git.oblomov.eu Git - wine/blob - dlls/crypt32/tests/cert.c

   1 /*
   2  * crypt32 cert functions tests
   3  *
   4  * Copyright 2005-2006 Juan Lang
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  */
  20
  21 #include <assert.h>
  22 #include <stdio.h>
  23 #include <stdarg.h>
  24 #include <windef.h>
  25 #include <winbase.h>
  26 #include <winreg.h>
  27 #include <winerror.h>
  28 #include <wincrypt.h>
  29
  30 #include "wine/test.h"
  31
  32 static BOOL (WINAPI * pCryptVerifyCertificateSignatureEx)
  33                         (HCRYPTPROV, DWORD, DWORD, void *, DWORD, void *, DWORD, void *);
  34
  35 static BOOL (WINAPI * pCryptAcquireContextW)
  36                         (HCRYPTPROV *, LPCWSTR, LPCWSTR, DWORD, DWORD);
  37
  38 static void init_function_pointers(void)
  39 {
  40     HMODULE hCrypt32 = GetModuleHandleA("crypt32.dll");
  41     HMODULE hAdvapi32 = GetModuleHandleA("advapi32.dll");
  42
  43 #define GET_PROC(dll, func) \
  44     p ## func = (void *)GetProcAddress(dll, #func); \
  45     if(!p ## func) \
  46       trace("GetProcAddress(%s) failed\n", #func);
  47
  48     GET_PROC(hCrypt32, CryptVerifyCertificateSignatureEx)
  49
  50     GET_PROC(hAdvapi32, CryptAcquireContextW)
  51
  52 #undef GET_PROC
  53 }
  54
  55 static BYTE subjectName[] = { 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06,
  56  0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61,
  57  0x6e, 0x67, 0x00 };
  58 static BYTE serialNum[] = { 1 };
  59 static const BYTE bigCert[] = { 0x30, 0x7a, 0x02, 0x01, 0x01, 0x30, 0x02, 0x06,
  60  0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
  61  0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x22,
  62  0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30,
  63  0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
  64  0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30,
  65  0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20,
  66  0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03, 0x01,
  67  0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
  68  0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x01 };
  69 static BYTE bigCertHash[] = { 0x6e, 0x30, 0x90, 0x71, 0x5f, 0xd9, 0x23,
  70  0x56, 0xeb, 0xae, 0x25, 0x40, 0xe6, 0x22, 0xda, 0x19, 0x26, 0x02, 0xa6, 0x08 };
  71
  72 static const BYTE bigCertWithDifferentSubject[] = { 0x30, 0x7a, 0x02, 0x01, 0x02,
  73  0x30, 0x02, 0x06, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55,
  74  0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67,
  75  0x00, 0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31,
  76  0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31,
  77  0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15,
  78  0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c,
  79  0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06,
  80  0x00, 0x03, 0x01, 0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55,
  81  0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02,
  82  0x01, 0x01 };
  83 static const BYTE bigCertWithDifferentIssuer[] = { 0x30, 0x7a, 0x02, 0x01,
  84  0x01, 0x30, 0x02, 0x06, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
  85  0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e,
  86  0x67, 0x00, 0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
  87  0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30,
  88  0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30,
  89  0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a,
  90  0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02,
  91  0x06, 0x00, 0x03, 0x01, 0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03,
  92  0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff,
  93  0x02, 0x01, 0x01 };
  94
  95 static BYTE subjectName2[] = { 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06,
  96  0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61,
  97  0x6e, 0x67, 0x00 };
  98 static const BYTE bigCert2[] = { 0x30, 0x7a, 0x02, 0x01, 0x01, 0x30, 0x02, 0x06,
  99  0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
 100  0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x22,
 101  0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30,
 102  0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
 103  0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30,
 104  0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20,
 105  0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03, 0x01,
 106  0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
 107  0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x01 };
 108 static const BYTE bigCert2WithDifferentSerial[] = { 0x30, 0x7a, 0x02, 0x01,
 109  0x02, 0x30, 0x02, 0x06, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
 110  0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e,
 111  0x67, 0x00, 0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
 112  0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30,
 113  0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30,
 114  0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x41,
 115  0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02,
 116  0x06, 0x00, 0x03, 0x01, 0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03,
 117  0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff,
 118  0x02, 0x01, 0x01 };
 119 static BYTE bigCert2Hash[] = { 0x4a, 0x7f, 0x32, 0x1f, 0xcf, 0x3b, 0xc0,
 120  0x87, 0x48, 0x2b, 0xa1, 0x86, 0x54, 0x18, 0xe4, 0x3a, 0x0e, 0x53, 0x7e, 0x2b };
 121
 122 static const BYTE certWithUsage[] = { 0x30, 0x81, 0x93, 0x02, 0x01, 0x01, 0x30,
 123  0x02, 0x06, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04,
 124  0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00,
 125  0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30,
 126  0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30,
 127  0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15, 0x31,
 128  0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61,
 129  0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00,
 130  0x03, 0x01, 0x00, 0xa3, 0x2f, 0x30, 0x2d, 0x30, 0x2b, 0x06, 0x03, 0x55, 0x1d,
 131  0x25, 0x01, 0x01, 0xff, 0x04, 0x21, 0x30, 0x1f, 0x06, 0x08, 0x2b, 0x06, 0x01,
 132  0x05, 0x05, 0x07, 0x03, 0x03, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
 133  0x03, 0x02, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01 };
 134
 135 static void testAddCert(void)
 136 {
 137     HCERTSTORE store;
 138     HCERTSTORE collection;
 139     PCCERT_CONTEXT context;
 140     PCCERT_CONTEXT copyContext;
 141     BOOL ret;
 142
 143     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
 144      CERT_STORE_CREATE_NEW_FLAG, NULL);
 145     ok(store != NULL, "CertOpenStore failed: %d\n", GetLastError());
 146     if (!store)
 147         return;
 148
 149     /* Weird--bad add disposition leads to an access violation in Windows.
 150      */
 151     ret = CertAddEncodedCertificateToStore(0, X509_ASN_ENCODING, bigCert,
 152      sizeof(bigCert), 0, NULL);
 153     ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
 154      "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
 155     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 156      bigCert, sizeof(bigCert), 0, NULL);
 157     ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
 158      "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
 159
 160     /* Weird--can add a cert to the NULL store (does this have special
 161      * meaning?)
 162      */
 163     context = NULL;
 164     ret = CertAddEncodedCertificateToStore(0, X509_ASN_ENCODING, bigCert,
 165      sizeof(bigCert), CERT_STORE_ADD_ALWAYS, &context);
 166     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 167      GetLastError());
 168     if (context)
 169         CertFreeCertificateContext(context);
 170
 171     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 172      bigCert, sizeof(bigCert), CERT_STORE_ADD_ALWAYS, NULL);
 173     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 174      GetLastError());
 175     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 176      bigCert2, sizeof(bigCert2), CERT_STORE_ADD_NEW, NULL);
 177     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 178      GetLastError());
 179     /* This has the same name as bigCert, so finding isn't done by name */
 180     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 181      certWithUsage, sizeof(certWithUsage), CERT_STORE_ADD_NEW, &context);
 182     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 183      GetLastError());
 184     ok(context != NULL, "Expected a context\n");
 185     if (context)
 186     {
 187         CRYPT_DATA_BLOB hash = { sizeof(bigCert2Hash), bigCert2Hash };
 188
 189         /* Duplicate (AddRef) the context so we can still use it after
 190          * deleting it from the store.
 191          */
 192         CertDuplicateCertificateContext(context);
 193         CertDeleteCertificateFromStore(context);
 194         /* Set the same hash as bigCert2, and try to readd it */
 195         ret = CertSetCertificateContextProperty(context, CERT_HASH_PROP_ID,
 196          0, &hash);
 197         ok(ret, "CertSetCertificateContextProperty failed: %08x\n",
 198          GetLastError());
 199         ret = CertAddCertificateContextToStore(store, context,
 200          CERT_STORE_ADD_NEW, NULL);
 201         /* The failure is a bit odd (CRYPT_E_ASN1_BADTAG), so just check
 202          * that it fails.
 203          */
 204         ok(!ret, "Expected failure\n");
 205         CertFreeCertificateContext(context);
 206     }
 207     context = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert2,
 208      sizeof(bigCert2));
 209     ok(context != NULL, "Expected a context\n");
 210     if (context)
 211     {
 212         /* Try to readd bigCert2 to the store */
 213         ret = CertAddCertificateContextToStore(store, context,
 214          CERT_STORE_ADD_NEW, NULL);
 215         ok(!ret && GetLastError() == CRYPT_E_EXISTS,
 216          "Expected CRYPT_E_EXISTS, got %08x\n", GetLastError());
 217         CertFreeCertificateContext(context);
 218     }
 219
 220     /* Adding a cert with the same issuer name and serial number (but
 221      * different subject) as an existing cert succeeds.
 222      */
 223     context = NULL;
 224     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 225      bigCert2WithDifferentSerial, sizeof(bigCert2WithDifferentSerial),
 226      CERT_STORE_ADD_NEW, &context);
 227     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 228      GetLastError());
 229     if (context)
 230         CertDeleteCertificateFromStore(context);
 231
 232     /* Adding a cert with the same subject name and serial number (but
 233      * different issuer) as an existing cert succeeds.
 234      */
 235     context = NULL;
 236     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 237      bigCertWithDifferentSubject, sizeof(bigCertWithDifferentSubject),
 238      CERT_STORE_ADD_NEW, &context);
 239     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 240      GetLastError());
 241     if (context)
 242         CertDeleteCertificateFromStore(context);
 243
 244     /* Adding a cert with the same issuer name and serial number (but
 245      * different otherwise) as an existing cert succeeds.
 246      */
 247     context = NULL;
 248     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 249      bigCertWithDifferentIssuer, sizeof(bigCertWithDifferentIssuer),
 250      CERT_STORE_ADD_NEW, &context);
 251     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 252      GetLastError());
 253     if (context)
 254         CertDeleteCertificateFromStore(context);
 255
 256     collection = CertOpenStore(CERT_STORE_PROV_COLLECTION, 0, 0,
 257      CERT_STORE_CREATE_NEW_FLAG, NULL);
 258     ok(collection != NULL, "CertOpenStore failed: %08x\n", GetLastError());
 259     if (collection)
 260     {
 261         /* Add store to the collection, but disable updates */
 262         CertAddStoreToCollection(collection, store, 0, 0);
 263
 264         context = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert2,
 265          sizeof(bigCert2));
 266         ok(context != NULL, "Expected a context\n");
 267         if (context)
 268         {
 269             /* Try to readd bigCert2 to the collection */
 270             ret = CertAddCertificateContextToStore(collection, context,
 271              CERT_STORE_ADD_NEW, NULL);
 272             ok(!ret && GetLastError() == CRYPT_E_EXISTS,
 273              "Expected CRYPT_E_EXISTS, got %08x\n", GetLastError());
 274             /* Replacing an existing certificate context is allowed, even
 275              * though updates to the collection aren't..
 276              */
 277             ret = CertAddCertificateContextToStore(collection, context,
 278              CERT_STORE_ADD_REPLACE_EXISTING, NULL);
 279             ok(ret, "CertAddCertificateContextToStore failed: %08x\n",
 280              GetLastError());
 281             /* use the existing certificate and ask for a copy of the context*/
 282             copyContext = NULL;
 283             ret = CertAddCertificateContextToStore(collection, context,
 284              CERT_STORE_ADD_USE_EXISTING, &copyContext);
 285             ok(ret, "CertAddCertificateContextToStore failed: %08x\n",
 286              GetLastError());
 287             ok(copyContext != NULL, "Expected on output a non NULL copyContext\n");
 288             if (copyContext)
 289                 CertFreeCertificateContext(copyContext);
 290             /* but adding a new certificate isn't allowed. */
 291             ret = CertAddCertificateContextToStore(collection, context,
 292              CERT_STORE_ADD_ALWAYS, NULL);
 293             ok(!ret && GetLastError() == E_ACCESSDENIED,
 294              "Expected E_ACCESSDENIED, got %08x\n", GetLastError());
 295             CertFreeCertificateContext(context);
 296         }
 297
 298         CertCloseStore(collection, 0);
 299     }
 300
 301     CertCloseStore(store, 0);
 302 }
 303
 304 static void checkHash(const BYTE *data, DWORD dataLen, ALG_ID algID,
 305  PCCERT_CONTEXT context, DWORD propID)
 306 {
 307     BYTE hash[20] = { 0 }, hashProperty[20];
 308     BOOL ret;
 309     DWORD size;
 310     DWORD dwSizeWithNull;
 311
 312     memset(hash, 0, sizeof(hash));
 313     memset(hashProperty, 0, sizeof(hashProperty));
 314     size = sizeof(hash);
 315     ret = CryptHashCertificate(0, algID, 0, data, dataLen, hash, &size);
 316     ok(ret, "CryptHashCertificate failed: %08x\n", GetLastError());
 317     ret = CertGetCertificateContextProperty(context, propID, NULL,
 318      &dwSizeWithNull);
 319     ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
 320      GetLastError());
 321     ret = CertGetCertificateContextProperty(context, propID, hashProperty,
 322      &size);
 323     ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
 324      GetLastError());
 325     ok(!memcmp(hash, hashProperty, size), "Unexpected hash for property %d\n",
 326      propID);
 327     ok(size == dwSizeWithNull, "Unexpected length of hash for property: received %d instead of %d\n",
 328      dwSizeWithNull,size);
 329 }
 330
 331 static WCHAR cspNameW[] = { 'W','i','n','e','C','r','y','p','t','T','e','m','p',0 };
 332 static const BYTE v1CertWithPubKey[] = {
 333 0x30,0x81,0x95,0x02,0x01,0x01,0x30,0x02,0x06,0x00,0x30,0x15,0x31,0x13,0x30,
 334 0x11,0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,
 335 0x6e,0x67,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,0x31,
 336 0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,
 337 0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x15,0x31,0x13,0x30,0x11,
 338 0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,
 339 0x67,0x00,0x30,0x22,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,
 340 0x01,0x01,0x05,0x00,0x03,0x11,0x00,0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,
 341 0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f,0xa3,0x16,0x30,0x14,0x30,0x12,0x06,
 342 0x03,0x55,0x1d,0x13,0x01,0x01,0xff,0x04,0x08,0x30,0x06,0x01,0x01,0xff,0x02,
 343 0x01,0x01 };
 344 static const BYTE v1CertWithSubjectKeyId[] = {
 345 0x30,0x7b,0x02,0x01,0x01,0x30,0x02,0x06,0x00,0x30,0x15,0x31,0x13,0x30,0x11,
 346 0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,
 347 0x67,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,0x31,0x30,
 348 0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,
 349 0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x15,0x31,0x13,0x30,0x11,0x06,
 350 0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,
 351 0x00,0x30,0x07,0x30,0x02,0x06,0x00,0x03,0x01,0x00,0xa3,0x17,0x30,0x15,0x30,
 352 0x13,0x06,0x03,0x55,0x1d,0x0e,0x04,0x0c,0x04,0x0a,0x4a,0x75,0x61,0x6e,0x20,
 353 0x4c,0x61,0x6e,0x67,0x00 };
 354 static const BYTE subjectKeyId[] = {
 355 0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x00 };
 356
 357 static void testCertProperties(void)
 358 {
 359     PCCERT_CONTEXT context = CertCreateCertificateContext(X509_ASN_ENCODING,
 360      bigCert, sizeof(bigCert));
 361     DWORD propID, numProps, access, size;
 362     BOOL ret;
 363     BYTE hash[20] = { 0 }, hashProperty[20];
 364     CRYPT_DATA_BLOB blob;
 365     CERT_KEY_CONTEXT keyContext;
 366
 367     ok(context != NULL, "CertCreateCertificateContext failed: %08x\n",
 368      GetLastError());
 369     if (!context)
 370         return;
 371
 372     /* This crashes
 373     propID = CertEnumCertificateContextProperties(NULL, 0);
 374      */
 375
 376     propID = 0;
 377     numProps = 0;
 378     do {
 379         propID = CertEnumCertificateContextProperties(context, propID);
 380         if (propID)
 381             numProps++;
 382     } while (propID != 0);
 383     ok(numProps == 0, "Expected 0 properties, got %d\n", numProps);
 384
 385     /* Tests with a NULL cert context.  Prop ID 0 fails.. */
 386     ret = CertSetCertificateContextProperty(NULL, 0, 0, NULL);
 387     ok(!ret && GetLastError() == E_INVALIDARG,
 388      "Expected E_INVALIDARG, got %08x\n", GetLastError());
 389     /* while this just crashes.
 390     ret = CertSetCertificateContextProperty(NULL,
 391      CERT_KEY_PROV_HANDLE_PROP_ID, 0, NULL);
 392      */
 393
 394     ret = CertSetCertificateContextProperty(context, 0, 0, NULL);
 395     ok(!ret && GetLastError() == E_INVALIDARG,
 396      "Expected E_INVALIDARG, got %08x\n", GetLastError());
 397     /* Can't set the cert property directly, this crashes.
 398     ret = CertSetCertificateContextProperty(context,
 399      CERT_CERT_PROP_ID, 0, bigCert2);
 400      */
 401
 402     /* These all crash.
 403     ret = CertGetCertificateContextProperty(context,
 404      CERT_ACCESS_STATE_PROP_ID, 0, NULL);
 405     ret = CertGetCertificateContextProperty(context, CERT_HASH_PROP_ID,
 406      NULL, NULL);
 407     ret = CertGetCertificateContextProperty(context, CERT_HASH_PROP_ID,
 408      hashProperty, NULL);
 409      */
 410     /* A missing prop */
 411     size = 0;
 412     ret = CertGetCertificateContextProperty(context,
 413      CERT_KEY_PROV_INFO_PROP_ID, NULL, &size);
 414     ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
 415      "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
 416     /* And, an implicit property */
 417     size = sizeof(access);
 418     ret = CertGetCertificateContextProperty(context,
 419      CERT_ACCESS_STATE_PROP_ID, &access, &size);
 420     ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
 421      GetLastError());
 422     ok(!(access & CERT_ACCESS_STATE_WRITE_PERSIST_FLAG),
 423      "Didn't expect a persisted cert\n");
 424     /* Trying to set this "read only" property crashes.
 425     access |= CERT_ACCESS_STATE_WRITE_PERSIST_FLAG;
 426     ret = CertSetCertificateContextProperty(context,
 427      CERT_ACCESS_STATE_PROP_ID, 0, &access);
 428      */
 429
 430     /* Can I set the hash to an invalid hash? */
 431     blob.pbData = hash;
 432     blob.cbData = sizeof(hash);
 433     ret = CertSetCertificateContextProperty(context, CERT_HASH_PROP_ID, 0,
 434      &blob);
 435     ok(ret, "CertSetCertificateContextProperty failed: %08x\n",
 436      GetLastError());
 437     size = sizeof(hashProperty);
 438     ret = CertGetCertificateContextProperty(context, CERT_HASH_PROP_ID,
 439      hashProperty, &size);
 440     ok(!memcmp(hashProperty, hash, sizeof(hash)), "Unexpected hash\n");
 441     /* Delete the (bogus) hash, and get the real one */
 442     ret = CertSetCertificateContextProperty(context, CERT_HASH_PROP_ID, 0,
 443      NULL);
 444     ok(ret, "CertSetCertificateContextProperty failed: %08x\n",
 445      GetLastError());
 446     checkHash(bigCert, sizeof(bigCert), CALG_SHA1, context,
 447      CERT_HASH_PROP_ID);
 448
 449     /* Now that the hash property is set, we should get one property when
 450      * enumerating.
