
@@ -4317,6 +4332,9 @@ msgstr "No se ha enviado solicitud."
 msgid "No request-id"
 msgstr "No hay request-id"
 
+msgid "No stored credentials, not valid for name."
+msgstr ""
+
 msgid "No subscription attributes in request."
 msgstr "No hay atributos de subscripción en la solicitud."
 
@@ -4800,6 +4818,9 @@ msgstr ""
 msgid "Self Adhesive Film"
 msgstr ""
 
+msgid "Self-signed credentials are blocked."
+msgstr ""
+
 msgid "Semi-Gloss Fabric"
 msgstr ""
 
@@ -5273,6 +5294,9 @@ msgstr "Grapado triple (retrato invertido)"
 msgid "Triple Wall Cardboard"
 msgstr ""
 
+msgid "Trust on first use is disabled."
+msgstr ""
+
 msgid "URI Too Long"
 msgstr "URI demasiado largo"
 
@@ -5405,6 +5429,9 @@ msgstr ""
 "No se han podido copiar los archivos del controlador de impresora de Windows "
 "9x (%d)."
 
+msgid "Unable to create credentials from array."
+msgstr ""
+
 msgid "Unable to create printer-uri"
 msgstr "No se ha podido crear printer-uri"
 
@@ -5786,8 +5813,8 @@ msgstr "Uso: cupstestdsc [opciones] nombre_archivo.ps [... nombre_archivo.ps]"
 msgid ""
 "Usage: cupstestppd [options] filename1.ppd[.gz] [... filenameN.ppd[.gz]]"
 msgstr ""
-"Uso: cupstestppd [opciones] nombre_archivo1.ppd[.gz] [... nombre_archivoN.ppd"
-"[.gz]]"
+"Uso: cupstestppd [opciones] nombre_archivo1.ppd[.gz] [... nombre_archivoN."
+"ppd[.gz]]"
 
 msgid ""
 "Usage: ippfind [options] regtype[,subtype][.domain.] ... [expression]\n"

locale/cups_fr.po

@@ -29,7 +29,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 1.6\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-08 12:26-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2012-12-12 11:12+0100\n"
 "Last-Translator: denis meramdjougoma <dcmeram@libertysurf.fr>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -2890,6 +2890,12 @@ msgstr ""
 msgid "Created"
 msgstr "Créé"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
+msgid "Credentials have expired."
+msgstr ""
+
 msgid "Custom"
 msgstr "Personnalisation"
 
@@ -3941,6 +3947,12 @@ msgstr ""
 msgid "Never"
 msgstr "Jamais"
 
+msgid "New credentials are not valid for name."
+msgstr ""
+
+msgid "New credentials are older than stored credentials."
+msgstr ""
+
 msgid "No"
 msgstr "Non"
 
@@ -3975,6 +3987,9 @@ msgstr ""
 msgid "No authentication information provided."
 msgstr ""
 
+msgid "No common name specified."
+msgstr ""
+
 msgid "No community name"
 msgstr "Aucun nom de communauté"
 
@@ -4029,6 +4044,9 @@ msgstr ""
 msgid "No request-id"
 msgstr "Paramètre request-id absent"
 
+msgid "No stored credentials, not valid for name."
+msgstr ""
+
 msgid "No subscription attributes in request."
 msgstr ""
 
@@ -4511,6 +4529,9 @@ msgstr ""
 msgid "Self Adhesive Film"
 msgstr ""
 
+msgid "Self-signed credentials are blocked."
+msgstr ""
+
 msgid "Semi-Gloss Fabric"
 msgstr ""
 
@@ -4977,6 +4998,9 @@ msgstr ""
 msgid "Triple Wall Cardboard"
 msgstr ""
 
+msgid "Trust on first use is disabled."
+msgstr ""
+
 msgid "URI Too Long"
 msgstr "URI trop long"
 
@@ -5097,6 +5121,9 @@ msgstr ""
 msgid "Unable to copy Windows 9x printer driver files (%d)."
 msgstr ""
 
