Index: NetworkManager-openvpn-0.7.1/properties/auth-helpers.c
===================================================================
--- NetworkManager-openvpn-0.7.1.orig/properties/auth-helpers.c
+++ NetworkManager-openvpn-0.7.1/properties/auth-helpers.c
@@ -138,7 +138,7 @@ tls_pw_init_auth_widget (GladeXML *xml,
                          ChangedCallback changed_cb,
                          gpointer user_data)
 {
-	GtkWidget *widget;
+	GtkWidget *widget, *ca, *cert, *key;
 	const char *value;
 	char *tmp;
 	GtkFileFilter *filter;
@@ -149,58 +149,59 @@ tls_pw_init_auth_widget (GladeXML *xml,
 	g_return_if_fail (prefix != NULL);
 
 	tmp = g_strdup_printf ("%s_ca_cert_chooser", prefix);
-	widget = glade_xml_get_widget (xml, tmp);
+	ca = glade_xml_get_widget (xml, tmp);
 	g_free (tmp);
 
-	gtk_size_group_add_widget (group, widget);
+	gtk_size_group_add_widget (group, ca);
 	filter = tls_file_chooser_filter_new ();
-	gtk_file_chooser_add_filter (GTK_FILE_CHOOSER (widget), filter);
-	gtk_file_chooser_set_local_only (GTK_FILE_CHOOSER (widget), TRUE);
-	gtk_file_chooser_button_set_title (GTK_FILE_CHOOSER_BUTTON (widget),
+
+	gtk_file_chooser_add_filter (GTK_FILE_CHOOSER (ca), filter);
+	gtk_file_chooser_set_local_only (GTK_FILE_CHOOSER (ca), TRUE);
+	gtk_file_chooser_button_set_title (GTK_FILE_CHOOSER_BUTTON (ca),
 	                                   _("Choose a Certificate Authority certificate..."));
-	g_signal_connect (G_OBJECT (widget), "selection-changed", G_CALLBACK (changed_cb), user_data);
+	g_signal_connect (G_OBJECT (ca), "selection-changed", G_CALLBACK (changed_cb), user_data);
 
 	if (s_vpn) {
 		value = nm_setting_vpn_get_data_item (s_vpn, NM_OPENVPN_KEY_CA);
 		if (value && strlen (value))
-			gtk_file_chooser_set_filename (GTK_FILE_CHOOSER (widget), value);
+			gtk_file_chooser_set_filename (GTK_FILE_CHOOSER (ca), value);
 	}
 
 	if (!strcmp (contype, NM_OPENVPN_CONTYPE_TLS) || !strcmp (contype, NM_OPENVPN_CONTYPE_PASSWORD_TLS)) {
 		tmp = g_strdup_printf ("%s_user_cert_chooser", prefix);
-		widget = glade_xml_get_widget (xml, tmp);
+		cert = glade_xml_get_widget (xml, tmp);
 		g_free (tmp);
 
-		gtk_size_group_add_widget (group, widget);
+		gtk_size_group_add_widget (group, cert);
 		filter = tls_file_chooser_filter_new ();
-		gtk_file_chooser_add_filter (GTK_FILE_CHOOSER (widget), filter);
-		gtk_file_chooser_set_local_only (GTK_FILE_CHOOSER (widget), TRUE);
-		gtk_file_chooser_button_set_title (GTK_FILE_CHOOSER_BUTTON (widget),
+		gtk_file_chooser_add_filter (GTK_FILE_CHOOSER (cert), filter);
+		gtk_file_chooser_set_local_only (GTK_FILE_CHOOSER (cert), TRUE);
+		gtk_file_chooser_button_set_title (GTK_FILE_CHOOSER_BUTTON (cert),
 		                                   _("Choose your personal certificate..."));
-		g_signal_connect (G_OBJECT (widget), "selection-changed", G_CALLBACK (changed_cb), user_data);
+		g_signal_connect (G_OBJECT (cert), "selection-changed", G_CALLBACK (changed_cb), user_data);
 
 		if (s_vpn) {
 			value = nm_setting_vpn_get_data_item (s_vpn, NM_OPENVPN_KEY_CERT);
 			if (value && strlen (value))
-				gtk_file_chooser_set_filename (GTK_FILE_CHOOSER (widget), value);
+				gtk_file_chooser_set_filename (GTK_FILE_CHOOSER (cert), value);
 		}
 
 		tmp = g_strdup_printf ("%s_private_key_chooser", prefix);
-		widget = glade_xml_get_widget (xml, tmp);
+		key = glade_xml_get_widget (xml, tmp);
 		g_free (tmp);
 