 451      */
 452     propID = 0;
 453     numProps = 0;
 454     do {
 455         propID = CertEnumCertificateContextProperties(context, propID);
 456         if (propID)
 457             numProps++;
 458     } while (propID != 0);
 459     ok(numProps == 1, "Expected 1 properties, got %d\n", numProps);
 460
 461     /* Check a few other implicit properties */
 462     checkHash(bigCert, sizeof(bigCert), CALG_MD5, context,
 463      CERT_MD5_HASH_PROP_ID);
 464     checkHash(
 465      context->pCertInfo->Subject.pbData,
 466      context->pCertInfo->Subject.cbData,
 467      CALG_MD5, context, CERT_SUBJECT_NAME_MD5_HASH_PROP_ID);
 468     checkHash(
 469      context->pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
 470      context->pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
 471      CALG_MD5, context, CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID);
 472
 473     /* Test key contexts and handles and such */
 474     size = 0;
 475     ret = CertGetCertificateContextProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 476      NULL, &size);
 477     ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
 478      "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
 479     size = sizeof(CERT_KEY_CONTEXT);
 480     ret = CertGetCertificateContextProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 481      NULL, &size);
 482     ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
 483      "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
 484     ret = CertGetCertificateContextProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 485      &keyContext, &size);
 486     ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
 487      "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
 488     /* Key context with an invalid size */
 489     keyContext.cbSize = 0;
 490     ret = CertSetCertificateContextProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 491      0, &keyContext);
 492     ok(!ret && GetLastError() == E_INVALIDARG,
 493      "Expected E_INVALIDARG, got %08x\n", GetLastError());
 494     size = sizeof(keyContext);
 495     ret = CertGetCertificateContextProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 496      &keyContext, &size);
 497     ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
 498      "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
 499     keyContext.cbSize = sizeof(keyContext);
 500     keyContext.hCryptProv = 0;
 501     keyContext.dwKeySpec = AT_SIGNATURE;
 502     ret = CertSetCertificateContextProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 503      0, &keyContext);
 504     ok(ret, "CertSetCertificateContextProperty failed: %08x\n", GetLastError());
 505     /* Now that that's set, the key prov handle property is also gettable.
 506      */
 507     size = sizeof(DWORD);
 508     ret = CertGetCertificateContextProperty(context,
 509      CERT_KEY_PROV_HANDLE_PROP_ID, &keyContext.hCryptProv, &size);
 510     ok(ret, "Expected to get the CERT_KEY_PROV_HANDLE_PROP_ID, got %08x\n",
 511      GetLastError());
 512     /* Remove the key prov handle property.. */
 513     ret = CertSetCertificateContextProperty(context,
 514      CERT_KEY_PROV_HANDLE_PROP_ID, 0, NULL);
 515     ok(ret, "CertSetCertificateContextProperty failed: %08x\n",
 516      GetLastError());
 517     /* and the key context's CSP is set to NULL. */
 518     size = sizeof(keyContext);
 519     ret = CertGetCertificateContextProperty(context,
 520      CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
 521     ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
 522      GetLastError());
 523     ok(keyContext.hCryptProv == 0, "Expected no hCryptProv\n");
 524
 525     /* According to MSDN the subject key id can be stored as a property,
 526      * as a subject key extension, or as the SHA1 hash of the public key,
 527      * but this cert has none of them:
 528      */
 529     ret = CertGetCertificateContextProperty(context,
 530      CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
 531     ok(!ret && GetLastError() == ERROR_INVALID_DATA,
 532      "Expected ERROR_INVALID_DATA, got %08x\n", GetLastError());
 533     CertFreeCertificateContext(context);
 534     /* This cert does have a public key, but its subject key identifier still
 535      * isn't available: */
 536     context = CertCreateCertificateContext(X509_ASN_ENCODING,
 537      v1CertWithPubKey, sizeof(v1CertWithPubKey));
 538     ret = CertGetCertificateContextProperty(context,
 539      CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
 540     ok(!ret && GetLastError() == ERROR_INVALID_DATA,
 541      "Expected ERROR_INVALID_DATA, got %08x\n", GetLastError());
 542     CertFreeCertificateContext(context);
 543     /* This cert with a subject key extension can have its key identifier
 544      * property retrieved:
 545      */
 546     context = CertCreateCertificateContext(X509_ASN_ENCODING,
 547      v1CertWithSubjectKeyId, sizeof(v1CertWithSubjectKeyId));
 548     ret = CertGetCertificateContextProperty(context,
 549      CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
 550     ok(ret, "CertGetCertificateContextProperty failed: %08x\n", GetLastError());
 551     if (ret)
 552     {
 553         LPBYTE buf = HeapAlloc(GetProcessHeap(), 0, size);
 554
 555         if (buf)
 556         {
 557             ret = CertGetCertificateContextProperty(context,
 558              CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
 559             ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
 560              GetLastError());
 561             ok(!memcmp(buf, subjectKeyId, size), "Unexpected subject key id\n");
 562             HeapFree(GetProcessHeap(), 0, buf);
 563         }
 564     }
 565     CertFreeCertificateContext(context);
 566 }
 567
 568 static void testDupCert(void)
 569 {
 570     HCERTSTORE store;
 571     PCCERT_CONTEXT context, dupContext;
 572     BOOL ret;
 573
 574     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
 575      CERT_STORE_CREATE_NEW_FLAG, NULL);
 576     ok(store != NULL, "CertOpenStore failed: %d\n", GetLastError());
 577     if (!store)
 578         return;
 579
 580     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 581      bigCert, sizeof(bigCert), CERT_STORE_ADD_ALWAYS, &context);
 582     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 583      GetLastError());
 584     ok(context != NULL, "Expected a valid cert context\n");
 585     if (context)
 586     {
 587         ok(context->cbCertEncoded == sizeof(bigCert),
 588          "Wrong cert size %d\n", context->cbCertEncoded);
 589         ok(!memcmp(context->pbCertEncoded, bigCert, sizeof(bigCert)),
 590          "Unexpected encoded cert in context\n");
 591         ok(context->hCertStore == store, "Unexpected store\n");
 592
 593         dupContext = CertDuplicateCertificateContext(context);
 594         ok(dupContext != NULL, "Expected valid duplicate\n");
 595         /* Not only is it a duplicate, it's identical: the address is the
 596          * same.
 597          */
 598         ok(dupContext == context, "Expected identical context addresses\n");
 599         CertFreeCertificateContext(dupContext);
 600         CertFreeCertificateContext(context);
 601     }
 602     CertCloseStore(store, 0);
 603 }
 604
 605 static BYTE subjectName3[] = { 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06,
 606  0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x52, 0x6f, 0x62, 0x20, 0x20, 0x4c, 0x61,
 607  0x6e, 0x67, 0x00 };
 608 static const BYTE iTunesCert0[] = {
 609 0x30,0x82,0x03,0xc4,0x30,0x82,0x03,0x2d,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 610 0x47,0xbf,0x19,0x95,0xdf,0x8d,0x52,0x46,0x43,0xf7,0xdb,0x6d,0x48,0x0d,0x31,
 611 0xa4,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 612 0x00,0x30,0x81,0x8b,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,
 613 0x5a,0x41,0x31,0x15,0x30,0x13,0x06,0x03,0x55,0x04,0x08,0x13,0x0c,0x57,0x65,
 614 0x73,0x74,0x65,0x72,0x6e,0x20,0x43,0x61,0x70,0x65,0x31,0x14,0x30,0x12,0x06,
 615 0x03,0x55,0x04,0x07,0x13,0x0b,0x44,0x75,0x72,0x62,0x61,0x6e,0x76,0x69,0x6c,
 616 0x6c,0x65,0x31,0x0f,0x30,0x0d,0x06,0x03,0x55,0x04,0x0a,0x13,0x06,0x54,0x68,
 617 0x61,0x77,0x74,0x65,0x31,0x1d,0x30,0x1b,0x06,0x03,0x55,0x04,0x0b,0x13,0x14,
 618 0x54,0x68,0x61,0x77,0x74,0x65,0x20,0x43,0x65,0x72,0x74,0x69,0x66,0x69,0x63,
 619 0x61,0x74,0x69,0x6f,0x6e,0x31,0x1f,0x30,0x1d,0x06,0x03,0x55,0x04,0x03,0x13,
 620 0x16,0x54,0x68,0x61,0x77,0x74,0x65,0x20,0x54,0x69,0x6d,0x65,0x73,0x74,0x61,
 621 0x6d,0x70,0x69,0x6e,0x67,0x20,0x43,0x41,0x30,0x1e,0x17,0x0d,0x30,0x33,0x31,
 622 0x32,0x30,0x34,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x31,0x33,0x31,
 623 0x32,0x30,0x33,0x32,0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x53,0x31,0x0b,0x30,
 624 0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x17,0x30,0x15,0x06,
 625 0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x2c,
 626 0x20,0x49,0x6e,0x63,0x2e,0x31,0x2b,0x30,0x29,0x06,0x03,0x55,0x04,0x03,0x13,
 627 0x22,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x20,0x54,0x69,0x6d,0x65,0x20,
 628 0x53,0x74,0x61,0x6d,0x70,0x69,0x6e,0x67,0x20,0x53,0x65,0x72,0x76,0x69,0x63,
 629 0x65,0x73,0x20,0x43,0x41,0x30,0x82,0x01,0x22,0x30,0x0d,0x06,0x09,0x2a,0x86,
 630 0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x82,0x01,0x0f,0x00,0x30,
 631 0x82,0x01,0x0a,0x02,0x82,0x01,0x01,0x00,0xa9,0xca,0xb2,0xa4,0xcc,0xcd,0x20,
 632 0xaf,0x0a,0x7d,0x89,0xac,0x87,0x75,0xf0,0xb4,0x4e,0xf1,0xdf,0xc1,0x0f,0xbf,
 633 0x67,0x61,0xbd,0xa3,0x64,0x1c,0xda,0xbb,0xf9,0xca,0x33,0xab,0x84,0x30,0x89,
 634 0x58,0x7e,0x8c,0xdb,0x6b,0xdd,0x36,0x9e,0x0f,0xbf,0xd1,0xec,0x78,0xf2,0x77,
 635 0xa6,0x7e,0x6f,0x3c,0xbf,0x93,0xaf,0x0d,0xba,0x68,0xf4,0x6c,0x94,0xca,0xbd,
 636 0x52,0x2d,0xab,0x48,0x3d,0xf5,0xb6,0xd5,0x5d,0x5f,0x1b,0x02,0x9f,0xfa,0x2f,
 637 0x6b,0x1e,0xa4,0xf7,0xa3,0x9a,0xa6,0x1a,0xc8,0x02,0xe1,0x7f,0x4c,0x52,0xe3,
 638 0x0e,0x60,0xec,0x40,0x1c,0x7e,0xb9,0x0d,0xde,0x3f,0xc7,0xb4,0xdf,0x87,0xbd,
 639 0x5f,0x7a,0x6a,0x31,0x2e,0x03,0x99,0x81,0x13,0xa8,0x47,0x20,0xce,0x31,0x73,
 640 0x0d,0x57,0x2d,0xcd,0x78,0x34,0x33,0x95,0x12,0x99,0x12,0xb9,0xde,0x68,0x2f,
 641 0xaa,0xe6,0xe3,0xc2,0x8a,0x8c,0x2a,0xc3,0x8b,0x21,0x87,0x66,0xbd,0x83,0x58,
 642 0x57,0x6f,0x75,0xbf,0x3c,0xaa,0x26,0x87,0x5d,0xca,0x10,0x15,0x3c,0x9f,0x84,
 643 0xea,0x54,0xc1,0x0a,0x6e,0xc4,0xfe,0xc5,0x4a,0xdd,0xb9,0x07,0x11,0x97,0x22,
 644 0x7c,0xdb,0x3e,0x27,0xd1,0x1e,0x78,0xec,0x9f,0x31,0xc9,0xf1,0xe6,0x22,0x19,
 645 0xdb,0xc4,0xb3,0x47,0x43,0x9a,0x1a,0x5f,0xa0,0x1e,0x90,0xe4,0x5e,0xf5,0xee,
 646 0x7c,0xf1,0x7d,0xab,0x62,0x01,0x8f,0xf5,0x4d,0x0b,0xde,0xd0,0x22,0x56,0xa8,
 647 0x95,0xcd,0xae,0x88,0x76,0xae,0xee,0xba,0x0d,0xf3,0xe4,0x4d,0xd9,0xa0,0xfb,
 648 0x68,0xa0,0xae,0x14,0x3b,0xb3,0x87,0xc1,0xbb,0x02,0x03,0x01,0x00,0x01,0xa3,
 649 0x81,0xdb,0x30,0x81,0xd8,0x30,0x34,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,
 650 0x01,0x01,0x04,0x28,0x30,0x26,0x30,0x24,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,
 651 0x07,0x30,0x01,0x86,0x18,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x6f,0x63,0x73,
 652 0x70,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x30,
 653 0x12,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,0xff,0x04,0x08,0x30,0x06,0x01,0x01,
 654 0xff,0x02,0x01,0x00,0x30,0x41,0x06,0x03,0x55,0x1d,0x1f,0x04,0x3a,0x30,0x38,
 655 0x30,0x36,0xa0,0x34,0xa0,0x32,0x86,0x30,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,
 656 0x63,0x72,0x6c,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,
 657 0x6d,0x2f,0x54,0x68,0x61,0x77,0x74,0x65,0x54,0x69,0x6d,0x65,0x73,0x74,0x61,
 658 0x6d,0x70,0x69,0x6e,0x67,0x43,0x41,0x2e,0x63,0x72,0x6c,0x30,0x13,0x06,0x03,
 659 0x55,0x1d,0x25,0x04,0x0c,0x30,0x0a,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,
 660 0x03,0x08,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,0x01,0xff,0x04,0x04,0x03,
 661 0x02,0x01,0x06,0x30,0x24,0x06,0x03,0x55,0x1d,0x11,0x04,0x1d,0x30,0x1b,0xa4,
 662 0x19,0x30,0x17,0x31,0x15,0x30,0x13,0x06,0x03,0x55,0x04,0x03,0x13,0x0c,0x54,
 663 0x53,0x41,0x32,0x30,0x34,0x38,0x2d,0x31,0x2d,0x35,0x33,0x30,0x0d,0x06,0x09,
 664 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,
 665 0x4a,0x6b,0xf9,0xea,0x58,0xc2,0x44,0x1c,0x31,0x89,0x79,0x99,0x2b,0x96,0xbf,
 666 0x82,0xac,0x01,0xd6,0x1c,0x4c,0xcd,0xb0,0x8a,0x58,0x6e,0xdf,0x08,0x29,0xa3,
 667 0x5e,0xc8,0xca,0x93,0x13,0xe7,0x04,0x52,0x0d,0xef,0x47,0x27,0x2f,0x00,0x38,
 668 0xb0,0xe4,0xc9,0x93,0x4e,0x9a,0xd4,0x22,0x62,0x15,0xf7,0x3f,0x37,0x21,0x4f,
 669 0x70,0x31,0x80,0xf1,0x8b,0x38,0x87,0xb3,0xe8,0xe8,0x97,0x00,0xfe,0xcf,0x55,
 670 0x96,0x4e,0x24,0xd2,0xa9,0x27,0x4e,0x7a,0xae,0xb7,0x61,0x41,0xf3,0x2a,0xce,
 671 0xe7,0xc9,0xd9,0x5e,0xdd,0xbb,0x2b,0x85,0x3e,0xb5,0x9d,0xb5,0xd9,0xe1,0x57,
 672 0xff,0xbe,0xb4,0xc5,0x7e,0xf5,0xcf,0x0c,0x9e,0xf0,0x97,0xfe,0x2b,0xd3,0x3b,
 673 0x52,0x1b,0x1b,0x38,0x27,0xf7,0x3f,0x4a };
 674 static const BYTE iTunesCert1[] = {
 675 0x30,0x82,0x03,0xff,0x30,0x82,0x02,0xe7,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 676 0x0d,0xe9,0x2b,0xf0,0xd4,0xd8,0x29,0x88,0x18,0x32,0x05,0x09,0x5e,0x9a,0x76,
 677 0x88,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 678 0x00,0x30,0x53,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,
 679 0x53,0x31,0x17,0x30,0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,
 680 0x69,0x53,0x69,0x67,0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x2b,0x30,0x29,
 681 0x06,0x03,0x55,0x04,0x03,0x13,0x22,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,
