I have closed T4699 as a duplicate of this, even though T4699 was about simplification but IMO this is the same underlying problem.

My wish would be to unify this more with the OpenPGP dialog. Only ask about Name and Mail and extend the OpenPGP dialog to accept more then one mail Adress similar to the S/MIME dialog. All other things for the CN should be hidden by default.

Notes for testing (and maybe documentation update):

• A few features (?) of the old CSR creation have been removed:
  • The different choices offered after CSR creation (e.g. save to file, send to CA, create signing/encryption CSR with same settings, etc.) have been removed; now a file save dialog pops up when the CSR has been generated
  • Custom labels for the RSA key sizes ([CertificateCreationWizard]RSAKeySizeLabels); we use GnuPG's algorithm IDs as labels (items in the drop down box)
  • Custom key type ([CertificateCreationWizard]CMSKeyType); CSR creation supported (and still supports) only RSA as "key type"; by marking the config key as immutable one could force the creation of signing+encryption CSRs which makes little sense for S/MIME and might have been "copied" from OpenPGP key creation where forcing the generation of keys for signing & encryption does make some sense.
  • Specification of the CA's email address ([CertificateCreationWizard]CAEmailAddress); the generated CSRs are now always written to disk; the users will have to create an email themselves

The following customization is still available/supported via config entries in the [CertificateCreationWizard] group:

• RSAKeySizes: the allowed RSA key sizes; only 2048, 3072, and 4096 are supported; defaults to the compliant RSA algorithms; the default RSA key size can be specified by listing the negative size (e.g. -4096); defaults to the built-in default of gpgsm (currently, RSA 3072)
• DNAttributeOrder: the DN attributes that shall be offered when creating a CSR; defaults to L,OU,O,C; attributes can be flagged as required by appending a ! to their name; CN! and EMAIL! are implicitly included and always listed first; in particular, CN and EMAIL are required by default; check the DN-Attribute Order configuration in the settings dialog for other supported attributes (but note that the DN-Attribute Order configuration is only used when displaying DNs)
• For all attributes the following config entries are supported (where ATTR is the name of the attribute):
  • ATTR: The default value to use for the attribute; if flagged as immutable then the user cannot change the value
  • ATTR_label: The label to display in the CSR creation dialog
  • ATTR_hint (or ATTR_placeholder): A hint to display in the CSR creation dialog, e.g. if a certain format is required
  • ATTR_regex: A regular expression to enforce values matching the regular expression

Looks good to me on gpg4win-5.0.0-beta369 @ win10

• initial form is reduced
• order of advanced fields is correct
• last 3 input fields are simple
• dn is not shown
• file save dialog pops up after creation

Generated requests:

• Only required fields (name, email)

Certificate Request:
    Data:
        Version: 1 (0x0)
        Subject: CN=csr test
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Modulus:
                    [...]
                Exponent: 65537 (0x10001)
        Attributes:
            Requested Extensions:
                X509v3 Subject Alternative Name:
                    email:test.csr@gnupg.test
                X509v3 Key Usage: critical
                    Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        [...]

• All fields (signing only, rsa4096)

Certificate Request:
    Data:
        Version: 1 (0x0)
        Subject: C=COUNTRY CODE, O=ORGANIZATION, OU=ORGANIZATIONAL UNIT, L=LOCATION, CN=csr all fields
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    [...]
                Exponent: 65537 (0x10001)
        Attributes:
            Requested Extensions:
                X509v3 Subject Alternative Name:
                    URI:http://gnupg.test, URI:http://gpg.test, DNS:gnupg.test, DNS:gpg.test, email:allfields.csr@gnupg.test, email:add1.allfields.csr@gnupg.test, email:add2.allfields.csr@gnupg.test, email:add3.allfields.csr@gnupg.test
                X509v3 Key Usage: critical
                    Key Encipherment, Data Encipherment
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        [...]

Also the kleopatrarc settings seems to work, e.g.

[CertificateCreationWizard]
RSAKeySizes=2048,4096
DNAttributeOrder=C,L,O!,OU!

CN=CN
CN_label=CN_label
CN_hint=CN_hint
CN_regex=CN_*

EMAIL=EMAIL
EMAIL_label=EMAIL_label
EMAIL_hint=EMAIL_hint
EMAIL_regex=EMAIL_*

OU[$i]=OU
OU_label=OU_label
OU_hint=OU_hint
OU_regex=OU_*

O[$i]=O
O_label=O_label
O_hint=O_hint
O_regex=O_*

L[$i]=L
L_label=L_label
L_hint=L_hint
L_regex=L_*

C[$i]=C
C_label=C_label
C_hint=C_hint
C_regex=C_*

[CertificateCreationWizard]
DNAttributeOrder=FAX!
FAX=FAX
FAX_label=FAX_label
FAX_hint=FAX_hint
FAX_regex=FAX_*

Notes (probably as intended):

• [$i]mmutable does not work for CN or EMAIL
• _X_ does not work as ATTR

In T6117#205277, @timegrid wrote:

• All fields (signing only, rsa4096)

Certificate Request:

[...]

X509v3 Key Usage: critical
    Key Encipherment, Data Encipherment

I guess this is a typo because the CSR looks like an encryption-only certificate.

In T6117#205277, @timegrid wrote:

Notes (probably as intended):

• [$i]mmutable does not work for CN or EMAIL

Yes. I don't think it makes much sense for an organization to force a fixed CN or EMAIL for the CSRs of a user.

• _X_ does not work as ATTR

Yes. _X_ is the placeholder/wildcard used for unknown attributes when displaying S/MIME certificates.

I found and fixed a bug (likely a regression in the new code): When CN_prefill or EMAIL_prefill is configured as true and no fixed CN or EMAIL is configured then Kleopatra should prefill Name and Email with values taken from CONFIGDIR/emaildefaults (used by KDE apps on Linux), from the Windows user or from the EMAIL environment variable. This didn't work anymore.

In T6117#205379, @ikloecker wrote:

I guess this is a typo because the CSR looks like an encryption-only certificate.

Right, sorry, this works as expected:

Sign only:

X509v3 Key Usage: critical
    Digital Signature, Non Repudiation

Encrypt only:

X509v3 Key Usage: critical
    Key Encipherment, Data Encipherment