+msgid "Unable to create credentials from array."
+msgstr ""
+
 msgid "Unable to create printer-uri"
 msgstr ""
 

locale/cups_it.po

@@ -29,7 +29,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 1.6\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-08 12:26-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2013-07-14 12:00+0200\n"
 "Last-Translator: Giovanni Scafora <giovanni@archlinux.org>\n"
 "Language-Team: Arch Linux Italian Team <giovanni@archlinux.org>\n"
@@ -3160,6 +3160,12 @@ msgstr ""
 msgid "Created"
 msgstr "Creato"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
+msgid "Credentials have expired."
+msgstr ""
+
 msgid "Custom"
 msgstr "Personalizzato"
 
@@ -4227,6 +4233,12 @@ msgstr "Le classi nidificate non sono consentite."
 msgid "Never"
 msgstr "Mai"
 
+msgid "New credentials are not valid for name."
+msgstr ""
+
+msgid "New credentials are older than stored credentials."
+msgstr ""
+
 msgid "No"
 msgstr "No"
 
@@ -4261,6 +4273,9 @@ msgstr "Nessun attributo nella richiesta."
 msgid "No authentication information provided."
 msgstr "Nessuna informazione di autenticazione fornita."
 
+msgid "No common name specified."
+msgstr ""
+
 msgid "No community name"
 msgstr "Nessun nome della comunità"
 
@@ -4317,6 +4332,9 @@ msgstr ""
 msgid "No request-id"
 msgstr "Nessun request-id"
 
+msgid "No stored credentials, not valid for name."
+msgstr ""
+
 msgid "No subscription attributes in request."
 msgstr "Nessun attributo della sottoscrizione nella richiesta."
 
@@ -4801,6 +4819,9 @@ msgstr ""
 msgid "Self Adhesive Film"
 msgstr ""
 
+msgid "Self-signed credentials are blocked."
+msgstr ""
+
 msgid "Semi-Gloss Fabric"
 msgstr ""
 
@@ -5275,6 +5296,9 @@ msgstr ""
 msgid "Triple Wall Cardboard"
 msgstr ""
 
+msgid "Trust on first use is disabled."
+msgstr ""
+
 msgid "URI Too Long"
 msgstr "L'URI è troppo lungo"
 
@@ -5399,6 +5423,9 @@ msgstr "Non è possibile copiare i driver di Windows 2000 della stampante (%d)."
 msgid "Unable to copy Windows 9x printer driver files (%d)."
 msgstr "Non è possibile copiare i driver di Windows 9x della stampante (%d)."
 
+msgid "Unable to create credentials from array."
+msgstr ""
+
 msgid "Unable to create printer-uri"
 msgstr "Non è possibile creare il printer-uri"
 

locale/cups_ja.po

@@ -28,7 +28,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 2.0\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-08 12:26-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2014-11-15 19:27+0900\n"
 "Last-Translator: OPFC TRANSCUPS <opfc-transcups@sourceforge.jp>\n"
 "Language-Team: OPFC TRANSCUPS <opfc-transcups@sourceforge.jp>\n"
@@ -3119,6 +3119,12 @@ msgstr ""
 msgid "Created"
 msgstr "ジョブ作成"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
+msgid "Credentials have expired."
+msgstr ""
+
 msgid "Custom"
 msgstr "カスタム"
 
@@ -4190,6 +4196,12 @@ msgstr "入れ子になったクラスは許可されていません。"
 msgid "Never"
 msgstr "Never"
 
+msgid "New credentials are not valid for name."
+msgstr ""
+
+msgid "New credentials are older than stored credentials."
+msgstr ""
+
 msgid "No"
 msgstr "いいえ"
 
@@ -4224,6 +4236,9 @@ msgstr "リクエストに属性がありません。"
 msgid "No authentication information provided."
 msgstr "認証情報が提供されていません。"
 
+msgid "No common name specified."
+msgstr ""
+
 msgid "No community name"
 msgstr "コミュニティ名がありません"
 
@@ -4278,6 +4293,9 @@ msgstr "リクエストが送られませんでした。"
 msgid "No request-id"
 msgstr "リクエストID がありません"
 
+msgid "No stored credentials, not valid for name."
+msgstr ""
+
 msgid "No subscription attributes in request."
 msgstr "リクエストにサブスクリプション属性がありません。"
 
@@ -4762,6 +4780,9 @@ msgstr ""
 msgid "Self Adhesive Film"
 msgstr ""
 