 682 0x20,0x54,0x69,0x6d,0x65,0x20,0x53,0x74,0x61,0x6d,0x70,0x69,0x6e,0x67,0x20,
 683 0x53,0x65,0x72,0x76,0x69,0x63,0x65,0x73,0x20,0x43,0x41,0x30,0x1e,0x17,0x0d,
 684 0x30,0x33,0x31,0x32,0x30,0x34,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,
 685 0x30,0x38,0x31,0x32,0x30,0x33,0x32,0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x57,
 686 0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x17,
 687 0x30,0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,0x69,0x53,0x69,
 688 0x67,0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x2f,0x30,0x2d,0x06,0x03,0x55,
 689 0x04,0x03,0x13,0x26,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x20,0x54,0x69,
 690 0x6d,0x65,0x20,0x53,0x74,0x61,0x6d,0x70,0x69,0x6e,0x67,0x20,0x53,0x65,0x72,
 691 0x76,0x69,0x63,0x65,0x73,0x20,0x53,0x69,0x67,0x6e,0x65,0x72,0x30,0x82,0x01,
 692 0x22,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,
 693 0x00,0x03,0x82,0x01,0x0f,0x00,0x30,0x82,0x01,0x0a,0x02,0x82,0x01,0x01,0x00,
 694 0xb2,0x50,0x28,0x48,0xdd,0xd3,0x68,0x7a,0x84,0x18,0x44,0x66,0x75,0x5d,0x7e,
 695 0xc4,0xb8,0x9f,0x63,0x26,0xff,0x3d,0x43,0x9c,0x7c,0x11,0x38,0x10,0x25,0x55,
 696 0x73,0xd9,0x75,0x27,0x69,0xfd,0x4e,0xb9,0x20,0x5c,0xd3,0x0a,0xf9,0xa0,0x1b,
 697 0x2a,0xed,0x55,0x56,0x21,0x61,0xd8,0x1e,0xdb,0xe4,0xbc,0x33,0x6b,0xc7,0xef,
 698 0xdd,0xa3,0x37,0x65,0x8e,0x1b,0x93,0x0c,0xb6,0x53,0x1e,0x5c,0x7c,0x66,0x35,
 699 0x5f,0x05,0x8a,0x45,0xfe,0x76,0x4e,0xdf,0x53,0x80,0xa2,0x81,0x20,0x9d,0xae,
 700 0x88,0x5c,0xa2,0x08,0xf7,0xe5,0x30,0xf9,0xee,0x22,0x37,0x4c,0x42,0x0a,0xce,
 701 0xdf,0xc6,0x1f,0xc4,0xd6,0x55,0xe9,0x81,0x3f,0xb5,0x52,0xa3,0x2c,0xaa,0x01,
 702 0x7a,0xf2,0xa2,0xaa,0x8d,0x35,0xfe,0x9f,0xe6,0x5d,0x6a,0x05,0x9f,0x3d,0x6b,
 703 0xe3,0xbf,0x96,0xc0,0xfe,0xcc,0x60,0xf9,0x40,0xe7,0x07,0xa0,0x44,0xeb,0x81,
 704 0x51,0x6e,0xa5,0x2a,0xf2,0xb6,0x8a,0x10,0x28,0xed,0x8f,0xdc,0x06,0xa0,0x86,
 705 0x50,0x9a,0x7b,0x4a,0x08,0x0d,0x30,0x1d,0xca,0x10,0x9e,0x6b,0xf7,0xe9,0x58,
 706 0xae,0x04,0xa9,0x40,0x99,0xb2,0x28,0xe8,0x8f,0x16,0xac,0x3c,0xe3,0x53,0x6f,
 707 0x4b,0xd3,0x35,0x9d,0xb5,0x6f,0x64,0x1d,0xb3,0x96,0x2c,0xbb,0x3d,0xe7,0x79,
 708 0xeb,0x6d,0x7a,0xf9,0x16,0xe6,0x26,0xad,0xaf,0xef,0x99,0x53,0xb7,0x40,0x2c,
 709 0x95,0xb8,0x79,0xaa,0xfe,0xd4,0x52,0xab,0x29,0x74,0x7e,0x42,0xec,0x39,0x1e,
 710 0xa2,0x6a,0x16,0xe6,0x59,0xbb,0x24,0x68,0xd8,0x00,0x80,0x43,0x10,0x87,0x80,
 711 0x6b,0x02,0x03,0x01,0x00,0x01,0xa3,0x81,0xca,0x30,0x81,0xc7,0x30,0x34,0x06,
 712 0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x01,0x01,0x04,0x28,0x30,0x26,0x30,0x24,
 713 0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x30,0x01,0x86,0x18,0x68,0x74,0x74,
 714 0x70,0x3a,0x2f,0x2f,0x6f,0x63,0x73,0x70,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,
 715 0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x30,0x0c,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,
 716 0xff,0x04,0x02,0x30,0x00,0x30,0x33,0x06,0x03,0x55,0x1d,0x1f,0x04,0x2c,0x30,
 717 0x2a,0x30,0x28,0xa0,0x26,0xa0,0x24,0x86,0x22,0x68,0x74,0x74,0x70,0x3a,0x2f,
 718 0x2f,0x63,0x72,0x6c,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,
 719 0x6f,0x6d,0x2f,0x74,0x73,0x73,0x2d,0x63,0x61,0x2e,0x63,0x72,0x6c,0x30,0x16,
 720 0x06,0x03,0x55,0x1d,0x25,0x01,0x01,0xff,0x04,0x0c,0x30,0x0a,0x06,0x08,0x2b,
 721 0x06,0x01,0x05,0x05,0x07,0x03,0x08,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,
 722 0x01,0xff,0x04,0x04,0x03,0x02,0x06,0xc0,0x30,0x24,0x06,0x03,0x55,0x1d,0x11,
 723 0x04,0x1d,0x30,0x1b,0xa4,0x19,0x30,0x17,0x31,0x15,0x30,0x13,0x06,0x03,0x55,
 724 0x04,0x03,0x13,0x0c,0x54,0x53,0x41,0x32,0x30,0x34,0x38,0x2d,0x31,0x2d,0x35,
 725 0x34,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 726 0x00,0x03,0x82,0x01,0x01,0x00,0x87,0x78,0x70,0xda,0x4e,0x52,0x01,0x20,0x5b,
 727 0xe0,0x79,0xc9,0x82,0x30,0xc4,0xfd,0xb9,0x19,0x96,0xbd,0x91,0x00,0xc3,0xbd,
 728 0xcd,0xcd,0xc6,0xf4,0x0e,0xd8,0xff,0xf9,0x4d,0xc0,0x33,0x62,0x30,0x11,0xc5,
 729 0xf5,0x74,0x1b,0xd4,0x92,0xde,0x5f,0x9c,0x20,0x13,0xb1,0x7c,0x45,0xbe,0x50,
 730 0xcd,0x83,0xe7,0x80,0x17,0x83,0xa7,0x27,0x93,0x67,0x13,0x46,0xfb,0xca,0xb8,
 731 0x98,0x41,0x03,0xcc,0x9b,0x51,0x5b,0x05,0x8b,0x7f,0xa8,0x6f,0xf3,0x1b,0x50,
 732 0x1b,0x24,0x2e,0xf2,0x69,0x8d,0x6c,0x22,0xf7,0xbb,0xca,0x16,0x95,0xed,0x0c,
 733 0x74,0xc0,0x68,0x77,0xd9,0xeb,0x99,0x62,0x87,0xc1,0x73,0x90,0xf8,0x89,0x74,
 734 0x7a,0x23,0xab,0xa3,0x98,0x7b,0x97,0xb1,0xf7,0x8f,0x29,0x71,0x4d,0x2e,0x75,
 735 0x1b,0x48,0x41,0xda,0xf0,0xb5,0x0d,0x20,0x54,0xd6,0x77,0xa0,0x97,0x82,0x63,
 736 0x69,0xfd,0x09,0xcf,0x8a,0xf0,0x75,0xbb,0x09,0x9b,0xd9,0xf9,0x11,0x55,0x26,
 737 0x9a,0x61,0x32,0xbe,0x7a,0x02,0xb0,0x7b,0x86,0xbe,0xa2,0xc3,0x8b,0x22,0x2c,
 738 0x78,0xd1,0x35,0x76,0xbc,0x92,0x73,0x5c,0xf9,0xb9,0xe6,0x4c,0x15,0x0a,0x23,
 739 0xcc,0xe4,0xd2,0xd4,0x34,0x2e,0x49,0x40,0x15,0x3c,0x0f,0x60,0x7a,0x24,0xc6,
 740 0xa5,0x66,0xef,0x96,0xcf,0x70,0xeb,0x3e,0xe7,0xf4,0x0d,0x7e,0xdc,0xd1,0x7c,
 741 0xa3,0x76,0x71,0x69,0xc1,0x9c,0x4f,0x47,0x30,0x35,0x21,0xb1,0xa2,0xaf,0x1a,
 742 0x62,0x3c,0x2b,0xd9,0x8e,0xaa,0x2a,0x07,0x7b,0xd8,0x18,0xb3,0x5c,0x7b,0xe2,
 743 0x9d,0xa5,0x6f,0xfe,0x3c,0x89,0xad };
 744 static const BYTE iTunesCert2[] = {
 745 0x30,0x82,0x04,0xbf,0x30,0x82,0x04,0x28,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 746 0x41,0x91,0xa1,0x5a,0x39,0x78,0xdf,0xcf,0x49,0x65,0x66,0x38,0x1d,0x4c,0x75,
 747 0xc2,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 748 0x00,0x30,0x5f,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,
 749 0x53,0x31,0x17,0x30,0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,
 750 0x69,0x53,0x69,0x67,0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x37,0x30,0x35,
 751 0x06,0x03,0x55,0x04,0x0b,0x13,0x2e,0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,
 752 0x50,0x75,0x62,0x6c,0x69,0x63,0x20,0x50,0x72,0x69,0x6d,0x61,0x72,0x79,0x20,
 753 0x43,0x65,0x72,0x74,0x69,0x66,0x69,0x63,0x61,0x74,0x69,0x6f,0x6e,0x20,0x41,
 754 0x75,0x74,0x68,0x6f,0x72,0x69,0x74,0x79,0x30,0x1e,0x17,0x0d,0x30,0x34,0x30,
 755 0x37,0x31,0x36,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x31,0x34,0x30,
 756 0x37,0x31,0x35,0x32,0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x81,0xb4,0x31,0x0b,
 757 0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x17,0x30,0x15,
 758 0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,
 759 0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x1f,0x30,0x1d,0x06,0x03,0x55,0x04,0x0b,
 760 0x13,0x16,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x20,0x54,0x72,0x75,0x73,
 761 0x74,0x20,0x4e,0x65,0x74,0x77,0x6f,0x72,0x6b,0x31,0x3b,0x30,0x39,0x06,0x03,
 762 0x55,0x04,0x0b,0x13,0x32,0x54,0x65,0x72,0x6d,0x73,0x20,0x6f,0x66,0x20,0x75,
 763 0x73,0x65,0x20,0x61,0x74,0x20,0x68,0x74,0x74,0x70,0x73,0x3a,0x2f,0x2f,0x77,
 764 0x77,0x77,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,
 765 0x2f,0x72,0x70,0x61,0x20,0x28,0x63,0x29,0x30,0x34,0x31,0x2e,0x30,0x2c,0x06,
 766 0x03,0x55,0x04,0x03,0x13,0x25,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x20,
 767 0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,0x43,0x6f,0x64,0x65,0x20,0x53,0x69,
 768 0x67,0x6e,0x69,0x6e,0x67,0x20,0x32,0x30,0x30,0x34,0x20,0x43,0x41,0x30,0x82,
 769 0x01,0x22,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,
 770 0x05,0x00,0x03,0x82,0x01,0x0f,0x00,0x30,0x82,0x01,0x0a,0x02,0x82,0x01,0x01,
 771 0x00,0xbe,0xbc,0xee,0xbc,0x7e,0xef,0x83,0xeb,0xe0,0x37,0x4f,0xfb,0x03,0x10,
 772 0x38,0xbe,0x08,0xd2,0x8c,0x7d,0x9d,0xfa,0x92,0x7f,0x19,0x0c,0xc2,0x6b,0xee,
 773 0x42,0x52,0x8c,0xde,0xd3,0x1c,0x48,0x13,0x25,0xea,0xc1,0x63,0x7a,0xf9,0x51,
 774 0x65,0xee,0xd3,0xaa,0x3b,0xf5,0xf0,0x94,0x9c,0x2b,0xfb,0xf2,0x66,0xd4,0x24,
 775 0xda,0xf7,0xf5,0x9f,0x6e,0x19,0x39,0x36,0xbc,0xd0,0xa3,0x76,0x08,0x1e,0x22,
 776 0x27,0x24,0x6c,0x38,0x91,0x27,0xe2,0x84,0x49,0xae,0x1b,0x8a,0xa1,0xfd,0x25,
 777 0x82,0x2c,0x10,0x30,0xe8,0x71,0xab,0x28,0xe8,0x77,0x4a,0x51,0xf1,0xec,0xcd,
 778 0xf8,0xf0,0x54,0xd4,0x6f,0xc0,0xe3,0x6d,0x0a,0x8f,0xd9,0xd8,0x64,0x8d,0x63,
 779 0xb2,0x2d,0x4e,0x27,0xf6,0x85,0x0e,0xfe,0x6d,0xe3,0x29,0x99,0xe2,0x85,0x47,
 780 0x7c,0x2d,0x86,0x7f,0xe8,0x57,0x8f,0xad,0x67,0xc2,0x33,0x32,0x91,0x13,0x20,
 781 0xfc,0xa9,0x23,0x14,0x9a,0x6d,0xc2,0x84,0x4b,0x76,0x68,0x04,0xd5,0x71,0x2c,
 782 0x5d,0x21,0xfa,0x88,0x0d,0x26,0xfd,0x1f,0x2d,0x91,0x2b,0xe7,0x01,0x55,0x4d,
 783 0xf2,0x6d,0x35,0x28,0x82,0xdf,0xd9,0x6b,0x5c,0xb6,0xd6,0xd9,0xaa,0x81,0xfd,
 784 0x5f,0xcd,0x83,0xba,0x63,0x9d,0xd0,0x22,0xfc,0xa9,0x3b,0x42,0x69,0xb2,0x8e,
 785 0x3a,0xb5,0xbc,0xb4,0x9e,0x0f,0x5e,0xc4,0xea,0x2c,0x82,0x8b,0x28,0xfd,0x53,
 786 0x08,0x96,0xdd,0xb5,0x01,0x20,0xd1,0xf9,0xa5,0x18,0xe7,0xc0,0xee,0x51,0x70,
 787 0x37,0xe1,0xb6,0x05,0x48,0x52,0x48,0x6f,0x38,0xea,0xc3,0xe8,0x6c,0x7b,0x44,
 788 0x84,0xbb,0x02,0x03,0x01,0x00,0x01,0xa3,0x82,0x01,0xa0,0x30,0x82,0x01,0x9c,
 789 0x30,0x12,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,0xff,0x04,0x08,0x30,0x06,0x01,
 790 0x01,0xff,0x02,0x01,0x00,0x30,0x44,0x06,0x03,0x55,0x1d,0x20,0x04,0x3d,0x30,
 791 0x3b,0x30,0x39,0x06,0x0b,0x60,0x86,0x48,0x01,0x86,0xf8,0x45,0x01,0x07,0x17,
 792 0x03,0x30,0x2a,0x30,0x28,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x02,0x01,
 793 0x16,0x1c,0x68,0x74,0x74,0x70,0x73,0x3a,0x2f,0x2f,0x77,0x77,0x77,0x2e,0x76,
 794 0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x72,0x70,0x61,
 795 0x30,0x31,0x06,0x03,0x55,0x1d,0x1f,0x04,0x2a,0x30,0x28,0x30,0x26,0xa0,0x24,
 796 0xa0,0x22,0x86,0x20,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x63,0x72,0x6c,0x2e,
 797 0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x70,0x63,
 798 0x61,0x33,0x2e,0x63,0x72,0x6c,0x30,0x1d,0x06,0x03,0x55,0x1d,0x25,0x04,0x16,
 799 0x30,0x14,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x03,0x02,0x06,0x08,0x2b,
 800 0x06,0x01,0x05,0x05,0x07,0x03,0x03,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,
 801 0x01,0xff,0x04,0x04,0x03,0x02,0x01,0x06,0x30,0x11,0x06,0x09,0x60,0x86,0x48,
 802 0x01,0x86,0xf8,0x42,0x01,0x01,0x04,0x04,0x03,0x02,0x00,0x01,0x30,0x29,0x06,
 803 0x03,0x55,0x1d,0x11,0x04,0x22,0x30,0x20,0xa4,0x1e,0x30,0x1c,0x31,0x1a,0x30,
 804 0x18,0x06,0x03,0x55,0x04,0x03,0x13,0x11,0x43,0x6c,0x61,0x73,0x73,0x33,0x43,
 805 0x41,0x32,0x30,0x34,0x38,0x2d,0x31,0x2d,0x34,0x33,0x30,0x1d,0x06,0x03,0x55,
 806 0x1d,0x0e,0x04,0x16,0x04,0x14,0x08,0xf5,0x51,0xe8,0xfb,0xfe,0x3d,0x3d,0x64,
 807 0x36,0x7c,0x68,0xcf,0x5b,0x78,0xa8,0xdf,0xb9,0xc5,0x37,0x30,0x81,0x80,0x06,
 808 0x03,0x55,0x1d,0x23,0x04,0x79,0x30,0x77,0xa1,0x63,0xa4,0x61,0x30,0x5f,0x31,
 809 0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x17,0x30,
 810 0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,0x69,0x53,0x69,0x67,
 811 0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x37,0x30,0x35,0x06,0x03,0x55,0x04,
 812 0x0b,0x13,0x2e,0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,0x50,0x75,0x62,0x6c,
 813 0x69,0x63,0x20,0x50,0x72,0x69,0x6d,0x61,0x72,0x79,0x20,0x43,0x65,0x72,0x74,
 814 0x69,0x66,0x69,0x63,0x61,0x74,0x69,0x6f,0x6e,0x20,0x41,0x75,0x74,0x68,0x6f,
 815 0x72,0x69,0x74,0x79,0x82,0x10,0x70,0xba,0xe4,0x1d,0x10,0xd9,0x29,0x34,0xb6,
 816 0x38,0xca,0x7b,0x03,0xcc,0xba,0xbf,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,
 817 0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0xae,0x3a,0x17,0xb8,
 818 0x4a,0x7b,0x55,0xfa,0x64,0x55,0xec,0x40,0xa4,0xed,0x49,0x41,0x90,0x99,0x9c,
 819 0x89,0xbc,0xaf,0x2e,0x1d,0xca,0x78,0x23,0xf9,0x1c,0x19,0x0f,0x7f,0xeb,0x68,
 820 0xbc,0x32,0xd9,0x88,0x38,0xde,0xdc,0x3f,0xd3,0x89,0xb4,0x3f,0xb1,0x82,0x96,
 821 0xf1,0xa4,0x5a,0xba,0xed,0x2e,0x26,0xd3,0xde,0x7c,0x01,0x6e,0x00,0x0a,0x00,
 822 0xa4,0x06,0x92,0x11,0x48,0x09,0x40,0xf9,0x1c,0x18,0x79,0x67,0x23,0x24,0xe0,
 823 0xbb,0xd5,0xe1,0x50,0xae,0x1b,0xf5,0x0e,0xdd,0xe0,0x2e,0x81,0xcd,0x80,0xa3,
 824 0x6c,0x52,0x4f,0x91,0x75,0x55,0x8a,0xba,0x22,0xf2,0xd2,0xea,0x41,0x75,0x88,
 825 0x2f,0x63,0x55,0x7d,0x1e,0x54,0x5a,0x95,0x59,0xca,0xd9,0x34,0x81,0xc0,0x5f,
 826 0x5e,0xf6,0x7a,0xb5 };
 827 static const BYTE iTunesCert3[] = {
 828 0x30,0x82,0x04,0xf1,0x30,0x82,0x03,0xd9,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 829 0x0f,0x1a,0xa0,0xe0,0x9b,0x9b,0x61,0xa6,0xb6,0xfe,0x40,0xd2,0xdf,0x6a,0xf6,
 830 0x8d,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 831 0x00,0x30,0x81,0xb4,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,
 832 0x55,0x53,0x31,0x17,0x30,0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,
 833 0x72,0x69,0x53,0x69,0x67,0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x1f,0x30,
 834 0x1d,0x06,0x03,0x55,0x04,0x0b,0x13,0x16,0x56,0x65,0x72,0x69,0x53,0x69,0x67,
 835 0x6e,0x20,0x54,0x72,0x75,0x73,0x74,0x20,0x4e,0x65,0x74,0x77,0x6f,0x72,0x6b,
 836 0x31,0x3b,0x30,0x39,0x06,0x03,0x55,0x04,0x0b,0x13,0x32,0x54,0x65,0x72,0x6d,
 837 0x73,0x20,0x6f,0x66,0x20,0x75,0x73,0x65,0x20,0x61,0x74,0x20,0x68,0x74,0x74,
 838 0x70,0x73,0x3a,0x2f,0x2f,0x77,0x77,0x77,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,
 839 0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x72,0x70,0x61,0x20,0x28,0x63,0x29,0x30,
 840 0x34,0x31,0x2e,0x30,0x2c,0x06,0x03,0x55,0x04,0x03,0x13,0x25,0x56,0x65,0x72,
 841 0x69,0x53,0x69,0x67,0x6e,0x20,0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,0x43,
 842 0x6f,0x64,0x65,0x20,0x53,0x69,0x67,0x6e,0x69,0x6e,0x67,0x20,0x32,0x30,0x30,
 843 0x34,0x20,0x43,0x41,0x30,0x1e,0x17,0x0d,0x30,0x36,0x30,0x31,0x31,0x37,0x30,
 844 0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x38,0x30,0x31,0x32,0x32,0x32,
 845 0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x81,0xb4,0x31,0x0b,0x30,0x09,0x06,0x03,
 846 0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,