-		gtk_size_group_add_widget (group, widget);
+		gtk_size_group_add_widget (group, key);
 		filter = tls_file_chooser_filter_new ();
-		gtk_file_chooser_add_filter (GTK_FILE_CHOOSER (widget), filter);
-		gtk_file_chooser_set_local_only (GTK_FILE_CHOOSER (widget), TRUE);
-		gtk_file_chooser_button_set_title (GTK_FILE_CHOOSER_BUTTON (widget),
+		gtk_file_chooser_add_filter (GTK_FILE_CHOOSER (key), filter);
+		gtk_file_chooser_set_local_only (GTK_FILE_CHOOSER (key), TRUE);
+		gtk_file_chooser_button_set_title (GTK_FILE_CHOOSER_BUTTON (key),
 		                                   _("Choose your private key..."));
-		g_signal_connect (G_OBJECT (widget), "selection-changed", G_CALLBACK (changed_cb), user_data);
+		g_signal_connect (G_OBJECT (key), "selection-changed", G_CALLBACK (changed_cb), user_data);
 
 		if (s_vpn) {
 			value = nm_setting_vpn_get_data_item (s_vpn, NM_OPENVPN_KEY_KEY);
 			if (value && strlen (value))
-				gtk_file_chooser_set_filename (GTK_FILE_CHOOSER (widget), value);
+				gtk_file_chooser_set_filename (GTK_FILE_CHOOSER (key), value);
 		}
 	}
 
@@ -317,19 +318,23 @@ validate_file_chooser (GladeXML *xml, co
 {
 	GtkWidget *widget;
 	char *str;
+	gboolean valid = FALSE;
 
 	widget = glade_xml_get_widget (xml, name);
 	str = gtk_file_chooser_get_filename (GTK_FILE_CHOOSER (widget));
-	if (!str || !strlen (str))
-		return FALSE;
-	return TRUE;
+	if (str && strlen (str))
+		valid = TRUE;
+	g_free (str);
+	return valid;
 }
 
 static gboolean
 validate_tls (GladeXML *xml, const char *prefix, GError **error)
 {
 	char *tmp;
-	gboolean valid;
+	gboolean valid, encrypted = FALSE;
+	GtkWidget *widget;
+	char *str;
 
 	tmp = g_strdup_printf ("%s_ca_cert_chooser", prefix);
 	valid = validate_file_chooser (xml, tmp);
@@ -354,6 +359,7 @@ validate_tls (GladeXML *xml, const char
 	}
 
 	tmp = g_strdup_printf ("%s_private_key_chooser", prefix);
+	widget = glade_xml_get_widget (xml, tmp);
 	valid = validate_file_chooser (xml, tmp);
 	g_free (tmp);
 	if (!valid) {
@@ -364,6 +370,24 @@ validate_tls (GladeXML *xml, const char
 		return FALSE;
 	}
 
+	/* Encrypted certificates require a password */
+	str = gtk_file_chooser_get_filename (GTK_FILE_CHOOSER (widget));
+	encrypted = is_encrypted (str);
+	g_free (str);
+	if (encrypted) {
+		tmp = g_strdup_printf ("%s_private_key_password_entry", prefix);
+		widget = glade_xml_get_widget (xml, tmp);
+		g_free (tmp);
+
+		if (!gtk_entry_get_text_length (GTK_ENTRY (widget))) {
+			g_set_error (error,
+			             OPENVPN_PLUGIN_UI_ERROR,
+			             OPENVPN_PLUGIN_UI_ERROR_INVALID_PROPERTY,
+			             NM_OPENVPN_KEY_CERTPASS);
+			return FALSE;
+		}
+	}
+
 	return TRUE;
 }
 
@@ -461,12 +485,8 @@ update_from_filechooser (GladeXML *xml,
 	g_free (tmp);
 
 	filename = gtk_file_chooser_get_filename (GTK_FILE_CHOOSER (widget));
-	if (!filename)
-		return;
-
-	if (strlen (filename))
+	if (filename && strlen (filename))
 		nm_setting_vpn_add_data_item (s_vpn, key, filename);
-	
 	g_free (filename);
 }
 
