2 * Copyright 2004-2006 Juan Lang
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
23 #define NONAMELESSUNION
29 #include "wine/debug.h"
30 #include "crypt32_private.h"
32 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
34 /* Internal version of CertGetCertificateContextProperty that gets properties
35 * directly from the context (or the context it's linked to, depending on its
36 * type.) Doesn't handle special-case properties, since they are handled by
37 * CertGetCertificateContextProperty, and are particular to the store in which
38 * the property exists (which is separate from the context.)
40 static BOOL WINAPI CertContext_GetProperty(void *context, DWORD dwPropId,
41 void *pvData, DWORD *pcbData);
43 /* Internal version of CertSetCertificateContextProperty that sets properties
44 * directly on the context (or the context it's linked to, depending on its
45 * type.) Doesn't handle special cases, since they're handled by
46 * CertSetCertificateContextProperty anyway.
48 static BOOL WINAPI CertContext_SetProperty(void *context, DWORD dwPropId,
49 DWORD dwFlags, const void *pvData);
51 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
52 DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
53 DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
55 PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
56 pbCertEncoded, cbCertEncoded);
59 TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
60 pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
64 ret = CertAddCertificateContextToStore(hCertStore, cert,
65 dwAddDisposition, ppCertContext);
66 CertFreeCertificateContext(cert);
73 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
74 const BYTE *pbCertEncoded, DWORD cbCertEncoded)
76 PCERT_CONTEXT cert = NULL;
78 PCERT_INFO certInfo = NULL;
81 TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
84 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
85 pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
86 (BYTE *)&certInfo, &size);
91 cert = (PCERT_CONTEXT)Context_CreateDataContext(sizeof(CERT_CONTEXT));
94 data = CryptMemAlloc(cbCertEncoded);
101 memcpy(data, pbCertEncoded, cbCertEncoded);
102 cert->dwCertEncodingType = dwCertEncodingType;
103 cert->pbCertEncoded = data;
104 cert->cbCertEncoded = cbCertEncoded;
105 cert->pCertInfo = certInfo;
106 cert->hCertStore = 0;
110 return (PCCERT_CONTEXT)cert;
113 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(
114 PCCERT_CONTEXT pCertContext)
116 TRACE("(%p)\n", pCertContext);
117 Context_AddRef((void *)pCertContext, sizeof(CERT_CONTEXT));
121 static void CertDataContext_Free(void *context)
123 PCERT_CONTEXT certContext = (PCERT_CONTEXT)context;
125 CryptMemFree(certContext->pbCertEncoded);
126 LocalFree(certContext->pCertInfo);
129 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
131 TRACE("(%p)\n", pCertContext);
134 Context_Release((void *)pCertContext, sizeof(CERT_CONTEXT),
135 CertDataContext_Free);
139 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
142 PCONTEXT_PROPERTY_LIST properties = Context_GetProperties(
143 (void *)pCertContext, sizeof(CERT_CONTEXT));
146 TRACE("(%p, %d)\n", pCertContext, dwPropId);
149 ret = ContextPropertyList_EnumPropIDs(properties, dwPropId);
155 static BOOL CertContext_GetHashProp(void *context, DWORD dwPropId,
156 ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
159 BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
163 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
165 ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
170 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
177 else if (*pcbData < cb)
179 SetLastError(ERROR_MORE_DATA);
185 memcpy(pvData, pb, cb);
191 static BOOL WINAPI CertContext_GetProperty(void *context, DWORD dwPropId,
192 void *pvData, DWORD *pcbData)
194 PCCERT_CONTEXT pCertContext = (PCCERT_CONTEXT)context;
195 PCONTEXT_PROPERTY_LIST properties =
196 Context_GetProperties(context, sizeof(CERT_CONTEXT));
198 CRYPT_DATA_BLOB blob;
200 TRACE("(%p, %d, %p, %p)\n", context, dwPropId, pvData, pcbData);
203 ret = ContextPropertyList_FindProperty(properties, dwPropId, &blob);
207 ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
210 /* Implicit properties */
213 case CERT_SHA1_HASH_PROP_ID:
214 ret = CertContext_GetHashProp(context, dwPropId, CALG_SHA1,
215 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
218 case CERT_MD5_HASH_PROP_ID:
219 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
220 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
223 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
224 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
225 pCertContext->pCertInfo->Subject.pbData,
226 pCertContext->pCertInfo->Subject.cbData,
229 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
230 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
231 pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
232 pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
235 case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
236 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
237 pCertContext->pCertInfo->SerialNumber.pbData,
238 pCertContext->pCertInfo->SerialNumber.cbData,
241 case CERT_SIGNATURE_HASH_PROP_ID:
242 FIXME("CERT_SIGNATURE_HASH_PROP_ID unimplemented\n");
243 SetLastError(CRYPT_E_NOT_FOUND);
245 case CERT_KEY_IDENTIFIER_PROP_ID:
247 PCERT_EXTENSION ext = CertFindExtension(
248 szOID_SUBJECT_KEY_IDENTIFIER, pCertContext->pCertInfo->cExtension,
249 pCertContext->pCertInfo->rgExtension);
253 CRYPT_DATA_BLOB value;
256 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
257 szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
258 ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
262 ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
264 CertContext_SetProperty(context, dwPropId, 0, &value);
268 SetLastError(ERROR_INVALID_DATA);
272 SetLastError(CRYPT_E_NOT_FOUND);
275 TRACE("returning %d\n", ret);
279 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info)
281 DWORD i, containerLen, provNameLen;
282 LPBYTE data = (LPBYTE)info + sizeof(CRYPT_KEY_PROV_INFO);
284 info->pwszContainerName = (LPWSTR)data;
285 containerLen = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
286 data += containerLen;
288 info->pwszProvName = (LPWSTR)data;
289 provNameLen = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
292 info->rgProvParam = (PCRYPT_KEY_PROV_PARAM)data;
293 data += info->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
295 for (i = 0; i < info->cProvParam; i++)
297 info->rgProvParam[i].pbData = data;
298 data += info->rgProvParam[i].cbData;
302 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
303 DWORD dwPropId, void *pvData, DWORD *pcbData)
307 TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
312 case CERT_CERT_PROP_ID:
313 case CERT_CRL_PROP_ID:
314 case CERT_CTL_PROP_ID:
315 SetLastError(E_INVALIDARG);
318 case CERT_ACCESS_STATE_PROP_ID:
319 if (pCertContext->hCertStore)
320 ret = CertGetStoreProperty(pCertContext->hCertStore, dwPropId,
326 ret = CertContext_CopyParam(pvData, pcbData, &state, sizeof(state));
329 case CERT_KEY_PROV_HANDLE_PROP_ID:
331 CERT_KEY_CONTEXT keyContext;
332 DWORD size = sizeof(keyContext);
334 ret = CertContext_GetProperty((void *)pCertContext,
335 CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
337 ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
338 sizeof(keyContext.hCryptProv));
341 case CERT_KEY_PROV_INFO_PROP_ID:
342 ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
345 CRYPT_FixKeyProvInfoPointers((PCRYPT_KEY_PROV_INFO)pvData);
348 ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
352 TRACE("returning %d\n", ret);
356 /* Copies key provider info from from into to, where to is assumed to be a
357 * contiguous buffer of memory large enough for from and all its associated
358 * data, but whose pointers are uninitialized.
