Problem - Kevin Tafuro

LocalFree(pvStructInfo);
return 0;
}
The SpcLookupCACert( ) function computes the fingerprint of the specified certificate
and tries to match it with a fingerprint in the table of CA certificates and CRLURLs
that we’ve already defined. If a match is found, the function returns a pointer to the
matching entry. We will be using MD5 for computing the fingerprint, so we know
that the size of the fingerprint will always be 16 bytes. (Note that we have essentially
taken the SpcFingerPrintCert( ) and SpcFingerPrintEqual( ) functions from Recipe
10.9, stripped them down a bit, and combined them here.)
SPC_CACERT *SpcLookupCACert(PCCERT_CONTEXT pCertContext) {
SPC_CACERT *pCACert;
BYTE pbFingerPrint[16]; /* MD5 is 128 bits or 16 bytes */
DWORD cbFingerPrint;
/* Compute the fingerprint of the certificate */
cbFingerPrint = sizeof(pbFingerPrint);
CryptHashCertificate(0, CALG_MD5, 0, pCertContext->pbCertEncoded,
pCertContext->cbCertEncoded, pbFingerPrint,
&cbFingerPrint);
/* Compare the computed certificate against those in our lookup table */
for (pCACert = rgLookupTable; pCACert->pbFingerPrint; pCACert++) {
if (!memcmp(pCACert->pbFingerPrint, pbFingerPrint, cbFingerPrint))
return pCACert;
}
return 0;
}
SpcGetCertCRLURL( ) attempts to find the URLfor the CRLfor a certificate. It first
checks the subject’s certificate for an RFC 3280 cRLDistributionPoints extension
using the GetDistributionPoint( ) worker function. If the subject certificate does not
have one, the function checks the issuer’s certificate. If neither certificate contains a
cRLDistributionPoints extension, it checks the issuer certificate’s fingerprint against
the table of CA fingerprints and CRLURLs using SpcLookupCACert( ). If a URLcannot
be determined, SpcGetCertCRLURL( ) returns NULL.
LPSTR SpcGetCertCRLURL(PCCERT_CONTEXT pSubject, PCCERT_CONTEXT pIssuer,
BOOL bLookupOnly) {
LPSTR lpszURL;
SPC_CACERT *pCACert;
if (!bLookupOnly) {
if (pSubject && (lpszURL = GetDistributionPoint(pSubject)) != 0)
return lpszURL;
if (pIssuer && (lpszURL = GetDistributionPoint(pIssuer)) != 0)
return lpszURL;
}
/* Get the fingerprint of the cert's issuer, and look it up in a table */
Obtaining CRLs with CryptoAPI | 559
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.