@@ -613,7 +633,7 @@ find_tag (const char *tag, const char *b
 	if (len < taglen)
 		return NULL;
 
-	for (i = 0; i < len - taglen; i++) {
+	for (i = 0; i < len - taglen + 1; i++) {
 		if (memcmp (buf + i, tag, taglen) == 0)
 			return buf + i;
 	}
@@ -622,7 +642,9 @@ find_tag (const char *tag, const char *b
 
 static const char *pem_rsa_key_begin = "-----BEGIN RSA PRIVATE KEY-----";
 static const char *pem_dsa_key_begin = "-----BEGIN DSA PRIVATE KEY-----";
+static const char *pem_pkcs8_key_begin = "-----BEGIN ENCRYPTED PRIVATE KEY-----";
 static const char *pem_cert_begin = "-----BEGIN CERTIFICATE-----";
+static const char *pem_unenc_key_begin = "-----BEGIN PRIVATE KEY-----";
 
 static gboolean
 tls_default_filter (const GtkFileFilterInfo *filter_info, gpointer data)
@@ -642,6 +664,7 @@ tls_default_filter (const GtkFileFilterI
 	ext = g_ascii_strdown (p, -1);
 	if (!ext)
 		return FALSE;
+
 	if (strcmp (ext, ".pem") && strcmp (ext, ".crt") && strcmp (ext, ".key") && strcmp (ext, ".cer")) {
 		g_free (ext);
 		return FALSE;
@@ -675,6 +698,16 @@ tls_default_filter (const GtkFileFilterI
 		show = TRUE;
 		goto out;
 	}
+
+	if (find_tag (pem_pkcs8_key_begin, (const char *) contents, bytes_read)) {
+		show = TRUE;
+		goto out;
+	}
+
+	if (find_tag (pem_unenc_key_begin, (const char *) contents, bytes_read)) {
+		show = TRUE;
+		goto out;
+	}
 
 out:
 	g_free (contents);
Index: NetworkManager-openvpn-0.7.1/common/Makefile.am
===================================================================
--- /dev/null
+++ NetworkManager-openvpn-0.7.1/common/Makefile.am
@@ -0,0 +1,14 @@
+noinst_LTLIBRARIES=libnm-openvpn-common.la
+
+libnm_openvpn_common_la_CPPFLAGS = \
+	$(NETWORK_MANAGER_CFLAGS) \
+	-DG_DISABLE_DEPRECATED \
+        -I$(top_srcdir)/src/
+
+libnm_openvpn_common_la_SOURCES= \
+	utils.c \
+	utils.h
+
+libnm_openvpn_common_la_LIBADD = \
+	$(NETWORK_MANAGER_LIBS)
+
Index: NetworkManager-openvpn-0.7.1/common/utils.c
===================================================================
--- /dev/null
+++ NetworkManager-openvpn-0.7.1/common/utils.c
@@ -0,0 +1,60 @@
+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
+/*
+ * Dan Williams <dcbw@redhat.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * (C) Copyright 2010 Red Hat, Inc.
+ */
+
+#include <string.h>
+#include "utils.h"
+
+#define PROC_TYPE_TAG "Proc-Type: 4,ENCRYPTED"
+#define PKCS8_TAG "-----BEGIN ENCRYPTED PRIVATE KEY-----"
+
+/** Checks if a file appears to be an encrypted private key.
+ * @param filename the path to the file
+ * @return returns true if the key is encrypted, false otherwise
+ */
+gboolean
+is_encrypted (const char *filename)
+{
+	GIOChannel *pem_chan;
+	char *str = NULL;
+	gboolean encrypted = FALSE;
+
+	if (!filename || !strlen (filename))
+		return FALSE;
+
+	pem_chan = g_io_channel_new_file (filename, "r", NULL);
+	if (!pem_chan)
+		return FALSE;
+
+	while (g_io_channel_read_line (pem_chan, &str, NULL, NULL, NULL) != G_IO_STATUS_EOF) {
+		if (str) {
+			if (g_str_has_prefix (str, PROC_TYPE_TAG) || g_str_has_prefix (str, PKCS8_TAG)) {
+				encrypted = TRUE;
+				break;
+			}
+			g_free (str);
+		}
+	}
+
+	g_io_channel_shutdown (pem_chan, FALSE, NULL);
+	g_io_channel_unref (pem_chan);
+	return encrypted;
+}
+
Index: NetworkManager-openvpn-0.7.1/common/utils.h
===================================================================
--- /dev/null
+++ NetworkManager-openvpn-0.7.1/common/utils.h
@@ -0,0 +1,30 @@
+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
+/*
+ * Dan Williams <dcbw@redhat.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * (C) Copyright 2010 Red Hat, Inc.
+ */
+
+#ifndef UTILS_H
+#define UTILS_H
+
+#include <glib.h>
+
+gboolean is_encrypted (const char *filename);
+
+#endif  /* UTILS_H */
+
Index: NetworkManager-openvpn-0.7.1/Makefile.am
===================================================================
--- NetworkManager-openvpn-0.7.1.orig/Makefile.am
+++ NetworkManager-openvpn-0.7.1/Makefile.am
@@ -1,9 +1,9 @@
 AUTOMAKE_OPTIONS = foreign
 
