Problem - Kevin Tafuro

IN DWORD dwType,
IN DWORD dwFlags,
IN void *pvTypePara,
OUT OPTIONAL LPWSTR pszNameString,
IN DWORD cchNameString
);
#define CERT_NAME_ATTR_TYPE 3
#endif
CertGetNameStringW( ) is exported from all versions of crypt32.dll that are included
with Microsoft Internet Explorer 3.02 or later. You may run into problems linking,
however, because the import is missing from crypt32.lib. In our testing, we have
experienced no problems using the crypt32.lib distributed with the latest Microsoft
Windows Platform SDK. Unfortunately, we have been unable to find an alternative
method of obtaining the contents of the commonName field in a certificate other than
using this function.
See Also
Recipe 10.4
10.9 Using a Whitelist to Verify Certificates
Problem
You have a certificate that you want to compare against a list of known good certificates.
Solution
The average certificate is generally small, often under 2 KB in size. Because a certificate
is both reasonably small and cannot be undetectably modified once it has been
signed by a CA, it might seem reasonable to do a byte-for-byte comparison of the
certificate with a list of certificates. One problem with this approach is that if you are
comparing a certificate against a sizable list, performing the comparisons can become
a time-consuming operation. The other problem is that of storing all the certificates
in the list against which the certificate to verify will be compared. A better way is to
compute the fingerprint of each certificate and store the fingerprint instead of the
entire certificate. Fingerprints are generally only 16 or 20 bytes in size, depending on
the message digest algorithm used to compute them.
Discussion
In OpenSSL, computing the fingerprint of a certificate is as simple as a single call to
X509_digest( ). Comparing fingerprints is done with a byte-for-byte comparison. The
544 | Chapter 10: Public Key Infrastructure
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.