359 * Upon return, to contains a contiguous copy of from, packed in the following
361 * - CRYPT_KEY_PROV_INFO
362 * - pwszContainerName
364 * - rgProvParam[0]...
366 static void CRYPT_CopyKeyProvInfo(PCRYPT_KEY_PROV_INFO to,
367 const CRYPT_KEY_PROV_INFO *from)
370 LPBYTE nextData = (LPBYTE)to + sizeof(CRYPT_KEY_PROV_INFO);
372 if (from->pwszContainerName)
374 to->pwszContainerName = (LPWSTR)nextData;
375 lstrcpyW(to->pwszContainerName, from->pwszContainerName);
376 nextData += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
379 to->pwszContainerName = NULL;
380 if (from->pwszProvName)
382 to->pwszProvName = (LPWSTR)nextData;
383 lstrcpyW(to->pwszProvName, from->pwszProvName);
384 nextData += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
387 to->pwszProvName = NULL;
388 to->dwProvType = from->dwProvType;
389 to->dwFlags = from->dwFlags;
390 to->cProvParam = from->cProvParam;
391 to->rgProvParam = (PCRYPT_KEY_PROV_PARAM)nextData;
392 nextData += to->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
393 to->dwKeySpec = from->dwKeySpec;
394 for (i = 0; i < to->cProvParam; i++)
396 memcpy(&to->rgProvParam[i], &from->rgProvParam[i],
397 sizeof(CRYPT_KEY_PROV_PARAM));
398 to->rgProvParam[i].pbData = nextData;
399 memcpy(to->rgProvParam[i].pbData, from->rgProvParam[i].pbData,
400 from->rgProvParam[i].cbData);
401 nextData += from->rgProvParam[i].cbData;
405 static BOOL CertContext_SetKeyProvInfoProperty(PCONTEXT_PROPERTY_LIST properties,
406 const CRYPT_KEY_PROV_INFO *info)
410 DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i, containerSize, provNameSize;
412 if (info->pwszContainerName)
413 containerSize = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
416 if (info->pwszProvName)
417 provNameSize = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
420 size += containerSize + provNameSize;
421 for (i = 0; i < info->cProvParam; i++)
422 size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
423 buf = CryptMemAlloc(size);
426 CRYPT_CopyKeyProvInfo((PCRYPT_KEY_PROV_INFO)buf, info);
427 ret = ContextPropertyList_SetProperty(properties,
428 CERT_KEY_PROV_INFO_PROP_ID, buf, size);
436 static BOOL WINAPI CertContext_SetProperty(void *context, DWORD dwPropId,
437 DWORD dwFlags, const void *pvData)
439 PCONTEXT_PROPERTY_LIST properties =
440 Context_GetProperties(context, sizeof(CERT_CONTEXT));
443 TRACE("(%p, %d, %08x, %p)\n", context, dwPropId, dwFlags, pvData);
451 case CERT_AUTO_ENROLL_PROP_ID:
452 case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
453 case CERT_DESCRIPTION_PROP_ID:
454 case CERT_FRIENDLY_NAME_PROP_ID:
455 case CERT_HASH_PROP_ID:
456 case CERT_KEY_IDENTIFIER_PROP_ID:
457 case CERT_MD5_HASH_PROP_ID:
458 case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
459 case CERT_PUBKEY_ALG_PARA_PROP_ID:
460 case CERT_PVK_FILE_PROP_ID:
461 case CERT_SIGNATURE_HASH_PROP_ID:
462 case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
463 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
464 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
465 case CERT_ENROLLMENT_PROP_ID:
466 case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
467 case CERT_RENEWAL_PROP_ID:
471 const CRYPT_DATA_BLOB *blob = (const CRYPT_DATA_BLOB *)pvData;
473 ret = ContextPropertyList_SetProperty(properties, dwPropId,
474 blob->pbData, blob->cbData);
478 ContextPropertyList_RemoveProperty(properties, dwPropId);
483 case CERT_DATE_STAMP_PROP_ID:
485 ret = ContextPropertyList_SetProperty(properties, dwPropId,
486 (const BYTE *)pvData, sizeof(FILETIME));
489 ContextPropertyList_RemoveProperty(properties, dwPropId);
493 case CERT_KEY_CONTEXT_PROP_ID:
497 const CERT_KEY_CONTEXT *keyContext = (const CERT_KEY_CONTEXT *)pvData;
499 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
501 SetLastError(E_INVALIDARG);
505 ret = ContextPropertyList_SetProperty(properties, dwPropId,
506 (const BYTE *)keyContext, keyContext->cbSize);
510 ContextPropertyList_RemoveProperty(properties, dwPropId);
515 case CERT_KEY_PROV_INFO_PROP_ID:
517 ret = CertContext_SetKeyProvInfoProperty(properties,
518 (const CRYPT_KEY_PROV_INFO *)pvData);
521 ContextPropertyList_RemoveProperty(properties, dwPropId);
525 case CERT_KEY_PROV_HANDLE_PROP_ID:
527 CERT_KEY_CONTEXT keyContext;
528 DWORD size = sizeof(keyContext);
530 ret = CertContext_GetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
534 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
535 CryptReleaseContext(keyContext.hCryptProv, 0);
537 keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
539 keyContext.hCryptProv = 0;
540 ret = CertContext_SetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
546 FIXME("%d: stub\n", dwPropId);
550 TRACE("returning %d\n", ret);
554 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
555 DWORD dwPropId, DWORD dwFlags, const void *pvData)
559 TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
561 /* Handle special cases for "read-only"/invalid prop IDs. Windows just
562 * crashes on most of these, I'll be safer.