+SUBDIRS = common src
+
 if WITH_GNOME
-SUBDIRS = src common-gnome auth-dialog properties po
-else
-SUBDIRS = src
+SUBDIRS += common-gnome auth-dialog properties po
 endif
 
 dbusservicedir = $(sysconfdir)/dbus-1/system.d
Index: NetworkManager-openvpn-0.7.1/properties/nm-openvpn.c
===================================================================
--- NetworkManager-openvpn-0.7.1.orig/properties/nm-openvpn.c
+++ NetworkManager-openvpn-0.7.1/properties/nm-openvpn.c
@@ -395,6 +395,7 @@ hash_copy_advanced (gpointer key, gpoint
 	NMSettingVPN *s_vpn = NM_SETTING_VPN (user_data);
 	const char *value = (const char *) data;
 
+	g_return_if_fail (value && strlen (value));
 	nm_setting_vpn_add_data_item (s_vpn, (const char *) key, value);
 }
 
@@ -605,7 +606,10 @@ import (NMVpnPluginUiInterface *iface, c
 		goto out;
 	}
 
-	if (strcmp (ext, ".ovpn") && strcmp (ext, ".conf") && strcmp (ext, ".cnf")) {
+	if (   strcmp (ext, ".ovpn")
+	    && strcmp (ext, ".conf")
+	    && strcmp (ext, ".cnf")
+	    && strcmp (ext, ".ovpntest")) {   /* Special extension for testcases */
 		g_set_error (error,
 		             OPENVPN_PLUGIN_UI_ERROR,
 		             OPENVPN_PLUGIN_UI_ERROR_FILE_NOT_OPENVPN,
@@ -616,6 +620,22 @@ import (NMVpnPluginUiInterface *iface, c
 	if (!g_file_get_contents (path, &contents, NULL, error))
 		return NULL;
 
+	if (!g_utf8_validate (contents, -1, NULL)) {
+		char *tmp;
+		GError *conv_error = NULL;
+
+		tmp = g_locale_to_utf8 (contents, -1, NULL, NULL, &conv_error);
+		if (conv_error) {
+			/* ignore the error, we tried at least. */
+			g_error_free (conv_error);
+			g_free (tmp);
+		} else {
+			g_assert (tmp);
+			g_free (contents);
+			contents = tmp;  /* update contents with the UTF-8 safe text */
+		}
+	}
+
 	lines = g_strsplit_set (contents, "\r\n", 0);
 	if (g_strv_length (lines) <= 1) {
 		g_set_error (error,
Index: NetworkManager-openvpn-0.7.1/properties/Makefile.am
===================================================================
--- NetworkManager-openvpn-0.7.1.orig/properties/Makefile.am
+++ NetworkManager-openvpn-0.7.1/properties/Makefile.am
@@ -34,7 +34,8 @@ libnm_openvpn_properties_la_LIBADD =
         $(GCONF_LIBS)                   \
         $(LIBGNOMEUI_LIBS)              \
         $(NETWORK_MANAGER_LIBS)         \
-        $(top_builddir)/common-gnome/libnm-openvpn-common-gnome.la
+        $(top_builddir)/common-gnome/libnm-openvpn-common-gnome.la \
+        $(top_builddir)/common/libnm-openvpn-common.la
 
