Problem - Kevin Tafuro

The SpcNewStoreForCert( ) function creates a temporary in-memory certificate store
that can be used with SpcVerifyCert( ). Only a single argument is required: the subject
certificate that is, presumably, at the end of a certificate hierarchy. The subject
certificate is added to the new certificate store, and for each issuing certificate in the
hierarchy, the system stores are searched for a copy of the certificate. If one cannot
be found, the new certificate store is destroyed and SpcNewStoreForCert( ) returns
NULL; otherwise, the found certificate will be added to the new certificate store.
Once the store has been created, it can now be passed directly into the
SpcVerifyCert( ) function, along with the subject certificate to be verified. If there are
CRLs for any of the certificates in the hierarchy, add them to the store before calling
SpcVerifyCert( ) (see Recipe 10.11 for obtaining CRLs with CryptoAPI). You can
enumerate the contents of the certificate store created by SpcNewStoreForCert( )
using CertEnumCertificatesInStore( ):
BOOL bResult;
HCERTSTORE hCertStore;
PCCRL_CONTEXT pCRLContext;
PCCERT_CONTEXT pCertContext = 0;
if (!(hCertStore = SpcNewStoreForCert(pSubjectContext))) {
/* handle an error condition--could not create the store */
abort( );
}
while ((pCertContext = CertEnumCertificatesInStore(hCertStore, pCertContext))) {
/* do something with the certificate retrieved from the store.
* if an error occurs, and enumeration must be terminated prematurely, the last
* certificate retrieved must be freed manually.
*
* For example, attempt to retrieve the CRL for the certificate using the code
* the can be found in Recipe 10.11. If no CRL can be retrieved, or the CRL
* cannot be added to the certificate store, consider it a failure and break
* out of the enumeration.
*/
if (!(pCRLContext = SpcRetrieveCRL(pCertContext, 0)) ||
!CertAddCRLContextToStore(hCertStore, pCRLContext,
CERT_ADD_USE_EXISTING, 0)) {
if (pCRLContext) CertFreeCRLContext(pCRLContext);
break;
}
CertFreeCRLContext(pCRLContext);
}
if (pCertContext) {
CertFreeCertificateContext(pCertContext);
CertCloseStore(hCertStore, 0);
abort( );
}
bResult = SpcVerifyCert(hCertStore, pSubjectContext);
CertCloseStore(hCertStore, 0);
return bResult;
534 | Chapter 10: Public Key Infrastructure
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.