 847 0x08,0x13,0x0a,0x43,0x61,0x6c,0x69,0x66,0x6f,0x72,0x6e,0x69,0x61,0x31,0x12,
 848 0x30,0x10,0x06,0x03,0x55,0x04,0x07,0x13,0x09,0x43,0x75,0x70,0x65,0x72,0x74,
 849 0x69,0x6e,0x6f,0x31,0x1d,0x30,0x1b,0x06,0x03,0x55,0x04,0x0a,0x14,0x14,0x41,
 850 0x70,0x70,0x6c,0x65,0x20,0x43,0x6f,0x6d,0x70,0x75,0x74,0x65,0x72,0x2c,0x20,
 851 0x49,0x6e,0x63,0x2e,0x31,0x3e,0x30,0x3c,0x06,0x03,0x55,0x04,0x0b,0x13,0x35,
 852 0x44,0x69,0x67,0x69,0x74,0x61,0x6c,0x20,0x49,0x44,0x20,0x43,0x6c,0x61,0x73,
 853 0x73,0x20,0x33,0x20,0x2d,0x20,0x4d,0x69,0x63,0x72,0x6f,0x73,0x6f,0x66,0x74,
 854 0x20,0x53,0x6f,0x66,0x74,0x77,0x61,0x72,0x65,0x20,0x56,0x61,0x6c,0x69,0x64,
 855 0x61,0x74,0x69,0x6f,0x6e,0x20,0x76,0x32,0x31,0x1d,0x30,0x1b,0x06,0x03,0x55,
 856 0x04,0x03,0x14,0x14,0x41,0x70,0x70,0x6c,0x65,0x20,0x43,0x6f,0x6d,0x70,0x75,
 857 0x74,0x65,0x72,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x30,0x81,0x9f,0x30,0x0d,0x06,
 858 0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,
 859 0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xd3,0xab,0x3b,0x7f,0xec,0x48,0x84,
 860 0xce,0xa8,0x1a,0x12,0xf3,0x3c,0x87,0xcb,0x24,0x58,0x96,0x02,0x87,0x66,0x49,
 861 0xeb,0x89,0xee,0x79,0x44,0x70,0x8d,0xe7,0xd4,0x1f,0x30,0x92,0xc0,0x9c,0x35,
 862 0x78,0xc0,0xaf,0x1c,0xb6,0x28,0xd3,0xe0,0xe0,0x9d,0xd3,0x49,0x76,0x73,0x57,
 863 0x19,0x4d,0x8d,0x70,0x85,0x64,0x4d,0x1d,0xc6,0x02,0x3e,0xe5,0x2c,0x66,0x07,
 864 0xd2,0x27,0x4b,0xd6,0xc8,0x3c,0x93,0xb6,0x15,0x0c,0xde,0x5b,0xd7,0x93,0xdd,
 865 0xbe,0x85,0x62,0x34,0x17,0x8a,0x05,0x60,0xf0,0x8a,0x1c,0x5a,0x40,0x21,0x8d,
 866 0x51,0x6c,0xb0,0x62,0xd8,0xb5,0xd4,0xf9,0xb1,0xd0,0x58,0x7a,0x7a,0x82,0x55,
 867 0xb3,0xf9,0x53,0x71,0xde,0xd2,0xc9,0x37,0x8c,0xf6,0x5a,0x1f,0x2d,0xcd,0x7c,
 868 0x67,0x02,0x03,0x01,0x00,0x01,0xa3,0x82,0x01,0x7f,0x30,0x82,0x01,0x7b,0x30,
 869 0x09,0x06,0x03,0x55,0x1d,0x13,0x04,0x02,0x30,0x00,0x30,0x0e,0x06,0x03,0x55,
 870 0x1d,0x0f,0x01,0x01,0xff,0x04,0x04,0x03,0x02,0x07,0x80,0x30,0x40,0x06,0x03,
 871 0x55,0x1d,0x1f,0x04,0x39,0x30,0x37,0x30,0x35,0xa0,0x33,0xa0,0x31,0x86,0x2f,
 872 0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x43,0x53,0x43,0x33,0x2d,0x32,0x30,0x30,
 873 0x34,0x2d,0x63,0x72,0x6c,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,
 874 0x63,0x6f,0x6d,0x2f,0x43,0x53,0x43,0x33,0x2d,0x32,0x30,0x30,0x34,0x2e,0x63,
 875 0x72,0x6c,0x30,0x44,0x06,0x03,0x55,0x1d,0x20,0x04,0x3d,0x30,0x3b,0x30,0x39,
 876 0x06,0x0b,0x60,0x86,0x48,0x01,0x86,0xf8,0x45,0x01,0x07,0x17,0x03,0x30,0x2a,
 877 0x30,0x28,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x02,0x01,0x16,0x1c,0x68,
 878 0x74,0x74,0x70,0x73,0x3a,0x2f,0x2f,0x77,0x77,0x77,0x2e,0x76,0x65,0x72,0x69,
 879 0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x72,0x70,0x61,0x30,0x13,0x06,
 880 0x03,0x55,0x1d,0x25,0x04,0x0c,0x30,0x0a,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,
 881 0x07,0x03,0x03,0x30,0x75,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x01,0x01,
 882 0x04,0x69,0x30,0x67,0x30,0x24,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x30,
 883 0x01,0x86,0x18,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x6f,0x63,0x73,0x70,0x2e,
 884 0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x30,0x3f,0x06,
 885 0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x30,0x02,0x86,0x33,0x68,0x74,0x74,0x70,
 886 0x3a,0x2f,0x2f,0x43,0x53,0x43,0x33,0x2d,0x32,0x30,0x30,0x34,0x2d,0x61,0x69,
 887 0x61,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,
 888 0x43,0x53,0x43,0x33,0x2d,0x32,0x30,0x30,0x34,0x2d,0x61,0x69,0x61,0x2e,0x63,
 889 0x65,0x72,0x30,0x1f,0x06,0x03,0x55,0x1d,0x23,0x04,0x18,0x30,0x16,0x80,0x14,
 890 0x08,0xf5,0x51,0xe8,0xfb,0xfe,0x3d,0x3d,0x64,0x36,0x7c,0x68,0xcf,0x5b,0x78,
 891 0xa8,0xdf,0xb9,0xc5,0x37,0x30,0x11,0x06,0x09,0x60,0x86,0x48,0x01,0x86,0xf8,
 892 0x42,0x01,0x01,0x04,0x04,0x03,0x02,0x04,0x10,0x30,0x16,0x06,0x0a,0x2b,0x06,
 893 0x01,0x04,0x01,0x82,0x37,0x02,0x01,0x1b,0x04,0x08,0x30,0x06,0x01,0x01,0x00,
 894 0x01,0x01,0xff,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,
 895 0x05,0x05,0x00,0x03,0x82,0x01,0x01,0x00,0x6a,0xa6,0x06,0xd0,0x33,0x18,0x64,
 896 0xe2,0x69,0x82,0xee,0x6e,0x36,0x9e,0x9d,0x9a,0x0e,0x18,0xa8,0xac,0x9d,0x10,
 897 0xed,0x01,0x3c,0xb9,0x61,0x04,0x62,0xf3,0x85,0x8f,0xcc,0x4f,0x2c,0x66,0x35,
 898 0x54,0x25,0x45,0x8d,0x95,0x1c,0xd2,0x33,0xbe,0x2e,0xdd,0x7f,0x74,0xaf,0x03,
 899 0x7b,0x86,0x63,0xb0,0xc9,0xe6,0xbd,0xc7,0x8e,0xde,0x03,0x18,0x98,0x82,0xc3,
 900 0xbb,0xf8,0x15,0x99,0x1a,0xa9,0xdd,0xb9,0x5d,0xb9,0xbd,0x53,0x95,0x25,0x76,
 901 0xfb,0x5c,0x53,0x90,0xea,0x01,0x0a,0xa0,0xb1,0xbf,0x09,0x1b,0x97,0x8f,0x40,
 902 0xfa,0x85,0x12,0x74,0x01,0xdb,0xf6,0xdb,0x09,0xd6,0x5f,0x4f,0xd7,0x17,0xb4,
 903 0xbf,0x9e,0x2f,0x86,0x52,0x5d,0x70,0x24,0x52,0x32,0x1e,0xa5,0x1d,0x39,0x8b,
 904 0x66,0xf6,0xba,0x9b,0x69,0x8e,0x12,0x60,0xdb,0xb6,0xcf,0xe6,0x0d,0xd6,0x1c,
 905 0x8f,0xd4,0x5b,0x4b,0x00,0xde,0x21,0x93,0xfb,0x6e,0xc7,0x3d,0xb4,0x66,0x0d,
 906 0x29,0x0c,0x4e,0xe9,0x3f,0x94,0xd6,0xd6,0xdc,0xec,0xf8,0x53,0x3b,0x62,0xd5,
 907 0x97,0x50,0x53,0x84,0x17,0xfe,0xe2,0xed,0x4c,0x23,0x0a,0x49,0xce,0x5b,0xe9,
 908 0x70,0x31,0xc1,0x04,0x02,0x02,0x6c,0xb8,0x52,0xcd,0xc7,0x4e,0x70,0xb4,0x13,
 909 0xd7,0xe0,0x92,0xba,0x44,0x1a,0x10,0x4c,0x6e,0x45,0xc6,0x86,0x04,0xc6,0x64,
 910 0xd3,0x9c,0x6e,0xc1,0x9c,0xac,0x74,0x3d,0x77,0x06,0x5e,0x28,0x28,0x5c,0xf5,
 911 0xe0,0x9c,0x19,0xd8,0xba,0x74,0x81,0x2d,0x67,0x77,0x93,0x8d,0xbf,0xd2,0x52,
 912 0x00,0xe6,0xa5,0x38,0x4e,0x2e,0x73,0x66,0x7a };
 913 static BYTE iTunesIssuer[] = {
 914 0x30,0x81,0xb4,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,
 915 0x13,0x02,0x55,0x53,0x31,0x17,0x30,0x15,0x06,0x03,0x55,0x04,
 916 0x0a,0x13,0x0e,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x2c,
 917 0x20,0x49,0x6e,0x63,0x2e,0x31,0x1f,0x30,0x1d,0x06,0x03,0x55,
 918 0x04,0x0b,0x13,0x16,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,
 919 0x20,0x54,0x72,0x75,0x73,0x74,0x20,0x4e,0x65,0x74,0x77,0x6f,
 920 0x72,0x6b,0x31,0x3b,0x30,0x39,0x06,0x03,0x55,0x04,0x0b,0x13,
 921 0x32,0x54,0x65,0x72,0x6d,0x73,0x20,0x6f,0x66,0x20,0x75,0x73,
 922 0x65,0x20,0x61,0x74,0x20,0x68,0x74,0x74,0x70,0x73,0x3a,0x2f,
 923 0x2f,0x77,0x77,0x77,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,
 924 0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x72,0x70,0x61,0x20,0x28,0x63,
 925 0x29,0x30,0x34,0x31,0x2e,0x30,0x2c,0x06,0x03,0x55,0x04,0x03,
 926 0x13,0x25,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x20,0x43,
 927 0x6c,0x61,0x73,0x73,0x20,0x33,0x20,0x43,0x6f,0x64,0x65,0x20,
 928 0x53,0x69,0x67,0x6e,0x69,0x6e,0x67,0x20,0x32,0x30,0x30,0x34,
 929 0x20,0x43,0x41 };
 930 static BYTE iTunesSerialNum[] = {
 931 0x8d,0xf6,0x6a,0xdf,0xd2,0x40,0xfe,0xb6,0xa6,0x61,0x9b,0x9b,
 932 0xe0,0xa0,0x1a,0x0f };
 933
 934 static void testFindCert(void)
 935 {
 936     HCERTSTORE store;
 937     PCCERT_CONTEXT context = NULL, subject;
 938     BOOL ret;
 939     CERT_INFO certInfo = { 0 };
 940     CRYPT_HASH_BLOB blob;
 941     BYTE otherSerialNumber[] = { 2 };
 942
 943     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
 944      CERT_STORE_CREATE_NEW_FLAG, NULL);
 945     ok(store != NULL, "CertOpenStore failed: %d\n", GetLastError());
 946     if (!store)
 947         return;
 948
 949     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 950      bigCert, sizeof(bigCert), CERT_STORE_ADD_NEW, NULL);
 951     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 952      GetLastError());
 953     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 954      bigCert2, sizeof(bigCert2), CERT_STORE_ADD_NEW, NULL);
 955     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 956      GetLastError());
 957     /* This has the same name as bigCert */
 958     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 959      certWithUsage, sizeof(certWithUsage), CERT_STORE_ADD_NEW, NULL);
 960     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 961      GetLastError());
 962
 963     /* Crashes
 964     context = CertFindCertificateInStore(NULL, 0, 0, 0, NULL, NULL);
 965      */
 966
 967     /* Check first cert's there, by issuer */
 968     certInfo.Subject.pbData = subjectName;
 969     certInfo.Subject.cbData = sizeof(subjectName);
 970     certInfo.SerialNumber.pbData = serialNum;
 971     certInfo.SerialNumber.cbData = sizeof(serialNum);
 972     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
 973      CERT_FIND_ISSUER_NAME, &certInfo.Subject, NULL);
 974     ok(context != NULL, "CertFindCertificateInStore failed: %08x\n",
 975      GetLastError());
 976     if (context)
 977     {
 978         context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
 979          CERT_FIND_ISSUER_NAME, &certInfo.Subject, context);
 980         ok(context != NULL, "Expected more than one cert\n");
 981         if (context)
 982         {
 983             context = CertFindCertificateInStore(store, X509_ASN_ENCODING,
 984              0, CERT_FIND_ISSUER_NAME, &certInfo.Subject, context);
 985             ok(context == NULL, "Expected precisely two certs\n");
 986         }
 987     }
 988
 989     /* Check second cert's there as well, by subject name */
 990     certInfo.Subject.pbData = subjectName2;
 991     certInfo.Subject.cbData = sizeof(subjectName2);
 992     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
 993      CERT_FIND_SUBJECT_NAME, &certInfo.Subject, NULL);
 994     ok(context != NULL, "CertFindCertificateInStore failed: %08x\n",
 995      GetLastError());
 996     if (context)
 997     {
 998         context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
 999          CERT_FIND_SUBJECT_NAME, &certInfo.Subject, context);
1000         ok(context == NULL, "Expected one cert only\n");
1001     }
1002
1003     /* Strange but true: searching for the subject cert requires you to set
1004      * the issuer, not the subject
1005      */
1006     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1007      CERT_FIND_SUBJECT_CERT, &certInfo.Subject, NULL);
1008     ok(context == NULL, "Expected no certificate\n");
1009     certInfo.Subject.pbData = NULL;
1010     certInfo.Subject.cbData = 0;
1011     certInfo.Issuer.pbData = subjectName2;
1012     certInfo.Issuer.cbData = sizeof(subjectName2);
1013     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1014      CERT_FIND_SUBJECT_CERT, &certInfo, NULL);
1015     ok(context != NULL, "CertFindCertificateInStore failed: %08x\n",
1016      GetLastError());
1017     if (context)
1018     {
1019         context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1020          CERT_FIND_SUBJECT_CERT, &certInfo.Subject, context);
1021         ok(context == NULL, "Expected one cert only\n");
1022     }
1023     /* A non-matching serial number will not match. */
1024     certInfo.SerialNumber.pbData = otherSerialNumber;
1025     certInfo.SerialNumber.cbData = sizeof(otherSerialNumber);
1026     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1027      CERT_FIND_SUBJECT_CERT, &certInfo, NULL);
1028     ok(context == NULL, "Expected no match\n");
1029     /* No serial number will not match */
1030     certInfo.SerialNumber.cbData = 0;
1031     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1032      CERT_FIND_SUBJECT_CERT, &certInfo, NULL);
1033     ok(context == NULL, "Expected no match\n");
1034     /* A serial number still won't match if the name doesn't */
1035     certInfo.SerialNumber.pbData = serialNum;
1036     certInfo.SerialNumber.cbData = sizeof(serialNum);
1037     certInfo.Issuer.pbData = subjectName3;
1038     certInfo.Issuer.cbData = sizeof(subjectName3);
1039     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1040      CERT_FIND_SUBJECT_CERT, &certInfo, NULL);
1041     ok(context == NULL, "Expected no match\n");
1042
1043     /* The nice thing about hashes, they're unique */
1044     blob.pbData = bigCertHash;
1045     blob.cbData = sizeof(bigCertHash);
1046     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1047      CERT_FIND_SHA1_HASH, &blob, NULL);
1048     ok(context != NULL, "CertFindCertificateInStore failed: %08x\n",
1049      GetLastError());
1050     if (context)
1051     {
1052         context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1053          CERT_FIND_SHA1_HASH, &certInfo.Subject, context);
1054         ok(context == NULL, "Expected one cert only\n");
1055     }
1056
1057     CertCloseStore(store, 0);
1058
1059     /* Another subject cert search, using iTunes's certs */
1060     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1061      CERT_STORE_CREATE_NEW_FLAG, NULL);
1062     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1063      iTunesCert0, sizeof(iTunesCert0), CERT_STORE_ADD_NEW, NULL);
1064     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1065      GetLastError());
1066     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1067      iTunesCert1, sizeof(iTunesCert1), CERT_STORE_ADD_NEW, NULL);
1068     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1069      GetLastError());
1070     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1071      iTunesCert2, sizeof(iTunesCert2), CERT_STORE_ADD_NEW, NULL);
1072     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1073      GetLastError());
1074     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1075      iTunesCert3, sizeof(iTunesCert3), CERT_STORE_ADD_NEW, &subject);
1076     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1077      GetLastError());
1078
1079     /* The certInfo's issuer does not match any subject, but the serial
1080      * number does match a cert whose issuer matches certInfo's issuer.
1081      * This yields a match.