 CLEANFILES = *.bak *.gladep *~
 
Index: NetworkManager-openvpn-0.7.1/configure.in
===================================================================
--- NetworkManager-openvpn-0.7.1.orig/configure.in
+++ NetworkManager-openvpn-0.7.1/configure.in
@@ -118,6 +118,7 @@ fi
 AC_OUTPUT([
 Makefile
 src/Makefile
+common/Makefile
 common-gnome/Makefile
 auth-dialog/Makefile
 properties/Makefile
Index: NetworkManager-openvpn-0.7.1/src/nm-openvpn-service.c
===================================================================
--- NetworkManager-openvpn-0.7.1.orig/src/nm-openvpn-service.c
+++ NetworkManager-openvpn-0.7.1/src/nm-openvpn-service.c
@@ -52,6 +52,7 @@
 
 #include "nm-openvpn-service.h"
 #include "nm-utils.h"
+#include "common/utils.h"
 
 #define NM_OPENVPN_HELPER_PATH		LIBEXECDIR"/nm-openvpn-service-openvpn-helper"
 
@@ -212,7 +213,8 @@ validate_one_property (const char *key,
 static gboolean
 nm_openvpn_properties_validate (NMSettingVPN *s_vpn, GError **error)
 {
-	ValidateInfo info = { &valid_properties[0], error, FALSE };
+	GError *validate_error = NULL;
+	ValidateInfo info = { &valid_properties[0], &validate_error, FALSE };
 
 	nm_setting_vpn_foreach_data_item (s_vpn, validate_one_property, &info);
 	if (!info.have_items) {
@@ -224,13 +226,18 @@ nm_openvpn_properties_validate (NMSettin
 		return FALSE;
 	}
 
-	return *error ? FALSE : TRUE;
+	if (validate_error) {
+		*error = validate_error;
+		return FALSE;
+	}
+	return TRUE;
 }
 
 static gboolean
 nm_openvpn_secrets_validate (NMSettingVPN *s_vpn, GError **error)
 {
-	ValidateInfo info = { &valid_secrets[0], error, FALSE };
+	GError *validate_error = NULL;
+	ValidateInfo info = { &valid_secrets[0], &validate_error, FALSE };
 
 	nm_setting_vpn_foreach_secret (s_vpn, validate_one_property, &info);
 	if (!info.have_items) {
@@ -242,7 +249,11 @@ nm_openvpn_secrets_validate (NMSettingVP
 		return FALSE;
 	}
 
-	return *error ? FALSE : TRUE;
+	if (validate_error) {
+		*error = validate_error;
+		return FALSE;
+	}
+	return TRUE;
 }
 
 static void
@@ -915,6 +926,49 @@ nm_openvpn_start_openvpn_binary (NMOpenv
 	return TRUE;
 }
 
+static const char *
+check_need_secrets (NMSettingVPN *s_vpn, gboolean *need_secrets)
+{
+	const char *tmp, *key, *ctype;
+
+	g_return_val_if_fail (s_vpn != NULL, FALSE);
+	g_return_val_if_fail (need_secrets != NULL, FALSE);
+
+	*need_secrets = FALSE;
+
+	tmp = nm_setting_vpn_get_data_item (s_vpn, NM_OPENVPN_KEY_CONNECTION_TYPE);
+	ctype = validate_connection_type (tmp);
+	if (!ctype)
+		return NULL;
+
+	if (!strcmp (ctype, NM_OPENVPN_CONTYPE_PASSWORD_TLS)) {
+		/* Will require a password and maybe private key password */
+		key = nm_setting_vpn_get_data_item (s_vpn, NM_OPENVPN_KEY_KEY);
+		g_debug ("check_need_secrets(key=%s).", key);
+		if (is_encrypted (key) && !nm_setting_vpn_get_secret (s_vpn, NM_OPENVPN_KEY_CERTPASS)) {
+			g_debug ("key is encrypted.");
+			*need_secrets = TRUE;
+		}
+
+		if (!nm_setting_vpn_get_secret (s_vpn, NM_OPENVPN_KEY_PASSWORD)) {
+			g_debug ("No password key");
+			*need_secrets = TRUE;
+		}
+	} else if (!strcmp (ctype, NM_OPENVPN_CONTYPE_PASSWORD)) {
+		/* Will require a password */
+		if (!nm_setting_vpn_get_secret (s_vpn, NM_OPENVPN_KEY_PASSWORD))
+			*need_secrets = TRUE;
+	} else if (!strcmp (ctype, NM_OPENVPN_CONTYPE_TLS)) {
+		/* May require private key password */
+		key = nm_setting_vpn_get_data_item (s_vpn, NM_OPENVPN_KEY_KEY);
+		if (is_encrypted (key) && !nm_setting_vpn_get_secret (s_vpn, NM_OPENVPN_KEY_CERTPASS))
+			*need_secrets = TRUE;
+	} else {
+		/* Static key doesn't need passwords */
+	}
+
+	return ctype;
+}
 static gboolean
 real_connect (NMVPNPlugin   *plugin,
               NMConnection  *connection,
@@ -923,7 +977,7 @@ real_connect (NMVPNPlugin   *plugin,
 	NMSettingVPN *s_vpn;
 	const char *connection_type;
 	const char *user_name;
-	const char *tmp;
+	gboolean need_secrets;
 
