Problem - Kevin Tafuro

for the types of verification checks that failed. SpcVerifyCert( ) checks the set of flags
after the successful return from CertGetIssuerCertificateFromStore( ) to see if CERT_
STORE_NO_CRL_FLAG is set. If it is, this indicates that no CRLcould be found in the
store against which the subject certificate could be compared. At this point, the flags
indicating failure as a result of there being no CRLare cleared. If any flags remain
set, this means that verification of the subject certificate failed; the loop is terminated,
and failure is returned.
CryptoAPI certificate stores
Several special certificate stores are available for use. In addition, private stores can
be created that reside in memory, in the registry, or in a disk file. To use one of the
special certificate stores, use the CryptoAPI function CertOpenSystemStore( ). This
function requires a handle to a Cryptographic Services Provider (CSP) and the name
of the certificate store to open. In the majority of cases, the CSP handle can be passed
as NULL, in which case the default CSP will be used. One of the names listed in
Table 10-2 may be opened for use.
Table 10-2. System certificate stores and their contents
Certificate store name Types of certificates in the store
MY Contains certificates that are owned by the current user. For each certificate in this store, the
associated private key is also available.
CA Contains CA certificates that are not self-signed root certificates. These certificates are capable
of issuing certificates.
ROOT Contains root CA certificates that are trusted. All of the certificates in this store should be selfsigned.
SPC Contains trusted software publisher certificates. The certificates in this store are used by
Microsoft’s Authenticode.
For the purposes of verification using SpcVerifyCert( ) as presented, you’ll need to
create a temporary certificate store that contains all the certificates that will be
needed to verify a subject certificate. At a minimum, the certificate that you want to
verify must be in the store, but verification will only succeed if the only certificate in
the store is the subject certificate and is self-signed, which in the vast majority of
cases isn’t all that useful.
If you do not have all the certificates and need to use certificates from one of the system
stores, a copy of the needed certificate from the system store can be made for
insertion into the temporary store being used for verification. Otherwise, certificates
in memory as CERT_CONTEXT objects can be added to the temporary store, or encoded
certificates residing in memory as a blob (binary large object) can be added.
#include
#include
static PCCERT_CONTEXT FindIssuerInSystemStore(LPCTSTR pszStoreName,
PCCERT_CONTEXT pSubjectContext) {
532 | Chapter 10: Public Key Infrastructure
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.