Problem - Kevin Tafuro

10.11 Obtaining CRLs with CryptoAPI
Problem
You have a certificate that you want to verify, as well as the certificate that was used
to issue it, but you need to check the issuing authority’s CRLto make sure that the
certificate has not been revoked. We cover how to use a CRLonce you have it in
Recipe 10.6—but how do you get it in the first place?
Solution
Obtaining a CRLwith CryptoAPI follows the same basic procedure as doing so with
OpenSSL(see Recipe 10.10); the only difference is in the functions used to perform
the work. We only provide support for retrieving CRLs via HTTP in this recipe and
in Recipe 10.10. We will use the WinInet API (see Recipe 9.4) and the relevant
CryptoAPI functions to create a CryptoAPI CRL_CONTEXT object from data retrieved
from a CA.
Discussion
For Windows, we mostly duplicate the table that was built in Recipe 10.10, but for
simplicity, we strip from the data structure some members we will not be using. The
name of the CA, the length of the fingerprint, and the URLto the OCSP for the CA
are all omitted, leaving only the fingerprint and URL to retrieve the CRL.
#include
#include
#include
typedef struct {
BYTE *pbFingerPrint;
LPSTR lpszCRLURL;
} SPC_CACERT;
static SPC_CACERT rgLookupTable[ ] = {
{ "\x67\xcb\x9d\xc0\x13\x24\x8a\x82\x9b\xb2\x17\x1e\xd1\x1b\xec\xd4",
"http://crl.geotrust.com/crls/secureca.crl" },
{ "\x8f\x5d\x77\x06\x27\xc4\x98\x3c\x5b\x93\x78\xe7\xd7\x7d\x9b\xcc",
"http://crl.geotrust.com/crls/globalca1.crl" },
{ "\x64\x9c\xef\x2e\x44\xfc\xc6\x8f\x52\x07\xd0\x51\x73\x8f\xcb\x3d",
"http://crl.geotrust.com/crls/ebizca1.crl" },
{ "\xaa\xbf\xbf\x64\x97\xda\x98\x1d\x6f\xc6\x08\x3a\x95\x70\x33\xca",
"http://crl.geotrust.com/crls/ebiz.crl" },
{ "\x74\x7b\x82\x03\x43\xf0\x00\x9e\x6b\xb3\xec\x47\xbf\x85\xa5\x93",
"http://crl.verisign.com/RSASecureServer.crl" },
{ "\xc5\x70\xc4\xa2\xed\x53\x78\x0c\xc8\x10\x53\x81\x64\xcb\xd0\x1d",
"https://www.thawte.com/cgi/lifecycle/getcrl.crl?skeyid=%07%15%28mps%AA"
"%B2%8A%7C%0F%86%CE8%93%008%05%8A%B1" },
556 | Chapter 10: Public Key Infrastructure
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.