 	s_vpn = NM_SETTING_VPN (nm_connection_get_setting (connection, NM_TYPE_SETTING_VPN));
 	if (!s_vpn) {
@@ -935,11 +989,8 @@ real_connect (NMVPNPlugin   *plugin,
 		return FALSE;
 	}
 
-	user_name = nm_setting_vpn_get_user_name (s_vpn);
-	tmp = nm_setting_vpn_get_data_item (s_vpn, NM_OPENVPN_KEY_CONNECTION_TYPE);
-	
-	connection_type = validate_connection_type (tmp);
-	
+	/* Check if we need secrets and validate the connection type */
+	connection_type = check_need_secrets (s_vpn, &need_secrets);
 	if (!connection_type) {
 		g_set_error (error,
 		             NM_VPN_PLUGIN_ERROR,
@@ -947,7 +998,9 @@ real_connect (NMVPNPlugin   *plugin,
 		             "%s",
 		             "Invalid connection type.");
 		return FALSE;
-	}	
+	}
+
+	user_name = nm_setting_vpn_get_user_name (s_vpn);
 
 	/* Need a username for any password-based connection types */
 	if (   !strcmp (connection_type, NM_OPENVPN_CONTYPE_PASSWORD_TLS)
@@ -966,8 +1019,8 @@ real_connect (NMVPNPlugin   *plugin,
 	if (!nm_openvpn_properties_validate (s_vpn, error))
 		return FALSE;
 
-	/* Static Key doesn't need secrets; the rest do */
-	if (strcmp (connection_type, NM_OPENVPN_CONTYPE_STATIC_KEY)) {
+	/* Validate secrets */
+	if (need_secrets) {
 		if (!nm_openvpn_secrets_validate (s_vpn, error))
 			return FALSE;
 	}
@@ -988,7 +1041,6 @@ real_need_secrets (NMVPNPlugin *plugin,
 	NMSettingVPN *s_vpn;
 	const char *connection_type;
 	gboolean need_secrets = FALSE;
-	const char *tmp;
 
 	g_return_val_if_fail (NM_IS_VPN_PLUGIN (plugin), FALSE);
 	g_return_val_if_fail (NM_IS_CONNECTION (connection), FALSE);
@@ -1003,9 +1055,7 @@ real_need_secrets (NMVPNPlugin *plugin,
 		return FALSE;
 	}
 
-	tmp = nm_setting_vpn_get_data_item (s_vpn, NM_OPENVPN_KEY_CONNECTION_TYPE);
-	connection_type = validate_connection_type (tmp);
-	
+	connection_type = check_need_secrets (s_vpn, &need_secrets);
 	if (!connection_type) {
 		g_set_error (error,
 		             NM_VPN_PLUGIN_ERROR,
@@ -1015,23 +1065,6 @@ real_need_secrets (NMVPNPlugin *plugin,
 		return FALSE;
 	}
 
-	if (!strcmp (connection_type, NM_OPENVPN_CONTYPE_PASSWORD_TLS)) {
-		/* Will require a password and maybe private key password */
-		if (!nm_setting_vpn_get_secret (s_vpn, NM_OPENVPN_KEY_CERTPASS))
-			need_secrets = TRUE;
-
-		if (!nm_setting_vpn_get_secret (s_vpn, NM_OPENVPN_KEY_PASSWORD))
-			need_secrets = TRUE;
-	} else if (!strcmp (connection_type, NM_OPENVPN_CONTYPE_PASSWORD)) {
-		/* Will require a password */
-		if (!nm_setting_vpn_get_secret (s_vpn, NM_OPENVPN_KEY_PASSWORD))
-			need_secrets = TRUE;
-	} else if (!strcmp (connection_type, NM_OPENVPN_CONTYPE_TLS)) {
-		/* May require private key password */
-		if (!nm_setting_vpn_get_secret (s_vpn, NM_OPENVPN_KEY_CERTPASS))
-			need_secrets = TRUE;
-	}
-
 	if (need_secrets)
 		*setting_name = NM_SETTING_VPN_SETTING_NAME;
 