1082      */
1083     certInfo.SerialNumber.cbData = sizeof(iTunesSerialNum);
1084     certInfo.SerialNumber.pbData = iTunesSerialNum;
1085     certInfo.Issuer.cbData = sizeof(iTunesIssuer);
1086     certInfo.Issuer.pbData = iTunesIssuer;
1087     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1088      CERT_FIND_SUBJECT_CERT, &certInfo, NULL);
1089     ok(context != NULL, "Expected a match\n");
1090     if (context)
1091     {
1092         ret = CertCompareCertificateName(context->dwCertEncodingType,
1093          &certInfo.Issuer, &context->pCertInfo->Subject);
1094         ok(!ret, "Expected subject name not to match\n");
1095         ret = CertCompareCertificateName(context->dwCertEncodingType,
1096          &certInfo.Issuer, &context->pCertInfo->Issuer);
1097         ok(ret, "Expected issuer name to match\n");
1098         ret = CertCompareIntegerBlob(&certInfo.SerialNumber,
1099          &context->pCertInfo->SerialNumber);
1100         ok(ret, "Expected serial number to match\n");
1101         context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1102          CERT_FIND_SUBJECT_CERT, &certInfo, context);
1103         ok(context == NULL, "Expected one cert only\n");
1104     }
1105
1106     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1107      CERT_FIND_ISSUER_OF, subject, NULL);
1108     ok(context != NULL, "Expected an issuer\n");
1109     if (context)
1110     {
1111         PCCERT_CONTEXT none = CertFindCertificateInStore(store,
1112          X509_ASN_ENCODING, 0, CERT_FIND_ISSUER_OF, context, NULL);
1113
1114         ok(!none, "Expected no parent of issuer\n");
1115         CertFreeCertificateContext(context);
1116     }
1117     CertFreeCertificateContext(subject);
1118     CertCloseStore(store, 0);
1119 }
1120
1121 static void testGetSubjectCert(void)
1122 {
1123     HCERTSTORE store;
1124     PCCERT_CONTEXT context1, context2;
1125     CERT_INFO info = { 0 };
1126     BOOL ret;
1127
1128     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1129      CERT_STORE_CREATE_NEW_FLAG, NULL);
1130     ok(store != NULL, "CertOpenStore failed: %d\n", GetLastError());
1131     if (!store)
1132         return;
1133
1134     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1135      bigCert, sizeof(bigCert), CERT_STORE_ADD_ALWAYS, NULL);
1136     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1137      GetLastError());
1138     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1139      bigCert2, sizeof(bigCert2), CERT_STORE_ADD_NEW, &context1);
1140     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1141      GetLastError());
1142     ok(context1 != NULL, "Expected a context\n");
1143     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1144      certWithUsage, sizeof(certWithUsage), CERT_STORE_ADD_NEW, NULL);
1145     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1146      GetLastError());
1147
1148     context2 = CertGetSubjectCertificateFromStore(store, X509_ASN_ENCODING,
1149      NULL);
1150     ok(!context2 && GetLastError() == E_INVALIDARG,
1151      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1152     context2 = CertGetSubjectCertificateFromStore(store, X509_ASN_ENCODING,
1153      &info);
1154     ok(!context2 && GetLastError() == CRYPT_E_NOT_FOUND,
1155      "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
1156     info.SerialNumber.cbData = sizeof(serialNum);
1157     info.SerialNumber.pbData = serialNum;
1158     context2 = CertGetSubjectCertificateFromStore(store, X509_ASN_ENCODING,
1159      &info);
1160     ok(!context2 && GetLastError() == CRYPT_E_NOT_FOUND,
1161      "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
1162     info.Issuer.cbData = sizeof(subjectName2);
1163     info.Issuer.pbData = subjectName2;
1164     context2 = CertGetSubjectCertificateFromStore(store, X509_ASN_ENCODING,
1165      &info);
1166     ok(context2 != NULL,
1167      "CertGetSubjectCertificateFromStore failed: %08x\n", GetLastError());
1168     /* Not only should this find a context, but it should be the same
1169      * (same address) as context1.
1170      */
1171     ok(context1 == context2, "Expected identical context addresses\n");
1172     CertFreeCertificateContext(context2);
1173
1174     CertFreeCertificateContext(context1);
1175     CertCloseStore(store, 0);
1176 }
1177
1178 /* This expires in 1970 or so */
1179 static const BYTE expiredCert[] = { 0x30, 0x82, 0x01, 0x33, 0x30, 0x81, 0xe2,
1180  0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x10, 0xc4, 0xd7, 0x7f, 0x0e, 0x6f, 0xa6,
1181  0x8c, 0xaa, 0x47, 0x47, 0x40, 0xe7, 0xb7, 0x0b, 0x4a, 0x7f, 0x30, 0x09, 0x06,
1182  0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1d, 0x05, 0x00, 0x30, 0x1f, 0x31, 0x1d, 0x30,
1183  0x1b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x14, 0x61, 0x72, 0x69, 0x63, 0x40,
1184  0x63, 0x6f, 0x64, 0x65, 0x77, 0x65, 0x61, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x63,
1185  0x6f, 0x6d, 0x30, 0x1e, 0x17, 0x0d, 0x36, 0x39, 0x30, 0x31, 0x30, 0x31, 0x30,
1186  0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x37, 0x30, 0x30, 0x31, 0x30,
1187  0x31, 0x30, 0x36, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x1f, 0x31, 0x1d, 0x30,
1188  0x1b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x14, 0x61, 0x72, 0x69, 0x63, 0x40,
1189  0x63, 0x6f, 0x64, 0x65, 0x77, 0x65, 0x61, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x63,
1190  0x6f, 0x6d, 0x30, 0x5c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
1191  0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x4b, 0x00, 0x30, 0x48, 0x02, 0x41,
1192  0x00, 0xa1, 0xaf, 0x4a, 0xea, 0xa7, 0x83, 0x57, 0xc0, 0x37, 0x33, 0x7e, 0x29,
1193  0x5e, 0x0d, 0xfc, 0x44, 0x74, 0x3a, 0x1d, 0xc3, 0x1b, 0x1d, 0x96, 0xed, 0x4e,
1194  0xf4, 0x1b, 0x98, 0xec, 0x69, 0x1b, 0x04, 0xea, 0x25, 0xcf, 0xb3, 0x2a, 0xf5,
1195  0xd9, 0x22, 0xd9, 0x8d, 0x08, 0x39, 0x81, 0xc6, 0xe0, 0x4f, 0x12, 0x37, 0x2a,
1196  0x3f, 0x80, 0xa6, 0x6c, 0x67, 0x43, 0x3a, 0xdd, 0x95, 0x0c, 0xbb, 0x2f, 0x6b,
1197  0x02, 0x03, 0x01, 0x00, 0x01, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02,
1198  0x1d, 0x05, 0x00, 0x03, 0x41, 0x00, 0x8f, 0xa2, 0x5b, 0xd6, 0xdf, 0x34, 0xd0,
1199  0xa2, 0xa7, 0x47, 0xf1, 0x13, 0x79, 0xd3, 0xf3, 0x39, 0xbd, 0x4e, 0x2b, 0xa3,
1200  0xf4, 0x63, 0x37, 0xac, 0x5a, 0x0c, 0x5e, 0x4d, 0x0d, 0x54, 0x87, 0x4f, 0x31,
1201  0xfb, 0xa0, 0xce, 0x8f, 0x9a, 0x2f, 0x4d, 0x48, 0xc6, 0x84, 0x8d, 0xf5, 0x70,
1202  0x74, 0x17, 0xa5, 0xf3, 0x66, 0x47, 0x06, 0xd6, 0x64, 0x45, 0xbc, 0x52, 0xef,
1203  0x49, 0xe5, 0xf9, 0x65, 0xf3 };
1204
1205 /* This expires in 2036 or so */
1206 static const BYTE childOfExpired[] = { 0x30, 0x81, 0xcc, 0x30, 0x78, 0xa0,
1207  0x03, 0x02, 0x01, 0x02, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86,
1208  0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x1f, 0x31, 0x1d,
1209  0x30, 0x1b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x14, 0x61, 0x72, 0x69, 0x63,
1210  0x40, 0x63, 0x6f, 0x64, 0x65, 0x77, 0x65, 0x61, 0x76, 0x65, 0x72, 0x73, 0x2e,
1211  0x63, 0x6f, 0x6d, 0x30, 0x1e, 0x17, 0x0d, 0x30, 0x36, 0x30, 0x35, 0x30, 0x35,
1212  0x31, 0x37, 0x31, 0x32, 0x34, 0x39, 0x5a, 0x17, 0x0d, 0x33, 0x36, 0x30, 0x35,
1213  0x30, 0x35, 0x31, 0x37, 0x31, 0x32, 0x34, 0x39, 0x5a, 0x30, 0x15, 0x31, 0x13,
1214  0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e,
1215  0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03,
1216  0x01, 0x00, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
1217  0x01, 0x05, 0x05, 0x00, 0x03, 0x41, 0x00, 0x20, 0x3b, 0xdb, 0x4d, 0x67, 0x50,
1218  0xec, 0x73, 0x9d, 0xf9, 0x85, 0x5d, 0x18, 0xe9, 0xb4, 0x98, 0xe3, 0x31, 0xb7,
1219  0x03, 0x0b, 0xc0, 0x39, 0x93, 0x56, 0x81, 0x0a, 0xfc, 0x78, 0xa8, 0x29, 0x42,
1220  0x5f, 0x69, 0xfb, 0xbc, 0x5b, 0xf2, 0xa6, 0x2a, 0xbe, 0x91, 0x2c, 0xfc, 0x89,
1221  0x69, 0x15, 0x18, 0x58, 0xe5, 0x02, 0x75, 0xf7, 0x2a, 0xb6, 0xa9, 0xfb, 0x47,
1222  0x6a, 0x6e, 0x0a, 0x9b, 0xe9, 0xdc };
1223 /* chain10_0 -+
1224  *            +-> chain7_1
1225  * chain10_1 -+
1226  * A chain with two issuers, only one of whose dates is valid.
1227  */
1228 static const BYTE chain10_0[] = {
1229 0x30,0x82,0x01,0x9b,0x30,0x82,0x01,0x08,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
1230 0x4a,0x30,0x3a,0x42,0xa2,0x5a,0xb3,0x93,0x4d,0x94,0x06,0xad,0x6d,0x1c,0x34,
1231 0xe6,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
1232 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
1233 0x30,0x1e,0x17,0x0d,0x30,0x36,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
1234 0x30,0x5a,0x17,0x0d,0x30,0x36,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
1235 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
1236 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
1237 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
1238 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
1239 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
1240 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
1241 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
1242 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
1243 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
1244 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
1245 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
1246 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
1247 0x00,0x01,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x81,
1248 0x81,0x00,0x85,0x6e,0x35,0x2f,0x2c,0x51,0x4f,0xd6,0x2a,0xe4,0x9e,0xd0,0x4b,
1249 0xe6,0x90,0xfd,0xf7,0x20,0xad,0x76,0x3f,0x93,0xea,0x7f,0x0d,0x1f,0xb3,0x8e,
1250 0xfd,0xe0,0xe1,0xd6,0xd7,0x9c,0x7d,0x46,0x6b,0x15,0x5c,0xe6,0xc9,0x62,0x3b,
1251 0x70,0x4a,0x4b,0xb2,0x82,0xe3,0x55,0x0c,0xc4,0x90,0x44,0x06,0x6c,0x86,0x1c,
1252 0x6d,0x47,0x12,0xda,0x33,0x95,0x5d,0x98,0x43,0xcb,0x7c,0xfa,0x2b,0xee,0xc4,
1253 0x2d,0xc8,0x95,0x33,0x89,0x08,0x3f,0x9f,0x87,0xea,0x20,0x04,0xaf,0x58,0x4b,
1254 0x9d,0xc0,0x7c,0x0a,0x1b,0x05,0x31,0x3b,0xbb,0x13,0x58,0x2e,0x3f,0x61,0x6b,
1255 0x10,0xb4,0xeb,0xb9,0x1a,0x30,0xfd,0xea,0xca,0x29,0x99,0x5f,0x42,0x2b,0x00,
1256 0xb0,0x08,0xc3,0xf0,0xb6,0xd6,0x6b,0xf9,0x35,0x95 };
1257 static const BYTE chain10_1[] = {
1258 0x30,0x82,0x01,0x9b,0x30,0x82,0x01,0x08,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
1259 0xbf,0x99,0x4f,0x14,0x03,0x77,0x44,0xb8,0x49,0x02,0x70,0xa1,0xb8,0x9c,0xa7,
1260 0x24,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
1261 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
1262 0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
1263 0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
1264 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
1265 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
1266 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
1267 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
1268 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
1269 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
1270 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
1271 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
1272 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
1273 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
1274 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
1275 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
1276 0x00,0x01,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x81,
1277 0x81,0x00,0xa8,0xec,0x8c,0x34,0xe7,0x2c,0xdf,0x75,0x87,0xc4,0xf7,0xda,0x71,
1278 0x72,0x29,0xb2,0x48,0xa8,0x2a,0xec,0x7b,0x7d,0x19,0xb9,0x5f,0x1d,0xd9,0x91,
1279 0x2b,0xc4,0x28,0x7e,0xd6,0xb5,0x91,0x69,0xa5,0x8a,0x1a,0x1f,0x97,0x98,0x46,
1280 0x9d,0xdf,0x12,0xf6,0x45,0x62,0xad,0x60,0xb6,0xba,0xb0,0xfd,0xf5,0x9f,0xc6,
1281 0x98,0x05,0x4f,0x4d,0x48,0xdc,0xee,0x69,0xbe,0xb8,0xc4,0xc4,0xd7,0x1b,0xb1,
1282 0x1f,0x64,0xd6,0x45,0xa7,0xdb,0xb3,0x87,0x63,0x0f,0x54,0xe1,0x3a,0x6b,0x57,
1283 0x36,0xd7,0x68,0x65,0xcf,0xda,0x57,0x8d,0xcd,0x84,0x75,0x47,0x26,0x2c,0xef,
1284 0x1e,0x8f,0xc7,0x3b,0xee,0x5d,0x03,0xa6,0xdf,0x3a,0x20,0xb2,0xcc,0xc9,0x09,
1285 0x2c,0xfe,0x2b,0x79,0xb0,0xca,0x2c,0x9a,0x81,0x6b };
1286 static const BYTE chain7_1[] = {
1287 0x30,0x82,0x01,0x93,0x30,0x81,0xfd,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
1288 0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,
1289 0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,
1290 0x72,0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,
1291 0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,
1292 0x35,0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,
1293 0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,
1294 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,
1295 0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,0x33,
1296 0x0e,0x67,0x5f,0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,0xdc,
1297 0xb6,0x17,0x8e,0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,0x48,
1298 0x9f,0x6e,0xfe,0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,0x47,
1299 0xd1,0x57,0x71,0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,0x05,
1300 0x72,0xa7,0x87,0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,0x6a,
1301 0x80,0x83,0x68,0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,0x85,
1302 0xb5,0x46,0x36,0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,0xd3,
1303 0x51,0x9a,0x22,0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,0xa3,
1304 0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,
1305 0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0x9f,0x69,0xfd,0x26,0xd5,0x4b,
1306 0xe0,0xab,0x12,0x21,0xb9,0xfc,0xf7,0xe0,0x0c,0x09,0x94,0xad,0x27,0xd7,0x9d,
1307 0xa3,0xcc,0x46,0x2a,0x25,0x9a,0x24,0xa7,0x31,0x58,0x78,0xf5,0xfc,0x30,0xe1,
1308 0x6d,0xfd,0x59,0xab,0xbe,0x69,0xa0,0xea,0xe3,0x7d,0x7a,0x7b,0xe5,0x85,0xeb,
1309 0x86,0x6a,0x84,0x3c,0x96,0x01,0x1a,0x70,0xa7,0xb8,0xcb,0xf2,0x11,0xe7,0x52,
1310 0x9c,0x58,0x2d,0xac,0x63,0xce,0x72,0x4b,0xad,0x62,0xa8,0x1d,0x75,0x96,0xe2,
1311 0x27,0xf5,0x6f,0xba,0x91,0xf8,0xf1,0xb0,0xbf,0x90,0x24,0x6d,0xba,0x5d,0xd7,
1312 0x39,0x63,0x3b,0x7c,0x04,0x5d,0x89,0x9d,0x1c,0xf2,0xf7,0xcc,0xdf,0x6e,0x8a,
1313 0x43,0xa9,0xdd,0x86,0x05,0xa2,0xf3,0x22,0x2d,0x1e,0x70,0xa1,0x59,0xd7,0xa5,
1314 0x94,0x7d };
1315
1316 static void testGetIssuerCert(void)
1317 {
1318     BOOL ret;
1319     PCCERT_CONTEXT parent, child, cert1, cert2;
1320     DWORD flags = 0xffffffff;
1321     HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1322      CERT_STORE_CREATE_NEW_FLAG, NULL);
1323
1324     ok(store != NULL, "CertOpenStore failed: %08x\n", GetLastError());
1325
1326     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1327      expiredCert, sizeof(expiredCert), CERT_STORE_ADD_ALWAYS, NULL);
1328     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1329      GetLastError());
1330
1331     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1332      childOfExpired, sizeof(childOfExpired), CERT_STORE_ADD_ALWAYS, &child);
1333     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1334      GetLastError());
1335
1336     /* These crash:
1337     parent = CertGetIssuerCertificateFromStore(NULL, NULL, NULL, NULL);
1338     parent = CertGetIssuerCertificateFromStore(store, NULL, NULL, NULL);
1339      */
1340     parent = CertGetIssuerCertificateFromStore(NULL, NULL, NULL, &flags);
1341     ok(!parent && GetLastError() == E_INVALIDARG,
1342      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1343     parent = CertGetIssuerCertificateFromStore(store, NULL, NULL, &flags);
1344     ok(!parent && GetLastError() == E_INVALIDARG,
1345      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1346     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1347     ok(!parent && GetLastError() == E_INVALIDARG,
1348      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1349     /* Confusing: the caller cannot set either of the
1350      * CERT_STORE_NO_*_FLAGs, as these are not checks,
1351      * they're results:
1352      */
1353     flags = CERT_STORE_NO_CRL_FLAG | CERT_STORE_NO_ISSUER_FLAG;
1354     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1355     ok(!parent && GetLastError() == E_INVALIDARG,
1356      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1357     /* Perform no checks */
1358     flags = 0;
1359     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1360     ok(parent != NULL, "CertGetIssuerCertificateFromStore failed: %08x\n",
1361      GetLastError());
1362     if (parent)
1363         CertFreeCertificateContext(parent);
1364     /* Check revocation and signature only */
1365     flags = CERT_STORE_REVOCATION_FLAG | CERT_STORE_SIGNATURE_FLAG;
1366     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1367     ok(parent != NULL, "CertGetIssuerCertificateFromStore failed: %08x\n",
1368      GetLastError());
1369     /* Confusing: CERT_STORE_REVOCATION_FLAG succeeds when there is no CRL by
1370      * setting CERT_STORE_NO_CRL_FLAG.
1371      */
1372     ok(flags == (CERT_STORE_REVOCATION_FLAG | CERT_STORE_NO_CRL_FLAG),
1373      "Expected CERT_STORE_REVOCATION_FLAG | CERT_STORE_NO_CRL_FLAG, got %08x\n",
1374      flags);
1375     if (parent)
1376         CertFreeCertificateContext(parent);
1377     /* Now check just the time */
1378     flags = CERT_STORE_TIME_VALIDITY_FLAG;
1379     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1380     ok(parent != NULL, "CertGetIssuerCertificateFromStore failed: %08x\n",
1381      GetLastError());
1382     /* Oops: the child is not expired, so the time validity check actually
1383      * succeeds, even though the signing cert is expired.