+msgid "Self-signed credentials are blocked."
+msgstr ""
+
 msgid "Semi-Gloss Fabric"
 msgstr ""
 
@@ -5230,6 +5251,9 @@ msgstr ""
 msgid "Triple Wall Cardboard"
 msgstr ""
 
+msgid "Trust on first use is disabled."
+msgstr ""
+
 msgid "URI Too Long"
 msgstr "URI が長すぎます"
 
@@ -5352,6 +5376,9 @@ msgid "Unable to copy Windows 9x printer driver files (%d)."
 msgstr ""
 "複数の Windows 9x プリンタードライバーファイルをコピーできません (%d)。"
 
+msgid "Unable to create credentials from array."
+msgstr ""
+
 msgid "Unable to create printer-uri"
 msgstr "printer-uri を作成できません"
 

locale/cups_pt_BR.po

@@ -40,7 +40,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 2.1.2\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-08 12:26-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2016-01-31 16:45-0200\n"
 "Last-Translator: Rafael Fontenelle <rffontenelle@gmail.com>\n"
 "Language-Team: Brazilian Portuguese <traducao-cups-pt-br@googlegroups.com>\n"
@@ -3161,6 +3161,12 @@ msgstr ""
 msgid "Created"
 msgstr "Criada"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
+msgid "Credentials have expired."
+msgstr ""
+
 msgid "Custom"
 msgstr "Personalizar"
 
@@ -4227,6 +4233,12 @@ msgstr "Classes aninhadas não são permitidas."
 msgid "Never"
 msgstr "Nunca"
 
+msgid "New credentials are not valid for name."
+msgstr ""
+
+msgid "New credentials are older than stored credentials."
+msgstr ""
+
 msgid "No"
 msgstr "Não"
 
@@ -4261,6 +4273,9 @@ msgstr "Nenhum atributo na requisição."
 msgid "No authentication information provided."
 msgstr "Nenhuma informação de autenticação foi fornecida."
 
+msgid "No common name specified."
+msgstr ""
+
 msgid "No community name"
 msgstr "Nenhum nome de comunidade"
 
@@ -4317,6 +4332,9 @@ msgstr "Nenhuma requisição enviada."
 msgid "No request-id"
 msgstr "Nenhum request-id"
 
+msgid "No stored credentials, not valid for name."
+msgstr ""
+
 msgid "No subscription attributes in request."
 msgstr "Nenhum atributo de inscrição na requisição."
 
@@ -4801,6 +4819,9 @@ msgstr ""
 msgid "Self Adhesive Film"
 msgstr ""
 
+msgid "Self-signed credentials are blocked."
+msgstr ""
+
 msgid "Semi-Gloss Fabric"
 msgstr ""
 
@@ -5273,6 +5294,9 @@ msgstr ""
 msgid "Triple Wall Cardboard"
 msgstr ""
 
+msgid "Trust on first use is disabled."
+msgstr ""
+
 msgid "URI Too Long"
 msgstr "URI muito longa"
 
@@ -5401,6 +5425,9 @@ msgid "Unable to copy Windows 9x printer driver files (%d)."
 msgstr ""
 "Não foi possível copiar arquivos de driver de impressora (%d) de Windows 9x."
 
+msgid "Unable to create credentials from array."
+msgstr ""
+
 msgid "Unable to create printer-uri"
 msgstr "Não foi possível criar uri de impressora"
 

locale/cups_ru.po

@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 2.0\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-08 12:26-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2015-01-28 12:00-0800\n"
 "Last-Translator: Aleksandr Proklov\n"
 "Language-Team: PuppyRus Linux Team\n"
@@ -3093,6 +3093,12 @@ msgstr ""
 msgid "Created"
 msgstr "Создано"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
+msgid "Credentials have expired."
+msgstr ""
+
 msgid "Custom"
 msgstr "Индивидуальный"
 
@@ -4153,6 +4159,12 @@ msgstr "Вложенные группы не допускаются."
 msgid "Never"
 msgstr "Никогда"
 
+msgid "New credentials are not valid for name."
+msgstr ""
+
+msgid "New credentials are older than stored credentials."
+msgstr ""
+
 msgid "No"
 msgstr "Нет"
 
@@ -4187,6 +4199,9 @@ msgstr "Нет атрибутов в запросе."
 msgid "No authentication information provided."
 msgstr "Нет информации для проверки подлинности."
 
