Problem - Kevin Tafuro

CertGetIssuerCertificateFromStore( ) is called, CryptoAPI will attempt to locate the
issuer of the subject certificate passed into it. If the issuer certificate is found, the signature
of the subject certificate will be verified with the public key of the issuer certificate.
In addition, time validity checks will be performed on the subject certificate,
and the subject certificate will be compared against the issuer’s CRLif it is present in
the store.
#include
#include
BOOL SpcVerifyCert(HCERTSTORE hCertStore, PCCERT_CONTEXT pSubjectContext) {
DWORD dwFlags;
PCCERT_CONTEXT pIssuerContext;
if (!(pSubjectContext = CertDuplicateCertificateContext(pSubjectContext)))
return FALSE;
do {
dwFlags = CERT_STORE_REVOCATION_FLAG | CERT_STORE_SIGNATURE_FLAG |
CERT_STORE_TIME_VALIDITY_FLAG;
pIssuerContext = CertGetIssuerCertificateFromStore(hCertStore,
pSubjectContext, 0, &dwFlags);
CertFreeCertificateContext(pSubjectContext);
if (pIssuerContext) {
pSubjectContext = pIssuerContext;
if (dwFlags & CERT_STORE_NO_CRL_FLAG)
dwFlags &= ~(CERT_STORE_NO_CRL_FLAG | CERT_STORE_REVOCATION_FLAG);
if (dwFlags) break;
} else if (GetLastError( ) = = CRYPT_E_SELF_SIGNED) return TRUE;
} while (pIssuerContext);
return FALSE;
}
Every certificate returned by CertGetIssuerCertificateFromStore( ) must be freed
with a call to CertFreeCertificateContext( ). To make things a bit simpler, a copy of
the original subject certificate is made so that the subject certificate can always be
freed after the call to CertGetIssuerCertificateFromStore( ). If an issuer certificate is
returned, the subject becomes the issuer for the next iteration through the loop.
When CertGetIssuerCertificateFromStore( ) cannot find the issuing certificate for
the subject certificate in the store, it returns NULL. This could mean that the end of
the certificate hierarchy has been reached, in which case GetLastError( ) will return
CRYPT_E_SELF_SIGNED because the root certificate in any hierarchy must always be
self-signed. A NULL return from CertGetIssuerCertificateFromStore( ) might also
indicate that there may be an issuer certificate for the subject certificate, but that one
wasn’t present in the certificate store; this is an error condition that results in the verification
failure of the subject certificate.
The call to CertGetIssuerCertificateFromStore( ) requires a set of flags to be passed
into it that determines what verification checks are to be performed on the subject
certificate. Upon return from the call, this set of flags is modified, leaving the bits set
Performing X.509 Certificate Verification with CryptoAPI | 531
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.