567 case CERT_ACCESS_STATE_PROP_ID:
568 case CERT_CERT_PROP_ID:
569 case CERT_CRL_PROP_ID:
570 case CERT_CTL_PROP_ID:
571 SetLastError(E_INVALIDARG);
574 ret = CertContext_SetProperty((void *)pCertContext, dwPropId, dwFlags,
576 TRACE("returning %d\n", ret);
580 /* Acquires the private key using the key provider info, retrieving info from
581 * the certificate if info is NULL. The acquired provider is returned in
582 * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
584 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert,
585 PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
588 BOOL allocated = FALSE, ret = TRUE;
592 ret = CertGetCertificateContextProperty(pCert,
593 CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
596 info = (PCRYPT_KEY_PROV_INFO)HeapAlloc(GetProcessHeap(), 0, size);
599 ret = CertGetCertificateContextProperty(pCert,
600 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
605 SetLastError(CRYPT_E_NO_KEY_PROPERTY);
609 ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
610 info->pwszProvName, info->dwProvType, 0);
615 for (i = 0; i < info->cProvParam; i++)
617 CryptSetProvParam(*phCryptProv,
618 info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
619 info->rgProvParam[i].dwFlags);
621 *pdwKeySpec = info->dwKeySpec;
624 SetLastError(CRYPT_E_NO_KEY_PROPERTY);
627 HeapFree(GetProcessHeap(), 0, info);
631 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
632 DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
633 DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
635 BOOL ret = FALSE, cache = FALSE;
636 PCRYPT_KEY_PROV_INFO info = NULL;
637 CERT_KEY_CONTEXT keyContext;
640 TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
641 phCryptProv, pdwKeySpec, pfCallerFreeProv);
643 if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
647 ret = CertGetCertificateContextProperty(pCert,
648 CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
651 info = (PCRYPT_KEY_PROV_INFO)HeapAlloc(
652 GetProcessHeap(), 0, size);
653 ret = CertGetCertificateContextProperty(pCert,
654 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
656 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
659 else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
664 size = sizeof(keyContext);
665 ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
669 *phCryptProv = keyContext.hCryptProv;
671 *pdwKeySpec = keyContext.dwKeySpec;
672 if (pfCallerFreeProv)
673 *pfCallerFreeProv = !cache;
678 ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, info,
679 &keyContext.hCryptProv, &keyContext.dwKeySpec);
682 *phCryptProv = keyContext.hCryptProv;
684 *pdwKeySpec = keyContext.dwKeySpec;
687 keyContext.cbSize = sizeof(keyContext);
688 if (CertSetCertificateContextProperty(pCert,
689 CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
691 if (pfCallerFreeProv)
692 *pfCallerFreeProv = FALSE;
697 if (pfCallerFreeProv)
698 *pfCallerFreeProv = TRUE;
702 HeapFree(GetProcessHeap(), 0, info);
706 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
707 PCERT_INFO pCertId1, PCERT_INFO pCertId2)
711 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
713 ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
714 &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
715 &pCertId2->SerialNumber);
716 TRACE("returning %d\n", ret);
720 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
721 PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
725 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
727 if (pCertName1->cbData == pCertName2->cbData)
729 if (pCertName1->cbData)
730 ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
737 TRACE("returning %d\n", ret);
741 /* Returns the number of significant bytes in pInt, where a byte is
742 * insignificant if it's a leading 0 for positive numbers or a leading 0xff
743 * for negative numbers. pInt is assumed to be little-endian.
745 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
747 DWORD ret = pInt->cbData;
751 if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
753 else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
761 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
762 PCRYPT_INTEGER_BLOB pInt2)
767 TRACE("(%p, %p)\n", pInt1, pInt2);
769 cb1 = CRYPT_significantBytes(pInt1);
770 cb2 = CRYPT_significantBytes(pInt2);
774 ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
780 TRACE("returning %d\n", ret);
784 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
785 PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
789 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
791 if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
792 pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
794 if (pPublicKey2->PublicKey.cbData)
795 ret = !memcmp(pPublicKey1->PublicKey.pbData,
796 pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
805 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
806 PCERT_PUBLIC_KEY_INFO pPublicKey)
810 TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
812 if (dwCertEncodingType != X509_ASN_ENCODING)
814 SetLastError(ERROR_FILE_NOT_FOUND);
817 if (pPublicKey->Algorithm.pszObjId &&
818 !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
820 FIXME("unimplemented for DH public keys\n");
821 SetLastError(CRYPT_E_ASN1_BADTAG);
827 BOOL ret = CryptDecodeObjectEx(dwCertEncodingType,
828 RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
829 pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
834 RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)((LPBYTE)buf +
837 len = rsaPubKey->bitlen;
844 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
845 DWORD dwFlags, const void *pvPara);
847 static BOOL compare_cert_any(PCCERT_CONTEXT pCertContext, DWORD dwType,
848 DWORD dwFlags, const void *pvPara)
853 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
854 DWORD dwFlags, const void *pvPara)
858 DWORD size = sizeof(hash);
860 ret = CertGetCertificateContextProperty(pCertContext,
861 CERT_MD5_HASH_PROP_ID, hash, &size);
864 const CRYPT_HASH_BLOB *pHash = (const CRYPT_HASH_BLOB *)pvPara;
866 if (size == pHash->cbData)
867 ret = !memcmp(pHash->pbData, hash, size);
874 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
875 DWORD dwFlags, const void *pvPara)
879 DWORD size = sizeof(hash);
881 ret = CertGetCertificateContextProperty(pCertContext,
882 CERT_SHA1_HASH_PROP_ID, hash, &size);
885 const CRYPT_HASH_BLOB *pHash = (const CRYPT_HASH_BLOB *)pvPara;
887 if (size == pHash->cbData)
888 ret = !memcmp(pHash->pbData, hash, size);
895 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
896 DWORD dwFlags, const void *pvPara)
898 CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
901 if (dwType & CERT_INFO_SUBJECT_FLAG)
902 toCompare = &pCertContext->pCertInfo->Subject;
904 toCompare = &pCertContext->pCertInfo->Issuer;
905 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
910 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
911 DWORD dwType, DWORD dwFlags, const void *pvPara)
913 CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
916 /* Matching serial number and subject match.. */
917 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
918 &pCertInfo->Issuer, &pCertContext->pCertInfo->Subject);
920 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
921 &pCertInfo->SerialNumber);
924 /* failing that, if the serial number and issuer match, we match */
925 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
926 &pCertInfo->SerialNumber);
928 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
929 &pCertInfo->Issuer, &pCertContext->pCertInfo->Issuer);