1384      */
1385     ok(!flags, "Expected check to succeed, got %08x\n", flags);
1386     if (parent)
1387         CertFreeCertificateContext(parent);
1388
1389     CertFreeCertificateContext(child);
1390     CertCloseStore(store, 0);
1391
1392     flags = 0;
1393     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1394      CERT_STORE_CREATE_NEW_FLAG, NULL);
1395     /* With only the child certificate, no issuer will be found */
1396     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1397      chain7_1, sizeof(chain7_1), CERT_STORE_ADD_ALWAYS, &child);
1398     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1399     ok(parent == NULL, "Expected no issuer\n");
1400     /* Adding an issuer allows one (and only one) issuer to be found */
1401     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1402      chain10_1, sizeof(chain10_1), CERT_STORE_ADD_ALWAYS, &cert1);
1403     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1404     ok(parent == cert1, "Expected cert1 to be the issuer\n");
1405     parent = CertGetIssuerCertificateFromStore(store, child, parent, &flags);
1406     ok(parent == NULL, "Expected only one issuer\n");
1407     /* Adding a second issuer allows two issuers to be found - and the second
1408      * issuer is found before the first, implying certs are added to the head
1409      * of a list.
1410      */
1411     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1412      chain10_0, sizeof(chain10_0), CERT_STORE_ADD_ALWAYS, &cert2);
1413     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1414     ok(parent == cert2, "Expected cert2 to be the first issuer\n");
1415     parent = CertGetIssuerCertificateFromStore(store, child, parent, &flags);
1416     ok(parent == cert1, "Expected cert1 to be the second issuer\n");
1417     parent = CertGetIssuerCertificateFromStore(store, child, parent, &flags);
1418     ok(parent == NULL, "Expected no more than two issuers\n");
1419     /* It's possible to start enumerating from any certificate in the store */
1420     parent = CertGetIssuerCertificateFromStore(store, child, cert1, &flags);
1421     ok(parent == NULL, "Expected no issuer\n");
1422     parent = CertGetIssuerCertificateFromStore(store, child, cert2, &flags);
1423     ok(parent == cert1, "Expected cert1 to be the second issuer\n");
1424     parent = CertGetIssuerCertificateFromStore(store, child, parent, &flags);
1425     ok(parent == NULL, "Expected no more than two issuers\n");
1426     CertFreeCertificateContext(child);
1427     CertFreeCertificateContext(cert1);
1428     CertFreeCertificateContext(cert2);
1429     CertCloseStore(store, 0);
1430
1431     /* Repeat the test, reversing the order in which issuers are added,
1432      * to show it's order-dependent.
1433      */
1434     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1435      CERT_STORE_CREATE_NEW_FLAG, NULL);
1436     /* With only the child certificate, no issuer will be found */
1437     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1438      chain7_1, sizeof(chain7_1), CERT_STORE_ADD_ALWAYS, &child);
1439     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1440     ok(parent == NULL, "Expected no issuer\n");
1441     /* Adding an issuer allows one (and only one) issuer to be found */
1442     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1443      chain10_0, sizeof(chain10_0), CERT_STORE_ADD_ALWAYS, &cert1);
1444     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1445     ok(parent == cert1, "Expected cert1 to be the issuer\n");
1446     parent = CertGetIssuerCertificateFromStore(store, child, parent, &flags);
1447     ok(parent == NULL, "Expected only one issuer\n");
1448     /* Adding a second issuer allows two issuers to be found - and the second
1449      * issuer is found before the first, implying certs are added to the head
1450      * of a list.
1451      */
1452     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1453      chain10_1, sizeof(chain10_1), CERT_STORE_ADD_ALWAYS, &cert2);
1454     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1455     ok(parent == cert2, "Expected cert2 to be the first issuer\n");
1456     parent = CertGetIssuerCertificateFromStore(store, child, parent, &flags);
1457     ok(parent == cert1, "Expected cert1 to be the second issuer\n");
1458     parent = CertGetIssuerCertificateFromStore(store, child, parent, &flags);
1459     ok(parent == NULL, "Expected no more than two issuers\n");
1460     /* It's possible to start enumerating from any certificate in the store */
1461     parent = CertGetIssuerCertificateFromStore(store, child, cert1, &flags);
1462     ok(parent == NULL, "Expected no issuer\n");
1463     parent = CertGetIssuerCertificateFromStore(store, child, cert2, &flags);
1464     ok(parent == cert1, "Expected cert1 to be the second issuer\n");
1465     parent = CertGetIssuerCertificateFromStore(store, child, parent, &flags);
1466     ok(parent == NULL, "Expected no more than two issuers\n");
1467     CertFreeCertificateContext(child);
1468     CertFreeCertificateContext(cert1);
1469     CertFreeCertificateContext(cert2);
1470     CertCloseStore(store, 0);
1471 }
1472
1473 static void testCryptHashCert(void)
1474 {
1475     static const BYTE emptyHash[] = { 0xda, 0x39, 0xa3, 0xee, 0x5e, 0x6b, 0x4b,
1476      0x0d, 0x32, 0x55, 0xbf, 0xef, 0x95, 0x60, 0x18, 0x90, 0xaf, 0xd8, 0x07,
1477      0x09 };
1478     static const BYTE knownHash[] = { 0xae, 0x9d, 0xbf, 0x6d, 0xf5, 0x46, 0xee,
1479      0x8b, 0xc5, 0x7a, 0x13, 0xba, 0xc2, 0xb1, 0x04, 0xf2, 0xbf, 0x52, 0xa8,
1480      0xa2 };
1481     static const BYTE toHash[] = "abcdefghijklmnopqrstuvwxyz0123456789.,;!?:";
1482     BOOL ret;
1483     BYTE hash[20];
1484     DWORD hashLen = sizeof(hash);
1485
1486     /* NULL buffer and nonzero length crashes
1487     ret = CryptHashCertificate(0, 0, 0, NULL, size, hash, &hashLen);
1488        empty hash length also crashes
1489     ret = CryptHashCertificate(0, 0, 0, buf, size, hash, NULL);
1490      */
1491     /* Test empty hash */
1492     ret = CryptHashCertificate(0, 0, 0, toHash, sizeof(toHash), NULL,
1493      &hashLen);
1494     ok(ret, "CryptHashCertificate failed: %08x\n", GetLastError());
1495     ok(hashLen == sizeof(hash), "Got unexpected size of hash %d\n", hashLen);
1496     /* Test with empty buffer */
1497     ret = CryptHashCertificate(0, 0, 0, NULL, 0, hash, &hashLen);
1498     ok(ret, "CryptHashCertificate failed: %08x\n", GetLastError());
1499     ok(!memcmp(hash, emptyHash, sizeof(emptyHash)),
1500      "Unexpected hash of nothing\n");
1501     /* Test a known value */
1502     ret = CryptHashCertificate(0, 0, 0, toHash, sizeof(toHash), hash,
1503      &hashLen);
1504     ok(ret, "CryptHashCertificate failed: %08x\n", GetLastError());
1505     ok(!memcmp(hash, knownHash, sizeof(knownHash)), "Unexpected hash\n");
1506 }
1507
1508 static void verifySig(HCRYPTPROV csp, const BYTE *toSign, size_t toSignLen,
1509  const BYTE *sig, unsigned int sigLen)
1510 {
1511     HCRYPTHASH hash;
1512     BOOL ret = CryptCreateHash(csp, CALG_SHA1, 0, 0, &hash);
1513
1514     ok(ret, "CryptCreateHash failed: %08x\n", GetLastError());
1515     if (ret)
1516     {
1517         BYTE mySig[64];
1518         DWORD mySigSize = sizeof(mySig);
1519
1520         ret = CryptHashData(hash, toSign, toSignLen, 0);
1521         ok(ret, "CryptHashData failed: %08x\n", GetLastError());
1522         /* use the A variant so the test can run on Win9x */
1523         ret = CryptSignHashA(hash, AT_SIGNATURE, NULL, 0, mySig, &mySigSize);
1524         ok(ret, "CryptSignHash failed: %08x\n", GetLastError());
1525         if (ret)
1526         {
1527             ok(mySigSize == sigLen, "Expected sig length %d, got %d\n",
1528              sigLen, mySigSize);
1529             ok(!memcmp(mySig, sig, sigLen), "Unexpected signature\n");
1530         }
1531         CryptDestroyHash(hash);
1532     }
1533 }
1534
1535 /* Tests signing the certificate described by toBeSigned with the CSP passed in,
1536  * using the algorithm with OID sigOID.  The CSP is assumed to be empty, and a
1537  * keyset named AT_SIGNATURE will be added to it.  The signing key will be
1538  * stored in *key, and the signature will be stored in sig.  sigLen should be
1539  * at least 64 bytes.
1540  */
1541 static void testSignCert(HCRYPTPROV csp, const CRYPT_DATA_BLOB *toBeSigned,
1542  LPCSTR sigOID, HCRYPTKEY *key, BYTE *sig, DWORD *sigLen)
1543 {
1544     BOOL ret;
1545     DWORD size = 0;
1546     CRYPT_ALGORITHM_IDENTIFIER algoID = { NULL, { 0, NULL } };
1547
1548     /* These all crash
1549     ret = CryptSignCertificate(0, 0, 0, NULL, 0, NULL, NULL, NULL, NULL);
1550     ret = CryptSignCertificate(0, 0, 0, NULL, 0, NULL, NULL, NULL, &size);
1551     ret = CryptSignCertificate(0, 0, 0, toBeSigned->pbData, toBeSigned->cbData,
1552      NULL, NULL, NULL, &size);
1553      */
1554     ret = CryptSignCertificate(0, 0, 0, toBeSigned->pbData, toBeSigned->cbData,
1555      &algoID, NULL, NULL, &size);
1556     ok(!ret && GetLastError() == NTE_BAD_ALGID,
1557      "Expected NTE_BAD_ALGID, got %08x\n", GetLastError());
1558     algoID.pszObjId = (LPSTR)sigOID;
1559     ret = CryptSignCertificate(0, 0, 0, toBeSigned->pbData, toBeSigned->cbData,
1560      &algoID, NULL, NULL, &size);
1561     ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
1562      "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
1563     ret = CryptSignCertificate(0, AT_SIGNATURE, 0, toBeSigned->pbData,
1564      toBeSigned->cbData, &algoID, NULL, NULL, &size);
1565     ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
1566      "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
1567
1568     /* No keys exist in the new CSP yet.. */
1569     ret = CryptSignCertificate(csp, AT_SIGNATURE, 0, toBeSigned->pbData,
1570      toBeSigned->cbData, &algoID, NULL, NULL, &size);
1571     ok(!ret && (GetLastError() == NTE_BAD_KEYSET || GetLastError() ==
1572      NTE_NO_KEY), "Expected NTE_BAD_KEYSET or NTE_NO_KEY, got %08x\n",
1573      GetLastError());
1574     ret = CryptGenKey(csp, AT_SIGNATURE, 0, key);
1575     ok(ret, "CryptGenKey failed: %08x\n", GetLastError());
1576     if (ret)
1577     {
1578         ret = CryptSignCertificate(csp, AT_SIGNATURE, 0, toBeSigned->pbData,
1579          toBeSigned->cbData, &algoID, NULL, NULL, &size);
1580         ok(ret, "CryptSignCertificate failed: %08x\n", GetLastError());
1581         ok(size <= *sigLen, "Expected size <= %d, got %d\n", *sigLen, size);
1582         if (ret)
1583         {
1584             ret = CryptSignCertificate(csp, AT_SIGNATURE, 0, toBeSigned->pbData,
1585              toBeSigned->cbData, &algoID, NULL, sig, &size);
1586             ok(ret, "CryptSignCertificate failed: %08x\n", GetLastError());
1587             if (ret)
1588             {
1589                 *sigLen = size;
1590                 verifySig(csp, toBeSigned->pbData, toBeSigned->cbData, sig,
1591                  size);
1592             }
1593         }
1594     }
1595 }
1596
1597 static void testVerifyCertSig(HCRYPTPROV csp, const CRYPT_DATA_BLOB *toBeSigned,
1598  LPCSTR sigOID, const BYTE *sig, DWORD sigLen)
1599 {
1600     CERT_SIGNED_CONTENT_INFO info;
1601     LPBYTE cert = NULL;
1602     DWORD size = 0;
1603     BOOL ret;
1604
1605     if (!pCryptVerifyCertificateSignatureEx)
1606     {
1607         skip("no CryptVerifyCertificateSignatureEx support\n");
1608         return;
1609     }
1610     ret = pCryptVerifyCertificateSignatureEx(0, 0, 0, NULL, 0, NULL, 0, NULL);
1611     ok(!ret && GetLastError() == E_INVALIDARG,
1612      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1613     ret = pCryptVerifyCertificateSignatureEx(csp, 0, 0, NULL, 0, NULL, 0, NULL);
1614     ok(!ret && GetLastError() == E_INVALIDARG,
1615      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1616     ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING, 0, NULL, 0,
1617      NULL, 0, NULL);
1618     ok(!ret && GetLastError() == E_INVALIDARG,
1619      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1620     /* This crashes
1621     ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1622      CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, NULL, 0, NULL, 0, NULL);
1623      */
1624     info.ToBeSigned.cbData = toBeSigned->cbData;
1625     info.ToBeSigned.pbData = toBeSigned->pbData;
1626     info.SignatureAlgorithm.pszObjId = (LPSTR)sigOID;
1627     info.SignatureAlgorithm.Parameters.cbData = 0;
1628     info.Signature.cbData = sigLen;
1629     info.Signature.pbData = (BYTE *)sig;
1630     info.Signature.cUnusedBits = 0;
1631     ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT, &info,
1632      CRYPT_ENCODE_ALLOC_FLAG, NULL, (BYTE *)&cert, &size);
1633     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
1634     if (cert)
1635     {
1636         CRYPT_DATA_BLOB certBlob = { 0, NULL };
1637         PCERT_PUBLIC_KEY_INFO pubKeyInfo = NULL;
1638
1639         ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1640          CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob, 0, NULL, 0, NULL);
1641         ok(!ret && GetLastError() == CRYPT_E_ASN1_EOD,
1642          "Expected CRYPT_E_ASN1_EOD, got %08x\n", GetLastError());
1643         certBlob.cbData = 1;
1644         certBlob.pbData = (void *)0xdeadbeef;
1645         ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1646          CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob, 0, NULL, 0, NULL);
1647         ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
1648          "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
1649         certBlob.cbData = size;
1650         certBlob.pbData = cert;
1651         ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1652          CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob, 0, NULL, 0, NULL);
1653         ok(!ret && GetLastError() == E_INVALIDARG,
1654          "Expected E_INVALIDARG, got %08x\n", GetLastError());
1655         ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1656          CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob,
1657          CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL, NULL, 0, NULL);
1658         ok(!ret && GetLastError() == E_INVALIDARG,
1659          "Expected E_INVALIDARG, got %08x\n", GetLastError());
1660         /* This crashes
1661         ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1662          CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob,
1663          CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, NULL, 0, NULL);
1664          */
1665         CryptExportPublicKeyInfoEx(csp, AT_SIGNATURE, X509_ASN_ENCODING,
1666          (LPSTR)sigOID, 0, NULL, NULL, &size);
1667         pubKeyInfo = HeapAlloc(GetProcessHeap(), 0, size);
1668         if (pubKeyInfo)
1669         {
1670             ret = CryptExportPublicKeyInfoEx(csp, AT_SIGNATURE,
1671              X509_ASN_ENCODING, (LPSTR)sigOID, 0, NULL, pubKeyInfo, &size);
1672             ok(ret, "CryptExportKey failed: %08x\n", GetLastError());
1673             if (ret)
1674             {
1675                 ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1676                  CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob,
1677                  CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pubKeyInfo, 0, NULL);
1678                 ok(ret, "CryptVerifyCertificateSignatureEx failed: %08x\n",
1679                  GetLastError());
1680             }
1681             HeapFree(GetProcessHeap(), 0, pubKeyInfo);
1682         }
1683         LocalFree(cert);
1684     }
1685 }
1686
1687 static BYTE emptyCert[] = { 0x30, 0x00 };
1688
1689 static void testCertSigs(void)
1690 {
1691     HCRYPTPROV csp;
1692     CRYPT_DATA_BLOB toBeSigned = { sizeof(emptyCert), emptyCert };
1693     BOOL ret;
1694     HCRYPTKEY key;
1695     BYTE sig[64];
1696     DWORD sigSize = sizeof(sig);
1697
1698     /* Just in case a previous run failed, delete this thing */
1699     pCryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
1700      CRYPT_DELETEKEYSET);
1701     ret = pCryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
1702      CRYPT_NEWKEYSET);
1703     ok(ret, "CryptAcquireContext failed: %08x\n", GetLastError());
1704
1705     testSignCert(csp, &toBeSigned, szOID_RSA_SHA1RSA, &key, sig, &sigSize);
1706     testVerifyCertSig(csp, &toBeSigned, szOID_RSA_SHA1RSA, sig, sigSize);
1707
1708     CryptDestroyKey(key);
1709     CryptReleaseContext(csp, 0);
1710     ret = pCryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
1711      CRYPT_DELETEKEYSET);
1712 }
1713
1714 static const BYTE md5SignedEmptyCert[] = {
1715 0x30,0x56,0x30,0x33,0x02,0x00,0x30,0x02,0x06,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,
1716 0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,0x31,
1717 0x36,0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x07,
1718 0x30,0x02,0x06,0x00,0x03,0x01,0x00,0x30,0x0c,0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,
1719 0x0d,0x02,0x05,0x05,0x00,0x03,0x11,0x00,0xfb,0x0f,0x66,0x82,0x66,0xd9,0xe5,0xf8,
1720 0xd8,0xa2,0x55,0x2b,0xe1,0xa5,0xd9,0x04 };
1721 static const BYTE md5SignedEmptyCertNoNull[] = {
1722 0x30,0x54,0x30,0x33,0x02,0x00,0x30,0x02,0x06,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,
1723 0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,0x31,
1724 0x36,0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x07,
1725 0x30,0x02,0x06,0x00,0x03,0x01,0x00,0x30,0x0a,0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,
1726 0x0d,0x02,0x05,0x03,0x11,0x00,0x04,0xd9,0xa5,0xe1,0x2b,0x55,0xa2,0xd8,0xf8,0xe5,
1727 0xd9,0x66,0x82,0x66,0x0f,0xfb };
1728
1729 static void testSignAndEncodeCert(void)
1730 {
1731     static char oid_rsa_md5rsa[] = szOID_RSA_MD5RSA;
1732     static char oid_rsa_md5[] = szOID_RSA_MD5;
1733     BOOL ret;
1734     DWORD size;
1735     CRYPT_ALGORITHM_IDENTIFIER algID = { 0 };
1736     CERT_INFO info = { 0 };
1737
1738     /* Crash
1739     ret = CryptSignAndEncodeCertificate(0, 0, 0, NULL, NULL, NULL, NULL, NULL,
1740      NULL);
1741     ret = CryptSignAndEncodeCertificate(0, 0, 0, NULL, NULL, NULL, NULL, NULL,
1742      &size);
1743      */
1744     ret = CryptSignAndEncodeCertificate(0, 0, 0, NULL, NULL, &algID, NULL, NULL,
1745      &size);
1746     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
1747      "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
1748     ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING, NULL, NULL,
1749      &algID, NULL, NULL, &size);
1750     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
1751      "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
1752     ret = CryptSignAndEncodeCertificate(0, 0, 0, X509_CERT_TO_BE_SIGNED, NULL,
1753      &algID, NULL, NULL, &size);
1754     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
1755      "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
1756     ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
1757      X509_CERT_TO_BE_SIGNED, NULL, &algID, NULL, NULL, &size);
1758     ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
1759      "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
1760     /* Crashes
1761     ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
1762      X509_CERT_TO_BE_SIGNED, &info, NULL, NULL, NULL, &size);
1763      */
1764     ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
1765      X509_CERT_TO_BE_SIGNED, &info, &algID, NULL, NULL, &size);
1766     ok(!ret && GetLastError() == NTE_BAD_ALGID,
1767      "Expected NTE_BAD_ALGID, got %08x\n", GetLastError());
1768     algID.pszObjId = oid_rsa_md5rsa;
1769     ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
1770      X509_CERT_TO_BE_SIGNED, &info, &algID, NULL, NULL, &size);
1771     ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
1772      "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
1773     algID.pszObjId = oid_rsa_md5;
1774     ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
1775      X509_CERT_TO_BE_SIGNED, &info, &algID, NULL, NULL, &size);
1776     ok(ret, "CryptSignAndEncodeCertificate failed: %08x\n", GetLastError());
1777     if (ret)
1778     {
1779         LPBYTE buf = HeapAlloc(GetProcessHeap(), 0, size);
1780
1781         if (buf)
1782         {
1783             ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
1784              X509_CERT_TO_BE_SIGNED, &info, &algID, NULL, buf, &size);
1785             ok(ret, "CryptSignAndEncodeCertificate failed: %08x\n",
1786              GetLastError());
1787             /* Tricky: because the NULL parameters may either be omitted or
1788              * included as an asn.1-encoded NULL (0x05,0x00), two different
1789              * values are allowed.