+msgid "No common name specified."
+msgstr ""
+
 msgid "No community name"
 msgstr "Нет имени сообщества"
 
@@ -4242,6 +4257,9 @@ msgstr "Не отправлен запрос."
 msgid "No request-id"
 msgstr "Нет идентификатора request-id"
 
+msgid "No stored credentials, not valid for name."
+msgstr ""
+
 msgid "No subscription attributes in request."
 msgstr "Нет атрибутов подписки в запросе."
 
@@ -4727,6 +4745,9 @@ msgstr ""
 msgid "Self Adhesive Film"
 msgstr ""
 
+msgid "Self-signed credentials are blocked."
+msgstr ""
+
 msgid "Semi-Gloss Fabric"
 msgstr ""
 
@@ -5191,6 +5212,9 @@ msgstr ""
 msgid "Triple Wall Cardboard"
 msgstr ""
 
+msgid "Trust on first use is disabled."
+msgstr ""
+
 msgid "URI Too Long"
 msgstr "Слишком длинный адрес URI"
 
@@ -5314,6 +5338,9 @@ msgstr "Не удается копировать файлы драйвера п
 msgid "Unable to copy Windows 9x printer driver files (%d)."
 msgstr "Не удается копировать файлы драйвера принтера Windows 9x (%d)"
 
+msgid "Unable to create credentials from array."
+msgstr ""
+
 msgid "Unable to create printer-uri"
 msgstr "Не удается создать printer-uri"
 

systemv/Dependencies

@@ -62,7 +62,7 @@ lpinfo.o: lpinfo.c ../cups/cups-private.h ../cups/string-private.h \
   ../cups/ipp.h ../cups/http.h ../cups/http-private.h ../cups/language.h \
   ../cups/md5-private.h ../cups/language-private.h ../cups/transcode.h \
   ../cups/pwg-private.h ../cups/cups.h ../cups/file.h ../cups/pwg.h \
-  ../cups/thread-private.h
+  ../cups/thread-private.h ../cups/adminutil.h
 lpmove.o: lpmove.c ../cups/cups-private.h ../cups/string-private.h \
   ../config.h ../cups/debug-private.h ../cups/versioning.h \
   ../cups/array-private.h ../cups/array.h ../cups/ipp-private.h \