931 TRACE("returning %d\n", ret);
935 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
936 DWORD dwFlags, const void *pvPara)
938 CERT_ID *id = (CERT_ID *)pvPara;
941 switch (id->dwIdChoice)
943 case CERT_ID_ISSUER_SERIAL_NUMBER:
944 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
945 &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
947 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
948 &id->u.IssuerSerialNumber.SerialNumber);
950 case CERT_ID_SHA1_HASH:
951 ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
954 case CERT_ID_KEY_IDENTIFIER:
958 ret = CertGetCertificateContextProperty(pCertContext,
959 CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
960 if (ret && size == id->u.KeyId.cbData)
962 LPBYTE buf = CryptMemAlloc(size);
966 CertGetCertificateContextProperty(pCertContext,
967 CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
968 ret = !memcmp(buf, id->u.KeyId.pbData, size);
983 static BOOL compare_cert_by_issuer(PCCERT_CONTEXT pCertContext, DWORD dwType,
984 DWORD dwFlags, const void *pvPara)
987 PCCERT_CONTEXT subject = (PCCERT_CONTEXT)pvPara;
991 if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
992 subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
994 CERT_AUTHORITY_KEY_ID_INFO *info;
996 ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
997 X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
998 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1004 if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1006 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1007 memcpy(&id.u.IssuerSerialNumber.Issuer, &info->CertIssuer,
1008 sizeof(CERT_NAME_BLOB));
1009 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1010 &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1011 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1014 else if (info->KeyId.cbData)
1016 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1017 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1018 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1026 else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1027 subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1029 CERT_AUTHORITY_KEY_ID2_INFO *info;
1031 ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1032 X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1033 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1039 if (info->AuthorityCertIssuer.cAltEntry &&
1040 info->AuthorityCertSerialNumber.cbData)
1042 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1045 for (i = 0; !directoryName &&
1046 i < info->AuthorityCertIssuer.cAltEntry; i++)
1047 if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1048 == CERT_ALT_NAME_DIRECTORY_NAME)
1050 &info->AuthorityCertIssuer.rgAltEntry[i];
1053 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1054 memcpy(&id.u.IssuerSerialNumber.Issuer,
1055 &directoryName->u.DirectoryName, sizeof(CERT_NAME_BLOB));
1056 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1057 &info->AuthorityCertSerialNumber,
1058 sizeof(CRYPT_INTEGER_BLOB));
1059 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1064 FIXME("no supported name type in authority key id2\n");
1068 else if (info->KeyId.cbData)
1070 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1071 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1072 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1081 ret = compare_cert_by_name(pCertContext,
1082 CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT, dwFlags,
1083 &subject->pCertInfo->Issuer);
1087 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1088 DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1089 PCCERT_CONTEXT pPrevCertContext)
1092 CertCompareFunc compare;
1094 TRACE("(%p, %08x, %08x, %08x, %p, %p)\n", hCertStore, dwCertEncodingType,
1095 dwFlags, dwType, pvPara, pPrevCertContext);
1097 switch (dwType >> CERT_COMPARE_SHIFT)
1099 case CERT_COMPARE_ANY:
1100 compare = compare_cert_any;
1102 case CERT_COMPARE_MD5_HASH:
1103 compare = compare_cert_by_md5_hash;
1105 case CERT_COMPARE_SHA1_HASH:
1106 compare = compare_cert_by_sha1_hash;
1108 case CERT_COMPARE_NAME:
1109 compare = compare_cert_by_name;
1111 case CERT_COMPARE_SUBJECT_CERT:
1112 compare = compare_cert_by_subject_cert;
1114 case CERT_COMPARE_CERT_ID:
1115 compare = compare_cert_by_cert_id;
1117 case CERT_COMPARE_ISSUER_OF:
1118 compare = compare_cert_by_issuer;
1121 FIXME("find type %08x unimplemented\n", dwType);
1127 BOOL matches = FALSE;
1129 ret = pPrevCertContext;
1131 ret = CertEnumCertificatesInStore(hCertStore, ret);
1133 matches = compare(ret, dwType, dwFlags, pvPara);
1134 } while (ret != NULL && !matches);
1136 SetLastError(CRYPT_E_NOT_FOUND);
1140 SetLastError(CRYPT_E_NOT_FOUND);
1143 TRACE("returning %p\n", ret);
1147 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1148 DWORD dwCertEncodingType, PCERT_INFO pCertId)
1150 TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1154 SetLastError(E_INVALIDARG);
1157 return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1158 CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1161 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1162 PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1164 static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1165 CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1167 if (*pdwFlags & ~supportedFlags)
1169 SetLastError(E_INVALIDARG);
1172 if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1175 PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1178 /* FIXME: what if the CRL has expired? */
1181 if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1182 pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1183 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1186 *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1188 if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1190 if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1191 *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1193 if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1195 if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1196 CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1197 CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1198 *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1203 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1204 PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1209 TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
1210 pPrevIssuerContext, *pdwFlags);
1212 if (!pSubjectContext)
1214 SetLastError(E_INVALIDARG);
1218 ret = CertFindCertificateInStore(hCertStore,
1219 pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1220 pSubjectContext, pPrevIssuerContext);
1223 if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1226 CertFreeCertificateContext(ret);
1230 TRACE("returning %p\n", ret);
1234 typedef struct _OLD_CERT_REVOCATION_STATUS {
1239 } OLD_CERT_REVOCATION_STATUS, *POLD_CERT_REVOCATION_STATUS;
1241 typedef BOOL (WINAPI *CertVerifyRevocationFunc)(DWORD, DWORD, DWORD,
1242 void **, DWORD, PCERT_REVOCATION_PARA, PCERT_REVOCATION_STATUS);
1244 BOOL WINAPI CertVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
1245 DWORD cContext, void *rgpvContext[], DWORD dwFlags,
1246 PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
1250 TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
1251 cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
1253 if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
1254 pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