1790              */
1791             ok(size == sizeof(md5SignedEmptyCert) ||
1792              size == sizeof(md5SignedEmptyCertNoNull), "Unexpected size %d\n",
1793              size);
1794             if (size == sizeof(md5SignedEmptyCert))
1795                 ok(!memcmp(buf, md5SignedEmptyCert, size),
1796                  "Unexpected value\n");
1797             else if (size == sizeof(md5SignedEmptyCertNoNull))
1798                 ok(!memcmp(buf, md5SignedEmptyCertNoNull, size),
1799                  "Unexpected value\n");
1800             HeapFree(GetProcessHeap(), 0, buf);
1801         }
1802     }
1803 }
1804
1805 static void testCreateSelfSignCert(void)
1806 {
1807     PCCERT_CONTEXT context;
1808     CERT_NAME_BLOB name = { sizeof(subjectName), subjectName };
1809     HCRYPTPROV csp;
1810     BOOL ret;
1811     HCRYPTKEY key;
1812     CRYPT_KEY_PROV_INFO info;
1813
1814     /* This crashes:
1815     context = CertCreateSelfSignCertificate(0, NULL, 0, NULL, NULL, NULL, NULL,
1816      NULL);
1817      * Calling this with no first parameter creates a new key container, which
1818      * lasts beyond the test, so I don't test that.  Nb: the generated key
1819      * name is a GUID.
1820     context = CertCreateSelfSignCertificate(0, &name, 0, NULL, NULL, NULL, NULL,
1821      NULL);
1822      */
1823
1824     /* Acquire a CSP */
1825     pCryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
1826      CRYPT_DELETEKEYSET);
1827     ret = pCryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
1828      CRYPT_NEWKEYSET);
1829     ok(ret, "CryptAcquireContext failed: %08x\n", GetLastError());
1830
1831     context = CertCreateSelfSignCertificate(csp, &name, 0, NULL, NULL, NULL,
1832      NULL, NULL);
1833     ok(!context && GetLastError() == NTE_NO_KEY,
1834      "Expected NTE_NO_KEY, got %08x\n", GetLastError());
1835     ret = CryptGenKey(csp, AT_SIGNATURE, 0, &key);
1836     ok(ret, "CryptGenKey failed: %08x\n", GetLastError());
1837     if (ret)
1838     {
1839         context = CertCreateSelfSignCertificate(csp, &name, 0, NULL, NULL, NULL,
1840          NULL, NULL);
1841         ok(context != NULL, "CertCreateSelfSignCertificate failed: %08x\n",
1842          GetLastError());
1843         if (context)
1844         {
1845             DWORD size = 0;
1846             PCRYPT_KEY_PROV_INFO info;
1847
1848             /* The context must have a key provider info property */
1849             ret = CertGetCertificateContextProperty(context,
1850              CERT_KEY_PROV_INFO_PROP_ID, NULL, &size);
1851             ok(ret && size, "Expected non-zero key provider info\n");
1852             if (size)
1853             {
1854                 info = HeapAlloc(GetProcessHeap(), 0, size);
1855                 if (info)
1856                 {
1857                     ret = CertGetCertificateContextProperty(context,
1858                      CERT_KEY_PROV_INFO_PROP_ID, info, &size);
1859                     ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
1860                      GetLastError());
1861                     if (ret)
1862                     {
1863                         /* Sanity-check the key provider */
1864                         ok(!lstrcmpW(info->pwszContainerName, cspNameW),
1865                          "Unexpected key container\n");
1866                         ok(!lstrcmpW(info->pwszProvName, MS_DEF_PROV_W),
1867                          "Unexpected provider\n");
1868                         ok(info->dwKeySpec == AT_SIGNATURE,
1869                          "Expected AT_SIGNATURE, got %d\n", info->dwKeySpec);
1870                     }
1871                     HeapFree(GetProcessHeap(), 0, info);
1872                 }
1873             }
1874
1875             CertFreeCertificateContext(context);
1876         }
1877
1878         CryptDestroyKey(key);
1879     }
1880
1881     CryptReleaseContext(csp, 0);
1882     ret = pCryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
1883      CRYPT_DELETEKEYSET);
1884
1885     /* do the same test with AT_KEYEXCHANGE  and key info*/
1886     memset(&info,0,sizeof(info));
1887     info.dwProvType = PROV_RSA_FULL;
1888     info.dwKeySpec = AT_KEYEXCHANGE;
1889     info.pwszProvName = (LPWSTR) MS_DEF_PROV_W;
1890     info.pwszContainerName = cspNameW;
1891     context = CertCreateSelfSignCertificate(0, &name, 0, &info, NULL, NULL,
1892         NULL, NULL);
1893     ok(context != NULL, "CertCreateSelfSignCertificate failed: %08x\n",
1894         GetLastError());
1895     if (context)
1896     {
1897         DWORD size = 0;
1898         PCRYPT_KEY_PROV_INFO info;
1899
1900         /* The context must have a key provider info property */
1901         ret = CertGetCertificateContextProperty(context,
1902             CERT_KEY_PROV_INFO_PROP_ID, NULL, &size);
1903         ok(ret && size, "Expected non-zero key provider info\n");
1904         if (size)
1905         {
1906             info = HeapAlloc(GetProcessHeap(), 0, size);
1907             if (info)
1908             {
1909                 ret = CertGetCertificateContextProperty(context,
1910                     CERT_KEY_PROV_INFO_PROP_ID, info, &size);
1911                 ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
1912                     GetLastError());
1913                 if (ret)
1914                 {
1915                     /* Sanity-check the key provider */
1916                     ok(!lstrcmpW(info->pwszContainerName, cspNameW),
1917                         "Unexpected key container\n");
1918                     ok(!lstrcmpW(info->pwszProvName, MS_DEF_PROV_W),
1919                         "Unexpected provider\n");
1920                     ok(info->dwKeySpec == AT_KEYEXCHANGE,
1921                         "Expected AT_KEYEXCHANGE, got %d\n", info->dwKeySpec);
1922                 }
1923                 HeapFree(GetProcessHeap(), 0, info);
1924             }
1925         }
1926
1927         CertFreeCertificateContext(context);
1928     }
1929
1930     pCryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
1931         CRYPT_DELETEKEYSET);
1932 }
1933
1934 static const LPCSTR keyUsages[] = { szOID_PKIX_KP_CODE_SIGNING,
1935  szOID_PKIX_KP_CLIENT_AUTH, szOID_RSA_RSA };
1936
1937 static void testKeyUsage(void)
1938 {
1939     BOOL ret;
1940     PCCERT_CONTEXT context;
1941     DWORD size;
1942
1943     /* Test base cases */
1944     ret = CertGetEnhancedKeyUsage(NULL, 0, NULL, NULL);
1945     ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
1946      "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
1947     size = 1;
1948     ret = CertGetEnhancedKeyUsage(NULL, 0, NULL, &size);
1949     ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
1950      "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
1951     size = 0;
1952     ret = CertGetEnhancedKeyUsage(NULL, 0, NULL, &size);
1953     ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
1954      "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
1955     /* These crash
1956     ret = CertSetEnhancedKeyUsage(NULL, NULL);
1957     usage.cUsageIdentifier = 0;
1958     ret = CertSetEnhancedKeyUsage(NULL, &usage);
1959      */
1960     /* Test with a cert with no enhanced key usage extension */
1961     context = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert,
1962      sizeof(bigCert));
1963     ok(context != NULL, "CertCreateCertificateContext failed: %08x\n",
1964      GetLastError());
1965     if (context)
1966     {
1967         static const char oid[] = "1.2.3.4";
1968         BYTE buf[sizeof(CERT_ENHKEY_USAGE) + 2 * (sizeof(LPSTR) + sizeof(oid))];
1969         PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
1970
1971         ret = CertGetEnhancedKeyUsage(context, 0, NULL, NULL);
1972         ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
1973          "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
1974         size = 1;
1975         ret = CertGetEnhancedKeyUsage(context, 0, NULL, &size);
1976         if (ret)
1977         {
1978             /* Windows 2000, ME, or later: even though it succeeded, we expect
1979              * CRYPT_E_NOT_FOUND, which indicates there is no enhanced key
1980              * usage set for this cert (which implies it's valid for all uses.)
1981              */
1982             ok(GetLastError() == CRYPT_E_NOT_FOUND,
1983              "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
1984             ok(size == sizeof(CERT_ENHKEY_USAGE), "Wrong size %d\n", size);
1985             ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
1986             ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1987             ok(pUsage->cUsageIdentifier == 0, "Expected 0 usages, got %d\n",
1988              pUsage->cUsageIdentifier);
1989         }
1990         else
1991         {
1992             /* Windows NT, 95, or 98: it fails, and the last error is
1993              * CRYPT_E_NOT_FOUND.
1994              */
1995             ok(GetLastError() == CRYPT_E_NOT_FOUND,
1996              "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
1997         }
1998         /* I can add a usage identifier when no key usage has been set */
1999         ret = CertAddEnhancedKeyUsageIdentifier(context, oid);
2000         ok(ret, "CertAddEnhancedKeyUsageIdentifier failed: %08x\n",
2001          GetLastError());
2002         size = sizeof(buf);
2003         ret = CertGetEnhancedKeyUsage(context,
2004          CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2005         ok(ret && GetLastError() == 0,
2006          "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2007         ok(pUsage->cUsageIdentifier == 1, "Expected 1 usage, got %d\n",
2008          pUsage->cUsageIdentifier);
2009         if (pUsage->cUsageIdentifier)
2010             ok(!strcmp(pUsage->rgpszUsageIdentifier[0], oid),
2011              "Expected %s, got %s\n", oid, pUsage->rgpszUsageIdentifier[0]);
2012         /* Now set an empty key usage */
2013         pUsage->cUsageIdentifier = 0;
2014         ret = CertSetEnhancedKeyUsage(context, pUsage);
2015         ok(ret, "CertSetEnhancedKeyUsage failed: %08x\n", GetLastError());
2016         /* Shouldn't find it in the cert */
2017         size = sizeof(buf);
2018         ret = CertGetEnhancedKeyUsage(context,
2019          CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2020         ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
2021          "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
2022         /* Should find it as an extended property */
2023         ret = CertGetEnhancedKeyUsage(context,
2024          CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2025         ok(ret && GetLastError() == 0,
2026          "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2027         ok(pUsage->cUsageIdentifier == 0, "Expected 0 usages, got %d\n",
2028          pUsage->cUsageIdentifier);
2029         /* Should find it as either */
2030         ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
2031         ok(ret && GetLastError() == 0,
2032          "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2033         ok(pUsage->cUsageIdentifier == 0, "Expected 0 usages, got %d\n",
2034          pUsage->cUsageIdentifier);
2035         /* Add a usage identifier */
2036         ret = CertAddEnhancedKeyUsageIdentifier(context, oid);
2037         ok(ret, "CertAddEnhancedKeyUsageIdentifier failed: %08x\n",
2038          GetLastError());
2039         size = sizeof(buf);
2040         ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
2041         ok(ret && GetLastError() == 0,
2042          "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2043         ok(pUsage->cUsageIdentifier == 1, "Expected 1 identifier, got %d\n",
2044          pUsage->cUsageIdentifier);
2045         if (pUsage->cUsageIdentifier)
2046             ok(!strcmp(pUsage->rgpszUsageIdentifier[0], oid),
2047              "Expected %s, got %s\n", oid, pUsage->rgpszUsageIdentifier[0]);
2048         /* Yep, I can re-add the same usage identifier */
2049         ret = CertAddEnhancedKeyUsageIdentifier(context, oid);
2050         ok(ret, "CertAddEnhancedKeyUsageIdentifier failed: %08x\n",
2051          GetLastError());
2052         size = sizeof(buf);
2053         ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
2054         ok(ret && GetLastError() == 0,
2055          "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2056         ok(pUsage->cUsageIdentifier == 2, "Expected 2 identifiers, got %d\n",
2057          pUsage->cUsageIdentifier);
2058         if (pUsage->cUsageIdentifier)
2059             ok(!strcmp(pUsage->rgpszUsageIdentifier[0], oid),
2060              "Expected %s, got %s\n", oid, pUsage->rgpszUsageIdentifier[0]);
2061         if (pUsage->cUsageIdentifier >= 2)
2062             ok(!strcmp(pUsage->rgpszUsageIdentifier[1], oid),
2063              "Expected %s, got %s\n", oid, pUsage->rgpszUsageIdentifier[1]);
2064         /* Now set a NULL extended property--this deletes the property. */
2065         ret = CertSetEnhancedKeyUsage(context, NULL);
2066         ok(ret, "CertSetEnhancedKeyUsage failed: %08x\n", GetLastError());
2067         SetLastError(0xbaadcafe);
2068         size = sizeof(buf);
2069         ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
2070         ok(GetLastError() == CRYPT_E_NOT_FOUND,
2071          "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
2072
2073         CertFreeCertificateContext(context);
2074     }
2075     /* Now test with a cert with an enhanced key usage extension */
2076     context = CertCreateCertificateContext(X509_ASN_ENCODING, certWithUsage,
2077      sizeof(certWithUsage));
2078     ok(context != NULL, "CertCreateCertificateContext failed: %08x\n",
2079      GetLastError());
2080     if (context)
2081     {
2082         LPBYTE buf = NULL;
2083         DWORD bufSize = 0, i;
2084
2085         /* The size may depend on what flags are used to query it, so I
2086          * realloc the buffer for each test.
2087          */
2088         ret = CertGetEnhancedKeyUsage(context,
2089          CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG, NULL, &bufSize);
2090         ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2091         buf = HeapAlloc(GetProcessHeap(), 0, bufSize);
2092         if (buf)
2093         {
2094             PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
2095
2096             /* Should find it in the cert */
2097             size = bufSize;
2098             ret = CertGetEnhancedKeyUsage(context,
2099              CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2100             ok(ret && GetLastError() == 0,
2101              "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2102             ok(pUsage->cUsageIdentifier == 3, "Expected 3 usages, got %d\n",
2103              pUsage->cUsageIdentifier);
2104             for (i = 0; i < pUsage->cUsageIdentifier; i++)
2105                 ok(!strcmp(pUsage->rgpszUsageIdentifier[i], keyUsages[i]),
2106                  "Expected %s, got %s\n", keyUsages[i],
2107                  pUsage->rgpszUsageIdentifier[i]);
2108             HeapFree(GetProcessHeap(), 0, buf);
2109         }
2110         ret = CertGetEnhancedKeyUsage(context, 0, NULL, &bufSize);
2111         ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2112         buf = HeapAlloc(GetProcessHeap(), 0, bufSize);
2113         if (buf)
2114         {
2115             PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
2116
2117             /* Should find it as either */
2118             size = bufSize;
2119             ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
2120             /* In Windows, GetLastError returns CRYPT_E_NOT_FOUND not found
2121              * here, even though the return is successful and the usage id
2122              * count is positive.  I don't enforce that here.
2123              */
2124             ok(ret,
2125              "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2126             ok(pUsage->cUsageIdentifier == 3, "Expected 3 usages, got %d\n",
2127              pUsage->cUsageIdentifier);
2128             for (i = 0; i < pUsage->cUsageIdentifier; i++)
2129                 ok(!strcmp(pUsage->rgpszUsageIdentifier[i], keyUsages[i]),
2130                  "Expected %s, got %s\n", keyUsages[i],
2131                  pUsage->rgpszUsageIdentifier[i]);
2132             HeapFree(GetProcessHeap(), 0, buf);
2133         }
2134         /* Shouldn't find it as an extended property */
2135         ret = CertGetEnhancedKeyUsage(context,
2136          CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size);
2137         ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
2138          "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
2139         /* Adding a usage identifier overrides the cert's usage!? */
2140         ret = CertAddEnhancedKeyUsageIdentifier(context, szOID_RSA_RSA);
2141         ok(ret, "CertAddEnhancedKeyUsageIdentifier failed: %08x\n",
2142          GetLastError());
2143         ret = CertGetEnhancedKeyUsage(context, 0, NULL, &bufSize);
2144         ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2145         buf = HeapAlloc(GetProcessHeap(), 0, bufSize);
2146         if (buf)
2147         {
2148             PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
2149
2150             /* Should find it as either */
2151             size = bufSize;
2152             ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
2153             ok(ret,
2154              "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2155             ok(pUsage->cUsageIdentifier == 1, "Expected 1 usage, got %d\n",
2156              pUsage->cUsageIdentifier);
2157             ok(!strcmp(pUsage->rgpszUsageIdentifier[0], szOID_RSA_RSA),
2158              "Expected %s, got %s\n", szOID_RSA_RSA,
2159              pUsage->rgpszUsageIdentifier[0]);
2160             HeapFree(GetProcessHeap(), 0, buf);
2161         }
2162         /* But querying the cert directly returns its usage */
2163         ret = CertGetEnhancedKeyUsage(context,
2164          CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG, NULL, &bufSize);
2165         ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2166         buf = HeapAlloc(GetProcessHeap(), 0, bufSize);
2167         if (buf)
2168         {
2169             PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
2170
2171             size = bufSize;
2172             ret = CertGetEnhancedKeyUsage(context,
2173              CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2174             ok(ret,
2175              "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2176             ok(pUsage->cUsageIdentifier == 3, "Expected 3 usages, got %d\n",
2177              pUsage->cUsageIdentifier);
2178             for (i = 0; i < pUsage->cUsageIdentifier; i++)
2179                 ok(!strcmp(pUsage->rgpszUsageIdentifier[i], keyUsages[i]),
2180                  "Expected %s, got %s\n", keyUsages[i],
2181                  pUsage->rgpszUsageIdentifier[i]);
2182             HeapFree(GetProcessHeap(), 0, buf);
2183         }
2184         /* And removing the only usage identifier in the extended property
2185          * results in the cert's key usage being found.