xcode/CUPS.xcodeproj/project.pbxproj

@@ -13,6 +13,7 @@
 			buildPhases = (
 			);
 			dependencies = (
+				270D02281D707E5100EA9403 /* PBXTargetDependency */,
 				271287361CC1411000E517C7 /* PBXTargetDependency */,
 				2712871C1CC13FFA00E517C7 /* PBXTargetDependency */,
 				271286DC1CC13EF400E517C7 /* PBXTargetDependency */,
@@ -194,6 +195,14 @@
 		270696561CADF3E200FFE5FB /* versioning.h in Headers */ = {isa = PBXBuildFile; fileRef = 72220F0A133305BB00FCA411 /* versioning.h */; settings = {ATTRIBUTES = (); }; };
 		2706965B1CAE1A9A00FFE5FB /* util.c in Sources */ = {isa = PBXBuildFile; fileRef = 72220F09133305BB00FCA411 /* util.c */; };
 		270CCDBC135E3D3E00007BE2 /* testmime.c in Sources */ = {isa = PBXBuildFile; fileRef = 270CCDBB135E3D3E00007BE2 /* testmime.c */; };
+		270D02191D707E0200EA9403 /* libcups_static.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 72A4332F155844CF002E172D /* libcups_static.a */; };
+		270D021A1D707E0200EA9403 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 278C58E5136B64AF00836530 /* CoreFoundation.framework */; };
+		270D021B1D707E0200EA9403 /* Kerberos.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 278C58E6136B64B000836530 /* Kerberos.framework */; };
+		270D021C1D707E0200EA9403 /* libiconv.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 728FB7EF1536167A005426E1 /* libiconv.dylib */; };
+		270D021D1D707E0200EA9403 /* libresolv.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 728FB7F01536167A005426E1 /* libresolv.dylib */; };
+		270D021E1D707E0200EA9403 /* libz.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 728FB7EC1536161C005426E1 /* libz.dylib */; };
+		270D021F1D707E0200EA9403 /* Security.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 278C58E7136B64B000836530 /* Security.framework */; };
+		270D02261D707E3700EA9403 /* testcreds.c in Sources */ = {isa = PBXBuildFile; fileRef = 270D02251D707E3700EA9403 /* testcreds.c */; };
 		271284D21CC1231300E517C7 /* snmp-supplies.c in Sources */ = {isa = PBXBuildFile; fileRef = 7243790C1333E4E3009631B9 /* snmp-supplies.c */; };
 		271284D71CC124D700E517C7 /* libcupscgi_static.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 724FA76B1CC03AF60092477B /* libcupscgi_static.a */; };
 		271284D81CC124E300E517C7 /* libcupscgi_static.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 724FA76B1CC03AF60092477B /* libcupscgi_static.a */; };
@@ -901,6 +910,20 @@
 			remoteGlobalIDString = 274FF6891333B1C400317ECB;
 			remoteInfo = libcups_static;
 		};
+		270D02151D707E0200EA9403 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 72BF96371333042100B1EAD7 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 274FF6891333B1C400317ECB;
+			remoteInfo = libcups_static;
+		};
+		270D02271D707E5100EA9403 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 72BF96371333042100B1EAD7 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 270D02131D707E0200EA9403;
+			remoteInfo = testcreds;
+		};
 		271284901CC11FA500E517C7 /* PBXContainerItemProxy */ = {
 			isa = PBXContainerItemProxy;
 			containerPortal = 72BF96371333042100B1EAD7 /* Project object */;
@@ -2341,6 +2364,15 @@
 			);
 			runOnlyForDeploymentPostprocessing = 1;
 		};
+		270D02201D707E0200EA9403 /* CopyFiles */ = {
+			isa = PBXCopyFilesBuildPhase;
+			buildActionMask = 2147483647;
+			dstPath = /usr/share/man/man1/;
+			dstSubfolderSpec = 0;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 1;
+		};
 		271284E81CC1261900E517C7 /* CopyFiles */ = {
 			isa = PBXCopyFilesBuildPhase;
 			buildActionMask = 2147483647;
@@ -3115,6 +3147,8 @@
 		270B268117F5C5D600C8A3A9 /* tls-sspi.c */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.c; name = "tls-sspi.c"; path = "../cups/tls-sspi.c"; sourceTree = "<group>"; };
 		270CCDA7135E3C9E00007BE2 /* testmime */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = testmime; sourceTree = BUILT_PRODUCTS_DIR; };
 		270CCDBB135E3D3E00007BE2 /* testmime.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = testmime.c; path = ../scheduler/testmime.c; sourceTree = "<group>"; };
+		270D02241D707E0200EA9403 /* testcreds */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = testcreds; sourceTree = BUILT_PRODUCTS_DIR; };
+		270D02251D707E3700EA9403 /* testcreds.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = testcreds.c; path = ../cups/testcreds.c; sourceTree = "<group>"; };
 		271284DD1CC125FC00E517C7 /* lpc.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = lpc.c; path = ../berkeley/lpc.c; sourceTree = "<group>"; };
 		271284DE1CC125FC00E517C7 /* lpq.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = lpq.c; path = ../berkeley/lpq.c; sourceTree = "<group>"; };