Index: NetworkManager-openvpn-0.7.1/src/Makefile.am
===================================================================
--- NetworkManager-openvpn-0.7.1.orig/src/Makefile.am
+++ NetworkManager-openvpn-0.7.1/src/Makefile.am
@@ -19,7 +19,8 @@ nm_openvpn_service_SOURCES =				\
 				nm-openvpn-service.h
 
 
-nm_openvpn_service_LDADD = $(NETWORK_MANAGER_LIBS) -lnm_glib_vpn
+nm_openvpn_service_LDADD = $(NETWORK_MANAGER_LIBS) -lnm_glib_vpn \
+        $(top_builddir)/common/libnm-openvpn-common.la
 
 
 nm_openvpn_service_openvpn_helper_SOURCES = 					\
Index: NetworkManager-openvpn-0.7.1/auth-dialog/Makefile.am
===================================================================
--- NetworkManager-openvpn-0.7.1.orig/auth-dialog/Makefile.am
+++ NetworkManager-openvpn-0.7.1/auth-dialog/Makefile.am
@@ -28,6 +28,7 @@ nm_openvpn_auth_dialog_LDADD =			\
 	$(GTK_LIBS)				\
 	$(GCONF_LIBS)				\
 	$(top_builddir)/common-gnome/libnm-openvpn-common-gnome.la \
+	$(top_builddir)/common/libnm-openvpn-common.la \
 	$(NULL)
 
 CLEANFILES = *~
Index: NetworkManager-openvpn-0.7.1/auth-dialog/main.c
===================================================================
--- NetworkManager-openvpn-0.7.1.orig/auth-dialog/main.c
+++ NetworkManager-openvpn-0.7.1/auth-dialog/main.c
@@ -36,6 +36,7 @@
 #include <nm-setting-connection.h>
 
 #include "common-gnome/keyring-helpers.h"
+#include "common/utils.h"
 #include "src/nm-openvpn-service.h"
 #include "gnome-two-password-dialog.h"
 
@@ -50,40 +51,6 @@ typedef struct {
 	char *certpass;
 } PasswordsInfo;
 
-#define PROC_TYPE_TAG "Proc-Type: 4,ENCRYPTED"
-
-/** Checks if a key is encrypted
- * The key file is read and it is checked if it contains a line reading
- * Proc-Type: 4,ENCRYPTED
- * This is defined in RFC 1421 (PEM)
- * @param filename the path to the file
- * @return returns true if the key is encrypted, false otherwise
- */
-static gboolean
-pem_is_encrypted (const char *filename)
-{
-	GIOChannel *pem_chan;
-	char       *str = NULL;
-	gboolean encrypted = FALSE;
-
-	pem_chan = g_io_channel_new_file (filename, "r", NULL);
-	if (!pem_chan)
-		return FALSE;
-
-	while (g_io_channel_read_line (pem_chan, &str, NULL, NULL, NULL) != G_IO_STATUS_EOF) {
-		if (strncmp (str, PROC_TYPE_TAG, strlen (PROC_TYPE_TAG)) == 0) {
-			encrypted = TRUE;
-			break;
-		}
-		g_free (str);
-	}
-
-	g_io_channel_shutdown (pem_chan, FALSE, NULL);
-	g_io_channel_unref (pem_chan);
-	return encrypted;
-}
-
-
 static void
 clear_secrets (PasswordsInfo *info)
 {
@@ -289,8 +256,7 @@ get_password_types (PasswordsInfo *info)
 		key = g_strdup_printf ("%s/%s/%s", connection_path, NM_SETTING_VPN_SETTING_NAME,
 		                       NM_OPENVPN_KEY_KEY);
 		str = gconf_client_get_string (gconf_client, key, NULL);
-		if (str)
-			info->need_certpass = pem_is_encrypted (str);
+		info->need_certpass = is_encrypted (str);
 		g_free (str);
 		g_free (key);
 	} else if (!strcmp (connection_type, NM_OPENVPN_CONTYPE_STATIC_KEY)) {