1256 SetLastError(E_INVALIDARG);
1261 static HCRYPTOIDFUNCSET set = NULL;
1265 set = CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC, 0);
1266 ret = CryptGetDefaultOIDDllList(set, dwEncodingType, NULL, &size);
1272 SetLastError(CRYPT_E_NO_REVOCATION_DLL);
1277 LPWSTR dllList = CryptMemAlloc(size * sizeof(WCHAR)), ptr;
1281 ret = CryptGetDefaultOIDDllList(set, dwEncodingType,
1285 for (ptr = dllList; ret && *ptr;
1286 ptr += lstrlenW(ptr) + 1)
1288 CertVerifyRevocationFunc func;
1289 HCRYPTOIDFUNCADDR hFunc;
1291 ret = CryptGetDefaultOIDFunctionAddress(set,
1292 dwEncodingType, ptr, 0, (void **)&func, &hFunc);
1295 ret = func(dwEncodingType, dwRevType, cContext,
1296 rgpvContext, dwFlags, pRevPara, pRevStatus);
1297 CryptFreeOIDFunctionAddress(hFunc, 0);
1301 CryptMemFree(dllList);
1305 SetLastError(ERROR_OUTOFMEMORY);
1316 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
1317 CRYPT_ATTRIBUTE rgAttr[])
1319 PCRYPT_ATTRIBUTE ret = NULL;
1322 TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
1328 SetLastError(ERROR_INVALID_PARAMETER);
1332 for (i = 0; !ret && i < cAttr; i++)
1333 if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
1338 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
1339 CERT_EXTENSION rgExtensions[])
1341 PCERT_EXTENSION ret = NULL;
1344 TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
1350 SetLastError(ERROR_INVALID_PARAMETER);
1354 for (i = 0; !ret && i < cExtensions; i++)
1355 if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
1356 rgExtensions[i].pszObjId))
1357 ret = &rgExtensions[i];
1361 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
1363 PCERT_RDN_ATTR ret = NULL;
1366 TRACE("%s %p\n", debugstr_a(pszObjId), pName);
1370 SetLastError(ERROR_INVALID_PARAMETER);
1374 for (i = 0; !ret && i < pName->cRDN; i++)
1375 for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
1376 if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
1377 pName->rgRDN[i].rgRDNAttr[j].pszObjId))
1378 ret = &pName->rgRDN[i].rgRDNAttr[j];
1382 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
1383 PCERT_INFO pCertInfo)
1390 GetSystemTimeAsFileTime(&fileTime);
1391 pTimeToVerify = &fileTime;
1393 if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
1395 ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
1402 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
1403 PCERT_INFO pIssuerInfo)
1405 TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
1407 return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
1408 && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
1411 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1412 DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
1413 DWORD *pcbComputedHash)
1416 HCRYPTHASH hHash = 0;
1418 TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
1419 pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
1422 hCryptProv = CRYPT_GetDefaultProvider();
1427 ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1430 ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
1432 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1433 pcbComputedHash, 0);
1434 CryptDestroyHash(hHash);
1440 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1441 DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
1442 BYTE *pbComputedHash, DWORD *pcbComputedHash)
1445 HCRYPTHASH hHash = 0;
1447 TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
1448 dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
1451 hCryptProv = CRYPT_GetDefaultProvider();
1459 ret = CryptEncodeObjectEx(dwCertEncodingType, X509_PUBLIC_KEY_INFO,
1460 pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
1463 ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1466 ret = CryptHashData(hHash, buf, size, 0);
1468 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1469 pcbComputedHash, 0);
1470 CryptDestroyHash(hHash);
1478 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
1479 DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
1480 DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
1481 const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
1484 PCCRYPT_OID_INFO info;
1487 TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
1488 dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
1489 pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
1491 info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1492 pSignatureAlgorithm->pszObjId, 0);
1495 SetLastError(NTE_BAD_ALGID);
1498 if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
1501 hCryptProv = CRYPT_GetDefaultProvider();
1502 ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
1505 ret = CryptHashData(hHash, pbEncodedToBeSigned,
1506 cbEncodedToBeSigned, 0);
1508 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
1510 CryptDestroyHash(hHash);
1517 SetLastError(ERROR_INVALID_PARAMETER);
1522 ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
1525 ret = CryptHashData(hHash, pbEncodedToBeSigned,
1526 cbEncodedToBeSigned, 0);
1528 ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
1530 CryptDestroyHash(hHash);
1537 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
1538 DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
1539 const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
1540 const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
1543 DWORD encodedSize, hashSize;
1545 TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
1546 dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
1547 pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
1549 ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
1550 NULL, &encodedSize);
1553 PBYTE encoded = CryptMemAlloc(encodedSize);
1557 ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
1558 pvStructInfo, encoded, &encodedSize);
1561 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
1562 dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
1563 pvHashAuxInfo, NULL, &hashSize);
1566 PBYTE hash = CryptMemAlloc(hashSize);
1570 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
1571 dwCertEncodingType, encoded, encodedSize,
1572 pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
1575 CERT_SIGNED_CONTENT_INFO info = { { 0 } };
1577 info.ToBeSigned.cbData = encodedSize;
1578 info.ToBeSigned.pbData = encoded;
1579 memcpy(&info.SignatureAlgorithm,
1580 pSignatureAlgorithm,
1581 sizeof(info.SignatureAlgorithm));
1582 info.Signature.cbData = hashSize;
1583 info.Signature.pbData = hash;
1584 info.Signature.cUnusedBits = 0;
1585 ret = CryptEncodeObject(dwCertEncodingType,
1586 X509_CERT, &info, pbEncoded, pcbEncoded);
1592 CryptMemFree(encoded);
1598 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
1599 DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
1600 PCERT_PUBLIC_KEY_INFO pPublicKey)
1602 return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
1603 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, (void *)pbEncoded,
1604 CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
1607 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv,
1608 DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pubKeyInfo,
1609 const CERT_SIGNED_CONTENT_INFO *signedCert)
1613 PCCRYPT_OID_INFO info;
1614 ALG_ID pubKeyID, hashID;
1616 info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1617 signedCert->SignatureAlgorithm.pszObjId, 0);
1618 if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
1620 SetLastError(NTE_BAD_ALGID);
1623 hashID = info->u.Algid;
1624 if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
1625 pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