 		271284DF1CC125FC00E517C7 /* lpr.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = lpr.c; path = ../berkeley/lpr.c; sourceTree = "<group>"; };
@@ -3585,6 +3619,20 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		270D02181D707E0200EA9403 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				270D02191D707E0200EA9403 /* libcups_static.a in Frameworks */,
+				270D021A1D707E0200EA9403 /* CoreFoundation.framework in Frameworks */,
+				270D021B1D707E0200EA9403 /* Kerberos.framework in Frameworks */,
+				270D021C1D707E0200EA9403 /* libiconv.dylib in Frameworks */,
+				270D021D1D707E0200EA9403 /* libresolv.dylib in Frameworks */,
+				270D021E1D707E0200EA9403 /* libz.dylib in Frameworks */,
+				270D021F1D707E0200EA9403 /* Security.framework in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		271284E61CC1261900E517C7 /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
@@ -4601,6 +4649,7 @@
 		273BF6B81333B4A90022CAAB /* tests */ = {
 			isa = PBXGroup;
 			children = (
+				270D02251D707E3700EA9403 /* testcreds.c */,
 				2712866A1CC130FF00E517C7 /* rasterbench.c */,
 				724FA65B1CC0389F0092477B /* test1284.c */,
 				727EF041192E3544001EF690 /* testadmin.c */,
@@ -4815,6 +4864,7 @@
 				271287031CC13F3F00E517C7 /* rss */,
 				271287181CC13FAB00E517C7 /* mantohtml */,
 				2712872C1CC140BE00E517C7 /* genstrings */,
+				270D02241D707E0200EA9403 /* testcreds */,
 			);
 			name = Products;
 			sourceTree = "<group>";
@@ -5428,6 +5478,24 @@
 			productReference = 270CCDA7135E3C9E00007BE2 /* testmime */;
 			productType = "com.apple.product-type.tool";
 		};
+		270D02131D707E0200EA9403 /* testcreds */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 270D02211D707E0200EA9403 /* Build configuration list for PBXNativeTarget "testcreds" */;
+			buildPhases = (
+				270D02161D707E0200EA9403 /* Sources */,
+				270D02181D707E0200EA9403 /* Frameworks */,
+				270D02201D707E0200EA9403 /* CopyFiles */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				270D02141D707E0200EA9403 /* PBXTargetDependency */,
+			);
+			name = testcreds;
+			productName = testhttp;
+			productReference = 270D02241D707E0200EA9403 /* testcreds */;
+			productType = "com.apple.product-type.tool";
+		};
 		271284E11CC1261900E517C7 /* cancel */ = {
 			isa = PBXNativeTarget;
 			buildConfigurationList = 271284E91CC1261900E517C7 /* Build configuration list for PBXNativeTarget "cancel" */;
@@ -7257,6 +7325,7 @@
 				724FA6ED1CC03A210092477B /* testcatalog */,
 				724FA6991CC039200092477B /* testcgi */,
 				724FA55D1CC037670092477B /* testconflicts */,
+				270D02131D707E0200EA9403 /* testcreds */,
 				273BF6BC1333B5000022CAAB /* testcups */,
 				2767FC4619266A0D000F61D3 /* testdest */,
 				724FA5701CC037810092477B /* testfile */,
@@ -7334,6 +7403,14 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		270D02161D707E0200EA9403 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				270D02261D707E3700EA9403 /* testcreds.c in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		271284E41CC1261900E517C7 /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -8304,6 +8381,16 @@
 			target = 274FF6891333B1C400317ECB /* libcups_static */;
 			targetProxy = 270CCDB7135E3CFD00007BE2 /* PBXContainerItemProxy */;
 		};
+		270D02141D707E0200EA9403 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 274FF6891333B1C400317ECB /* libcups_static */;
+			targetProxy = 270D02151D707E0200EA9403 /* PBXContainerItemProxy */;
+		};
+		270D02281D707E5100EA9403 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 270D02131D707E0200EA9403 /* testcreds */;
+			targetProxy = 270D02271D707E5100EA9403 /* PBXContainerItemProxy */;
+		};
 		271284911CC11FA500E517C7 /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
 			target = 274FF6891333B1C400317ECB /* libcups_static */;
@@ -9379,6 +9466,20 @@
 			};
 			name = Release;
 		};
+		270D02221D707E0200EA9403 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = "$(TARGET_NAME)";
+			};
+			name = Debug;
+		};
+		270D02231D707E0200EA9403 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = "$(TARGET_NAME)";
+			};
+			name = Release;
+		};
 		271284EA1CC1261900E517C7 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
@@ -11079,6 +11180,15 @@
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Release;
 		};
+		270D02211D707E0200EA9403 /* Build configuration list for PBXNativeTarget "testcreds" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				270D02221D707E0200EA9403 /* Debug */,
+				270D02231D707E0200EA9403 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
 		271284E91CC1261900E517C7 /* Build configuration list for PBXNativeTarget "cancel" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (