Problem - Kevin Tafuro

validity of the certificate. If the certificate is valid, the return value will be 1; otherwise,
the return value will be 0.
#include
int spc_verify_cert(X509 *cert, spc_x509store_t *spc_store) {
int result = -1;
X509_STORE *store = 0;
X509_STORE_CTX *ctx = 0;
if (!(store = spc_create_x509store(spc_store))) return -1;
if ((ctx = X509_STORE_CTX_new( )) != 0) {
if (X509_STORE_CTX_init(ctx, store, cert, 0) = = 1)
result = (X509_verify_cert(ctx) = = 1);
X509_STORE_CTX_free(ctx);
}
X509_STORE_free(store);
return result;
}
See Also
Recipes 7.17, 10.7
10.6 Performing X.509 Certificate Verification
with CryptoAPI
Problem
You have an X.509 certificate, and you want to verify its validity using Microsoft’s
CryptoAPI on Windows.
Solution
CryptoAPI represents an X.509 certificate using a CERT_CONTEXT object. Another
object, referenced by a HCERTSTORE handle, must be created to hold the certificates
that will be required for verification, as well as any certificate revocation lists (CRLs)
that may be necessary. The actual certificate verification is performed by calling the
CertGetIssuerCertificateFromStore( ) function for each certificate in the hierarchy.
This function will verify the signature, certificate validity times, and revocation status
of each certificate as it obtains the issuer for each call. The last certificate in the
hierarchy will have no issuing certificate and should be self-signed.
Discussion
Call the CertGetIssuerCertificateFromStore( ) function for each certificate in the
hierarchy, beginning with the subject certificate at the end of the chain. Each time
530 | Chapter 10: Public Key Infrastructure
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.