1628 /* Load the default provider if necessary */
1630 hCryptProv = CRYPT_GetDefaultProvider();
1631 ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
1632 pubKeyInfo, pubKeyID, 0, NULL, &key);
1637 ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
1640 ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
1641 signedCert->ToBeSigned.cbData, 0);
1643 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
1644 signedCert->Signature.cbData, key, NULL, 0);
1645 CryptDestroyHash(hash);
1647 CryptDestroyKey(key);
1652 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
1653 DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
1654 DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
1657 CRYPT_DATA_BLOB subjectBlob;
1659 TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
1660 dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
1661 dwFlags, pvReserved);
1663 switch (dwSubjectType)
1665 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
1667 PCRYPT_DATA_BLOB blob = (PCRYPT_DATA_BLOB)pvSubject;
1669 subjectBlob.pbData = blob->pbData;
1670 subjectBlob.cbData = blob->cbData;
1673 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
1675 PCERT_CONTEXT context = (PCERT_CONTEXT)pvSubject;
1677 subjectBlob.pbData = context->pbCertEncoded;
1678 subjectBlob.cbData = context->cbCertEncoded;
1681 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
1683 PCRL_CONTEXT context = (PCRL_CONTEXT)pvSubject;
1685 subjectBlob.pbData = context->pbCrlEncoded;
1686 subjectBlob.cbData = context->cbCrlEncoded;
1690 SetLastError(E_INVALIDARG);
1696 PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
1699 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
1700 subjectBlob.pbData, subjectBlob.cbData,
1701 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1702 (BYTE *)&signedCert, &size);
1705 switch (dwIssuerType)
1707 case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
1708 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
1709 dwCertEncodingType, (PCERT_PUBLIC_KEY_INFO)pvIssuer,
1712 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
1713 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
1715 &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
1718 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
1719 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
1722 case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
1725 SetLastError(E_INVALIDARG);
1730 FIXME("unimplemented for NULL signer\n");
1731 SetLastError(E_INVALIDARG);
1736 SetLastError(E_INVALIDARG);
1739 LocalFree(signedCert);
1745 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
1746 PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
1748 PCERT_ENHKEY_USAGE usage = NULL;
1752 if (!pCertContext || !pcbUsage)
1754 SetLastError(ERROR_INVALID_PARAMETER);
1758 TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
1760 if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
1764 if (CertGetCertificateContextProperty(pCertContext,
1765 CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
1767 LPBYTE buf = CryptMemAlloc(propSize);
1771 if (CertGetCertificateContextProperty(pCertContext,
1772 CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
1774 ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
1775 X509_ENHANCED_KEY_USAGE, buf, propSize,
1776 CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
1782 if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
1784 PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
1785 pCertContext->pCertInfo->cExtension,
1786 pCertContext->pCertInfo->rgExtension);
1790 ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
1791 X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
1792 CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
1797 /* If a particular location is specified, this should fail. Otherwise
1798 * it should succeed with an empty usage. (This is true on Win2k and
1799 * later, which we emulate.)
1803 SetLastError(CRYPT_E_NOT_FOUND);
1807 bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
1813 *pcbUsage = bytesNeeded;
1814 else if (*pcbUsage < bytesNeeded)
1816 SetLastError(ERROR_MORE_DATA);
1817 *pcbUsage = bytesNeeded;
1822 *pcbUsage = bytesNeeded;
1826 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
1827 sizeof(CERT_ENHKEY_USAGE) +
1828 usage->cUsageIdentifier * sizeof(LPSTR));
1830 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
1831 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
1832 sizeof(CERT_ENHKEY_USAGE));
1833 for (i = 0; i < usage->cUsageIdentifier; i++)
1835 pUsage->rgpszUsageIdentifier[i] = nextOID;
1836 strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
1837 nextOID += strlen(nextOID) + 1;
1841 pUsage->cUsageIdentifier = 0;
1846 TRACE("returning %d\n", ret);
1850 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
1851 PCERT_ENHKEY_USAGE pUsage)
1855 TRACE("(%p, %p)\n", pCertContext, pUsage);
1859 CRYPT_DATA_BLOB blob = { 0, NULL };
1861 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
1862 pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
1865 ret = CertSetCertificateContextProperty(pCertContext,
1866 CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
1867 LocalFree(blob.pbData);
1871 ret = CertSetCertificateContextProperty(pCertContext,
1872 CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
1876 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
1877 LPCSTR pszUsageIdentifier)
1882 TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
1884 if (CertGetEnhancedKeyUsage(pCertContext,
1885 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
1887 PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
1891 ret = CertGetEnhancedKeyUsage(pCertContext,
1892 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
1895 PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
1896 sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
1903 newUsage->rgpszUsageIdentifier =
1904 (LPSTR *)((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
1905 nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier +
1906 (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
1907 for (i = 0; i < usage->cUsageIdentifier; i++)
1909 newUsage->rgpszUsageIdentifier[i] = nextOID;
1910 strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
1911 nextOID += strlen(nextOID) + 1;
1913 newUsage->rgpszUsageIdentifier[i] = nextOID;
1914 strcpy(nextOID, pszUsageIdentifier);
1915 newUsage->cUsageIdentifier = i + 1;
1916 ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
1917 CryptMemFree(newUsage);
1920 CryptMemFree(usage);
1927 PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
1928 sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
1932 usage->rgpszUsageIdentifier =
1933 (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
1934 usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
1935 sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
1936 strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
1937 usage->cUsageIdentifier = 1;
1938 ret = CertSetEnhancedKeyUsage(pCertContext, usage);
1939 CryptMemFree(usage);
1947 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
1948 LPCSTR pszUsageIdentifier)
1952 CERT_ENHKEY_USAGE usage;
1954 TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
1956 size = sizeof(usage);
1957 ret = CertGetEnhancedKeyUsage(pCertContext,
1958 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
1959 if (!ret && GetLastError() == ERROR_MORE_DATA)
1961 PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
1965 ret = CertGetEnhancedKeyUsage(pCertContext,
1966 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
1969 if (pUsage->cUsageIdentifier)
1974 for (i = 0; i < pUsage->cUsageIdentifier; i++)
1976 if (!strcmp(pUsage->rgpszUsageIdentifier[i],
1977 pszUsageIdentifier))
1979 if (found && i < pUsage->cUsageIdentifier - 1)
1980 pUsage->rgpszUsageIdentifier[i] =
1981 pUsage->rgpszUsageIdentifier[i + 1];
1983 pUsage->cUsageIdentifier--;
1984 /* Remove the usage if it's empty */
1985 if (pUsage->cUsageIdentifier)
1986 ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
1988 ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
1991 CryptMemFree(pUsage);
1998 /* it fit in an empty usage, therefore there's nothing to remove */
2010 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
2012 static void CRYPT_SetBitInField(struct BitField *field, DWORD bit)
2014 DWORD indexIndex = bit / BITS_PER_DWORD;
2016 if (indexIndex + 1 > field->cIndexes)
2018 if (field->cIndexes)
2019 field->indexes = CryptMemRealloc(field->indexes,
2020 (indexIndex + 1) * sizeof(DWORD));
2022 field->indexes = CryptMemAlloc(sizeof(DWORD));
2025 field->indexes[indexIndex] = 0;
2026 field->cIndexes = indexIndex + 1;
2030 field->indexes[indexIndex] |= 1 << (bit % BITS_PER_DWORD);
2033 static BOOL CRYPT_IsBitInFieldSet(struct BitField *field, DWORD bit)
2036 DWORD indexIndex = bit / BITS_PER_DWORD;
2038 assert(field->cIndexes);
2039 set = field->indexes[indexIndex] & (1 << (bit % BITS_PER_DWORD));
2043 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
2044 int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
2047 DWORD i, cbOIDs = 0;
2048 BOOL allUsagesValid = TRUE;
2049 CERT_ENHKEY_USAGE validUsages = { 0, NULL };
2051 TRACE("(%d, %p, %d, %p, %d)\n", cCerts, rghCerts, *cNumOIDs,
2054 for (i = 0; i < cCerts; i++)
2056 CERT_ENHKEY_USAGE usage;
2057 DWORD size = sizeof(usage);
2059 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
2060 /* Success is deliberately ignored: it implies all usages are valid */
2061 if (!ret && GetLastError() == ERROR_MORE_DATA)
2063 PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2065 allUsagesValid = FALSE;
2068 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
2071 if (!validUsages.cUsageIdentifier)
2075 cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
2076 validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
2077 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2078 cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
2080 validUsages.rgpszUsageIdentifier =
2081 CryptMemAlloc(cbOIDs);
2082 if (validUsages.rgpszUsageIdentifier)
2084 LPSTR nextOID = (LPSTR)
2085 ((LPBYTE)validUsages.rgpszUsageIdentifier +
2086 validUsages.cUsageIdentifier * sizeof(LPSTR));
2088 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2090 validUsages.rgpszUsageIdentifier[j] = nextOID;
2091 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
2092 pUsage->rgpszUsageIdentifier[j]);
2093 nextOID += lstrlenA(nextOID) + 1;
2099 struct BitField validIndexes = { 0, NULL };
2100 DWORD j, k, numRemoved = 0;
2102 /* Merge: build a bitmap of all the indexes of
2103 * validUsages.rgpszUsageIdentifier that are in pUsage.
2105 for (j = 0; j < pUsage->cUsageIdentifier; j++)
2107 for (k = 0; k < validUsages.cUsageIdentifier; k++)
2109 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
2110 validUsages.rgpszUsageIdentifier[k]))
2112 CRYPT_SetBitInField(&validIndexes, k);
2117 /* Merge by removing from validUsages those that are
2118 * not in the bitmap.
2120 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2122 if (!CRYPT_IsBitInFieldSet(&validIndexes, j))
2124 if (j < validUsages.cUsageIdentifier - 1)
2126 memcpy(&validUsages.rgpszUsageIdentifier[j],
2127 &validUsages.rgpszUsageIdentifier[j +
2129 (validUsages.cUsageIdentifier - numRemoved
2130 - j - 1) * sizeof(LPSTR));
2132 validUsages.rgpszUsageIdentifier[j]) + 1 +
2134 validUsages.cUsageIdentifier--;
2138 validUsages.cUsageIdentifier--;
2141 CryptMemFree(validIndexes.indexes);
2144 CryptMemFree(pUsage);
2156 *cNumOIDs = validUsages.cUsageIdentifier;
2159 else if (*pcbOIDs < cbOIDs)
2162 SetLastError(ERROR_MORE_DATA);
2167 LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
2168 validUsages.cUsageIdentifier * sizeof(LPSTR));
2171 for (i = 0; i < validUsages.cUsageIdentifier; i++)
2173 rghOIDs[i] = nextOID;
2174 lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
2175 nextOID += lstrlenA(nextOID) + 1;
2179 CryptMemFree(validUsages.rgpszUsageIdentifier);
2180 TRACE("cNumOIDs: %d\n", *cNumOIDs);
2181 TRACE("returning %d\n", ret);
2185 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
2186 * pInfo is NULL, from the attributes of hProv.
2188 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
2189 const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
2191 CRYPT_KEY_PROV_INFO info = { 0 };
2199 ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
2202 LPSTR szContainer = CryptMemAlloc(size);
2206 ret = CryptGetProvParam(hProv, PP_CONTAINER,
2207 (BYTE *)szContainer, &size, 0);
2210 len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2214 info.pwszContainerName = CryptMemAlloc(len *
2216 len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2217 info.pwszContainerName, len);
2220 CryptMemFree(szContainer);
2223 ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
2226 LPSTR szProvider = CryptMemAlloc(size);
2230 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
2234 len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2238 info.pwszProvName = CryptMemAlloc(len *
2240 len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2241 info.pwszProvName, len);
2244 CryptMemFree(szProvider);
2247 size = sizeof(info.dwKeySpec);
2248 /* in case no CRYPT_KEY_PROV_INFO given,
2249 * we always use AT_SIGNATURE key spec
2251 info.dwKeySpec = AT_SIGNATURE;
2252 size = sizeof(info.dwProvType);
2253 ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
2256 info.dwProvType = PROV_RSA_FULL;
2260 ret = CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
2265 CryptMemFree(info.pwszContainerName);
2266 CryptMemFree(info.pwszProvName);
2270 /* Creates a signed certificate context from the unsigned, encoded certificate
2271 * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
2273 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
2274 HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
2276 PCCERT_CONTEXT context = NULL;
2280 ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2281 blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
2284 LPBYTE sig = CryptMemAlloc(sigSize);
2286 ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2287 blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
2290 CERT_SIGNED_CONTENT_INFO signedInfo;
2291 BYTE *encodedSignedCert = NULL;
2292 DWORD encodedSignedCertSize = 0;
2294 signedInfo.ToBeSigned.cbData = blob->cbData;
2295 signedInfo.ToBeSigned.pbData = blob->pbData;
2296 memcpy(&signedInfo.SignatureAlgorithm, sigAlgo,
2297 sizeof(signedInfo.SignatureAlgorithm));
2298 signedInfo.Signature.cbData = sigSize;
2299 signedInfo.Signature.pbData = sig;
2300 signedInfo.Signature.cUnusedBits = 0;
2301 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
2302 &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2303 (BYTE *)&encodedSignedCert, &encodedSignedCertSize);
2306 context = CertCreateCertificateContext(X509_ASN_ENCODING,
2307 encodedSignedCert, encodedSignedCertSize);
2308 LocalFree(encodedSignedCert);
2316 /* Copies data from the parameters into info, where:
2317 * pSerialNumber: The serial number. Must not be NULL.
2318 * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
2320 * pSignatureAlgorithm: Optional.
2321 * pStartTime: The starting time of the certificate. If NULL, the current
2322 * system time is used.
2323 * pEndTime: The ending time of the certificate. If NULL, one year past the
2324 * starting time is used.
2325 * pubKey: The public key of the certificate. Must not be NULL.
2326 * pExtensions: Extensions to be included with the certificate. Optional.
2328 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
2329 const CERT_NAME_BLOB *pSubjectIssuerBlob,
2330 const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
2331 const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
2332 const CERT_EXTENSIONS *pExtensions)
2334 static CHAR oid[] = szOID_RSA_SHA1RSA;
2337 assert(pSerialNumber);
2338 assert(pSubjectIssuerBlob);
2341 info->dwVersion = CERT_V3;
2342 info->SerialNumber.cbData = pSerialNumber->cbData;
2343 info->SerialNumber.pbData = pSerialNumber->pbData;
2344 if (pSignatureAlgorithm)
2345 memcpy(&info->SignatureAlgorithm, pSignatureAlgorithm,
2346 sizeof(info->SignatureAlgorithm));
2349 info->SignatureAlgorithm.pszObjId = oid;
2350 info->SignatureAlgorithm.Parameters.cbData = 0;
2351 info->SignatureAlgorithm.Parameters.pbData = NULL;
2353 info->Issuer.cbData = pSubjectIssuerBlob->cbData;
2354 info->Issuer.pbData = pSubjectIssuerBlob->pbData;
2356 SystemTimeToFileTime(pStartTime, &info->NotBefore);
2358 GetSystemTimeAsFileTime(&info->NotBefore);
2360 SystemTimeToFileTime(pEndTime, &info->NotAfter);
2365 if (FileTimeToSystemTime(&info->NotBefore, &endTime))
2368 SystemTimeToFileTime(&endTime, &info->NotAfter);
2371 info->Subject.cbData = pSubjectIssuerBlob->cbData;
2372 info->Subject.pbData = pSubjectIssuerBlob->pbData;
2373 memcpy(&info->SubjectPublicKeyInfo, pubKey,
2374 sizeof(info->SubjectPublicKeyInfo));
2377 info->cExtension = pExtensions->cExtension;
2378 info->rgExtension = pExtensions->rgExtension;
2382 info->cExtension = 0;
2383 info->rgExtension = NULL;
2387 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
2388 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
2389 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
2391 static HCRYPTPROV CRYPT_CreateKeyProv(void)
2393 HCRYPTPROV hProv = 0;
2394 HMODULE rpcrt = LoadLibraryA("rpcrt4");
2398 UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
2400 UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
2402 RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
2403 rpcrt, "RpcStringFreeA");
2405 if (uuidCreate && uuidToString && rpcStringFree)
2408 RPC_STATUS status = uuidCreate(&uuid);
2410 if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
2412 unsigned char *uuidStr;
2414 status = uuidToString(&uuid, &uuidStr);
2415 if (status == RPC_S_OK)
2417 BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
2418 MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
2424 ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
2426 CryptDestroyKey(key);
2428 rpcStringFree(&uuidStr);
2437 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
2438 PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
2439 PCRYPT_KEY_PROV_INFO pKeyProvInfo,
2440 PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
2441 PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
2443 PCCERT_CONTEXT context = NULL;
2444 BOOL ret, releaseContext = FALSE;
2445 PCERT_PUBLIC_KEY_INFO pubKey = NULL;
2446 DWORD pubKeySize = 0,dwKeySpec = AT_SIGNATURE;
2448 TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
2449 pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
2450 pExtensions, pExtensions);
2452 if(!pSubjectIssuerBlob)
2454 SetLastError(ERROR_INVALID_PARAMETER);
2462 hProv = CRYPT_CreateKeyProv();
2463 releaseContext = TRUE;
2465 else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
2467 SetLastError(NTE_BAD_FLAGS);
2473 /* acquire the context using the given information*/
2474 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
2475 pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
2476 pKeyProvInfo->dwFlags);
2479 if(GetLastError() != NTE_BAD_KEYSET)
2481 /* create the key set */
2482 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
2483 pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
2484 pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
2488 dwKeySpec = pKeyProvInfo->dwKeySpec;
2489 /* check if the key is here */
2490 ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
2493 if (NTE_NO_KEY == GetLastError())
2494 { /* generate the key */
2495 ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
2499 CryptReleaseContext(hProv,0);
2500 SetLastError(NTE_BAD_KEYSET);
2504 CryptDestroyKey(hKey);
2505 releaseContext = TRUE;
2508 else if (pKeyProvInfo)
2510 SetLastError(ERROR_INVALID_PARAMETER);
2514 CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
2516 pubKey = CryptMemAlloc(pubKeySize);
2519 ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
2520 pubKey, &pubKeySize);
2523 CERT_INFO info = { 0 };
2524 CRYPT_DER_BLOB blob = { 0, NULL };
2526 CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
2528 CryptGenRandom(hProv, sizeof(serial), serial);
2529 CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
2530 pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
2531 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
2532 &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, (BYTE *)&blob.pbData,
2536 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
2537 context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
2538 &info.SignatureAlgorithm);
2540 context = CertCreateCertificateContext(X509_ASN_ENCODING,
2541 blob.pbData, blob.cbData);
2542 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
2543 CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
2544 LocalFree(blob.pbData);
2547 CryptMemFree(pubKey);
2550 CryptReleaseContext(hProv, 0);