2186          */
2187         ret = CertRemoveEnhancedKeyUsageIdentifier(context, szOID_RSA_RSA);
2188         ok(ret, "CertRemoveEnhancedKeyUsage failed: %08x\n", GetLastError());
2189         ret = CertGetEnhancedKeyUsage(context, 0, NULL, &bufSize);
2190         ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2191         buf = HeapAlloc(GetProcessHeap(), 0, bufSize);
2192         if (buf)
2193         {
2194             PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
2195
2196             /* Should find it as either */
2197             size = bufSize;
2198             ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
2199             ok(ret,
2200              "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2201             ok(pUsage->cUsageIdentifier == 3, "Expected 3 usages, got %d\n",
2202              pUsage->cUsageIdentifier);
2203             for (i = 0; i < pUsage->cUsageIdentifier; i++)
2204                 ok(!strcmp(pUsage->rgpszUsageIdentifier[i], keyUsages[i]),
2205                  "Expected %s, got %s\n", keyUsages[i],
2206                  pUsage->rgpszUsageIdentifier[i]);
2207             HeapFree(GetProcessHeap(), 0, buf);
2208         }
2209
2210         CertFreeCertificateContext(context);
2211     }
2212 }
2213
2214 static void testCompareCertName(void)
2215 {
2216     static BYTE bogus[] = { 1, 2, 3, 4 };
2217     static BYTE bogusPrime[] = { 0, 1, 2, 3, 4 };
2218     static BYTE emptyPrime[] = { 0x30, 0x00, 0x01 };
2219     BOOL ret;
2220     CERT_NAME_BLOB blob1, blob2;
2221
2222     /* crashes
2223     ret = CertCompareCertificateName(0, NULL, NULL);
2224      */
2225     /* An empty name checks against itself.. */
2226     blob1.pbData = emptyCert;
2227     blob1.cbData = sizeof(emptyCert);
2228     ret = CertCompareCertificateName(0, &blob1, &blob1);
2229     ok(ret, "CertCompareCertificateName failed: %08x\n", GetLastError());
2230     /* It doesn't have to be a valid encoded name.. */
2231     blob1.pbData = bogus;
2232     blob1.cbData = sizeof(bogus);
2233     ret = CertCompareCertificateName(0, &blob1, &blob1);
2234     ok(ret, "CertCompareCertificateName failed: %08x\n", GetLastError());
2235     /* Leading zeroes matter.. */
2236     blob2.pbData = bogusPrime;
2237     blob2.cbData = sizeof(bogusPrime);
2238     ret = CertCompareCertificateName(0, &blob1, &blob2);
2239     ok(!ret, "Expected failure\n");
2240     /* As do trailing extra bytes. */
2241     blob2.pbData = emptyPrime;
2242     blob2.cbData = sizeof(emptyPrime);
2243     ret = CertCompareCertificateName(0, &blob1, &blob2);
2244     ok(!ret, "Expected failure\n");
2245 }
2246
2247 static BYTE int1[] = { 0x88, 0xff, 0xff, 0xff };
2248 static BYTE int2[] = { 0x88, 0xff };
2249 static BYTE int3[] = { 0x23, 0xff };
2250 static BYTE int4[] = { 0x7f, 0x00 };
2251 static BYTE int5[] = { 0x7f };
2252 static BYTE int6[] = { 0x80, 0x00, 0x00, 0x00 };
2253 static BYTE int7[] = { 0x80, 0x00 };
2254
2255 static struct IntBlobTest
2256 {
2257     CRYPT_INTEGER_BLOB blob1;
2258     CRYPT_INTEGER_BLOB blob2;
2259     BOOL areEqual;
2260 } intBlobs[] = {
2261  { { sizeof(int1), int1 }, { sizeof(int2), int2 }, TRUE },
2262  { { sizeof(int3), int3 }, { sizeof(int3), int3 }, TRUE },
2263  { { sizeof(int4), int4 }, { sizeof(int5), int5 }, TRUE },
2264  { { sizeof(int6), int6 }, { sizeof(int7), int7 }, TRUE },
2265  { { sizeof(int1), int1 }, { sizeof(int7), int7 }, FALSE },
2266 };
2267
2268 static void testCompareIntegerBlob(void)
2269 {
2270     DWORD i;
2271     BOOL ret;
2272
2273     for (i = 0; i < sizeof(intBlobs) / sizeof(intBlobs[0]); i++)
2274     {
2275         ret = CertCompareIntegerBlob(&intBlobs[i].blob1, &intBlobs[i].blob2);
2276         ok(ret == intBlobs[i].areEqual,
2277          "%d: expected blobs %s compare\n", i, intBlobs[i].areEqual ?
2278          "to" : "not to");
2279     }
2280 }
2281
2282 static void testComparePublicKeyInfo(void)
2283 {
2284     BOOL ret;
2285     CERT_PUBLIC_KEY_INFO info1 = { { 0 } }, info2 = { { 0 } };
2286     static CHAR oid_rsa_rsa[]     = szOID_RSA_RSA;
2287     static CHAR oid_rsa_sha1rsa[] = szOID_RSA_SHA1RSA;
2288     static CHAR oid_x957_dsa[]    = szOID_X957_DSA;
2289     static BYTE bits1[] = { 1, 0 };
2290     static BYTE bits2[] = { 0 };
2291     static BYTE bits3[] = { 1 };
2292
2293     /* crashes
2294     ret = CertComparePublicKeyInfo(0, NULL, NULL);
2295      */
2296     /* Empty public keys compare */
2297     ret = CertComparePublicKeyInfo(0, &info1, &info2);
2298     ok(ret, "CertComparePublicKeyInfo failed: %08x\n", GetLastError());
2299     /* Different OIDs appear to compare */
2300     info1.Algorithm.pszObjId = oid_rsa_rsa;
2301     info2.Algorithm.pszObjId = oid_rsa_sha1rsa;
2302     ret = CertComparePublicKeyInfo(0, &info1, &info2);
2303     ok(ret, "CertComparePublicKeyInfo failed: %08x\n", GetLastError());
2304     info2.Algorithm.pszObjId = oid_x957_dsa;
2305     ret = CertComparePublicKeyInfo(0, &info1, &info2);
2306     ok(ret, "CertComparePublicKeyInfo failed: %08x\n", GetLastError());
2307     info1.PublicKey.cbData = sizeof(bits1);
2308     info1.PublicKey.pbData = bits1;
2309     info1.PublicKey.cUnusedBits = 0;
2310     info2.PublicKey.cbData = sizeof(bits1);
2311     info2.PublicKey.pbData = bits1;
2312     info2.PublicKey.cUnusedBits = 0;
2313     ret = CertComparePublicKeyInfo(0, &info1, &info2);
2314     ok(ret, "CertComparePublicKeyInfo failed: %08x\n", GetLastError());
2315     /* Even though they compare in their used bits, these do not compare */
2316     info1.PublicKey.cbData = sizeof(bits2);
2317     info1.PublicKey.pbData = bits2;
2318     info1.PublicKey.cUnusedBits = 0;
2319     info2.PublicKey.cbData = sizeof(bits3);
2320     info2.PublicKey.pbData = bits3;
2321     info2.PublicKey.cUnusedBits = 1;
2322     ret = CertComparePublicKeyInfo(0, &info1, &info2);
2323     /* Simple (non-comparing) case */
2324     ok(!ret, "Expected keys not to compare\n");
2325     info2.PublicKey.cbData = sizeof(bits1);
2326     info2.PublicKey.pbData = bits1;
2327     info2.PublicKey.cUnusedBits = 0;
2328     ret = CertComparePublicKeyInfo(0, &info1, &info2);
2329     ok(!ret, "Expected keys not to compare\n");
2330 }
2331
2332 static void testHashPublicKeyInfo(void)
2333 {
2334     BOOL ret;
2335     CERT_PUBLIC_KEY_INFO info = { { 0 } };
2336     DWORD len;
2337
2338     /* Crash
2339     ret = CryptHashPublicKeyInfo(0, 0, 0, 0, NULL, NULL, NULL);
2340     ret = CryptHashPublicKeyInfo(0, 0, 0, 0, &info, NULL, NULL);
2341      */
2342     ret = CryptHashPublicKeyInfo(0, 0, 0, 0, NULL, NULL, &len);
2343     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
2344      "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
2345     ret = CryptHashPublicKeyInfo(0, 0, 0, X509_ASN_ENCODING, NULL, NULL, &len);
2346     ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
2347      "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
2348     ret = CryptHashPublicKeyInfo(0, 0, 0, X509_ASN_ENCODING, &info, NULL, &len);
2349     ok(ret, "CryptHashPublicKeyInfo failed: %08x\n", GetLastError());
2350     ok(len == 16, "Expected hash size 16, got %d\n", len);
2351     if (len == 16)
2352     {
2353         static const BYTE emptyHash[] = { 0xb8,0x51,0x3a,0x31,0x0e,0x9f,0x40,
2354          0x36,0x9c,0x92,0x45,0x1b,0x9d,0xc8,0xf9,0xf6 };
2355         BYTE buf[16];
2356
2357         ret = CryptHashPublicKeyInfo(0, 0, 0, X509_ASN_ENCODING, &info, buf,
2358          &len);
2359         ok(ret, "CryptHashPublicKeyInfo failed: %08x\n", GetLastError());
2360         ok(!memcmp(buf, emptyHash, len), "Unexpected hash\n");
2361     }
2362 }
2363
2364 static void testCompareCert(void)
2365 {
2366     CERT_INFO info1 = { 0 }, info2 = { 0 };
2367     BOOL ret;
2368
2369     /* Crashes
2370     ret = CertCompareCertificate(X509_ASN_ENCODING, NULL, NULL);
2371      */
2372
2373     /* Certs with the same issuer and serial number are equal, even if they
2374      * differ in other respects (like subject).
2375      */
2376     info1.SerialNumber.pbData = serialNum;
2377     info1.SerialNumber.cbData = sizeof(serialNum);
2378     info1.Issuer.pbData = subjectName;
2379     info1.Issuer.cbData = sizeof(subjectName);
2380     info1.Subject.pbData = subjectName2;
2381     info1.Subject.cbData = sizeof(subjectName2);
2382     info2.SerialNumber.pbData = serialNum;
2383     info2.SerialNumber.cbData = sizeof(serialNum);
2384     info2.Issuer.pbData = subjectName;
2385     info2.Issuer.cbData = sizeof(subjectName);
2386     info2.Subject.pbData = subjectName;
2387     info2.Subject.cbData = sizeof(subjectName);
2388     ret = CertCompareCertificate(X509_ASN_ENCODING, &info1, &info2);
2389     ok(ret, "Expected certs to be equal\n");
2390
2391     info2.Issuer.pbData = subjectName2;
2392     info2.Issuer.cbData = sizeof(subjectName2);
2393     ret = CertCompareCertificate(X509_ASN_ENCODING, &info1, &info2);
2394     ok(!ret, "Expected certs not to be equal\n");
2395 }
2396
2397 static void testVerifySubjectCert(void)
2398 {
2399     BOOL ret;
2400     DWORD flags;
2401     PCCERT_CONTEXT context1, context2;
2402
2403     /* Crashes
2404     ret = CertVerifySubjectCertificateContext(NULL, NULL, NULL);
2405      */
2406     flags = 0;
2407     ret = CertVerifySubjectCertificateContext(NULL, NULL, &flags);
2408     ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
2409      GetLastError());
2410     flags = CERT_STORE_NO_CRL_FLAG;
2411     ret = CertVerifySubjectCertificateContext(NULL, NULL, &flags);
2412     ok(!ret && GetLastError() == E_INVALIDARG,
2413      "Expected E_INVALIDARG, got %08x\n", GetLastError());
2414
2415     flags = 0;
2416     context1 = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert,
2417      sizeof(bigCert));
2418     ret = CertVerifySubjectCertificateContext(NULL, context1, &flags);
2419     ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
2420      GetLastError());
2421     ret = CertVerifySubjectCertificateContext(context1, NULL, &flags);
2422     ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
2423      GetLastError());
2424     ret = CertVerifySubjectCertificateContext(context1, context1, &flags);
2425     ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
2426      GetLastError());
2427
2428     context2 = CertCreateCertificateContext(X509_ASN_ENCODING,
2429      bigCertWithDifferentSubject, sizeof(bigCertWithDifferentSubject));
2430     SetLastError(0xdeadbeef);
2431     ret = CertVerifySubjectCertificateContext(context1, context2, &flags);
2432     ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
2433      GetLastError());
2434     flags = CERT_STORE_REVOCATION_FLAG;
2435     ret = CertVerifySubjectCertificateContext(context1, context2, &flags);
2436     ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
2437      GetLastError());
2438     ok(flags == (CERT_STORE_REVOCATION_FLAG | CERT_STORE_NO_CRL_FLAG),
2439      "Expected CERT_STORE_REVOCATION_FLAG | CERT_STORE_NO_CRL_FLAG, got %08x\n",
2440      flags);
2441     flags = CERT_STORE_SIGNATURE_FLAG;
2442     ret = CertVerifySubjectCertificateContext(context1, context2, &flags);
2443     ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
2444      GetLastError());
2445     ok(flags == CERT_STORE_SIGNATURE_FLAG,
2446      "Expected CERT_STORE_SIGNATURE_FLAG, got %08x\n", flags);
2447     CertFreeCertificateContext(context2);
2448
2449     CertFreeCertificateContext(context1);
2450 }
2451
2452 static BYTE privKey[] = {
2453  0x07, 0x02, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x52, 0x53, 0x41, 0x32, 0x00,
2454  0x02, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x79, 0x10, 0x1c, 0xd0, 0x6b, 0x10,
2455  0x18, 0x30, 0x94, 0x61, 0xdc, 0x0e, 0xcb, 0x96, 0x4e, 0x21, 0x3f, 0x79, 0xcd,
2456  0xa9, 0x17, 0x62, 0xbc, 0xbb, 0x61, 0x4c, 0xe0, 0x75, 0x38, 0x6c, 0xf3, 0xde,
2457  0x60, 0x86, 0x03, 0x97, 0x65, 0xeb, 0x1e, 0x6b, 0xdb, 0x53, 0x85, 0xad, 0x68,
2458  0x21, 0xf1, 0x5d, 0xe7, 0x1f, 0xe6, 0x53, 0xb4, 0xbb, 0x59, 0x3e, 0x14, 0x27,
2459  0xb1, 0x83, 0xa7, 0x3a, 0x54, 0xe2, 0x8f, 0x65, 0x8e, 0x6a, 0x4a, 0xcf, 0x3b,
2460  0x1f, 0x65, 0xff, 0xfe, 0xf1, 0x31, 0x3a, 0x37, 0x7a, 0x8b, 0xcb, 0xc6, 0xd4,
2461  0x98, 0x50, 0x36, 0x67, 0xe4, 0xa1, 0xe8, 0x7e, 0x8a, 0xc5, 0x23, 0xf2, 0x77,
2462  0xf5, 0x37, 0x61, 0x49, 0x72, 0x59, 0xe8, 0x3d, 0xf7, 0x60, 0xb2, 0x77, 0xca,
2463  0x78, 0x54, 0x6d, 0x65, 0x9e, 0x03, 0x97, 0x1b, 0x61, 0xbd, 0x0c, 0xd8, 0x06,
2464  0x63, 0xe2, 0xc5, 0x48, 0xef, 0xb3, 0xe2, 0x6e, 0x98, 0x7d, 0xbd, 0x4e, 0x72,
2465  0x91, 0xdb, 0x31, 0x57, 0xe3, 0x65, 0x3a, 0x49, 0xca, 0xec, 0xd2, 0x02, 0x4e,
2466  0x22, 0x7e, 0x72, 0x8e, 0xf9, 0x79, 0x84, 0x82, 0xdf, 0x7b, 0x92, 0x2d, 0xaf,
2467  0xc9, 0xe4, 0x33, 0xef, 0x89, 0x5c, 0x66, 0x99, 0xd8, 0x80, 0x81, 0x47, 0x2b,
2468  0xb1, 0x66, 0x02, 0x84, 0x59, 0x7b, 0xc3, 0xbe, 0x98, 0x45, 0x4a, 0x3d, 0xdd,
2469  0xea, 0x2b, 0xdf, 0x4e, 0xb4, 0x24, 0x6b, 0xec, 0xe7, 0xd9, 0x0c, 0x45, 0xb8,
2470  0xbe, 0xca, 0x69, 0x37, 0x92, 0x4c, 0x38, 0x6b, 0x96, 0x6d, 0xcd, 0x86, 0x67,
2471  0x5c, 0xea, 0x54, 0x94, 0xa4, 0xca, 0xa4, 0x02, 0xa5, 0x21, 0x4d, 0xae, 0x40,
2472  0x8f, 0x9d, 0x51, 0x83, 0xf2, 0x3f, 0x33, 0xc1, 0x72, 0xb4, 0x1d, 0x94, 0x6e,
2473  0x7d, 0xe4, 0x27, 0x3f, 0xea, 0xff, 0xe5, 0x9b, 0xa7, 0x5e, 0x55, 0x8e, 0x0d,
2474  0x69, 0x1c, 0x7a, 0xff, 0x81, 0x9d, 0x53, 0x52, 0x97, 0x9a, 0x76, 0x79, 0xda,
2475  0x93, 0x32, 0x16, 0xec, 0x69, 0x51, 0x1a, 0x4e, 0xc3, 0xf1, 0x72, 0x80, 0x78,
2476  0x5e, 0x66, 0x4a, 0x8d, 0x85, 0x2f, 0x3f, 0xb2, 0xa7 };
2477
2478 static const BYTE selfSignedCert[] = {
2479  0x30, 0x82, 0x01, 0x1f, 0x30, 0x81, 0xce, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02,
2480  0x10, 0xeb, 0x0d, 0x57, 0x2a, 0x9c, 0x09, 0xba, 0xa4, 0x4a, 0xb7, 0x25, 0x49,
2481  0xd9, 0x3e, 0xb5, 0x73, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1d,
2482  0x05, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03,
2483  0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30,
2484  0x1e, 0x17, 0x0d, 0x30, 0x36, 0x30, 0x36, 0x32, 0x39, 0x30, 0x35, 0x30, 0x30,
2485  0x34, 0x36, 0x5a, 0x17, 0x0d, 0x30, 0x37, 0x30, 0x36, 0x32, 0x39, 0x31, 0x31,
2486  0x30, 0x30, 0x34, 0x36, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
2487  0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e,
2488  0x67, 0x00, 0x30, 0x5c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
2489  0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x4b, 0x00, 0x30, 0x48, 0x02, 0x41,
2490  0x00, 0xe2, 0x54, 0x3a, 0xa7, 0x83, 0xb1, 0x27, 0x14, 0x3e, 0x59, 0xbb, 0xb4,
2491  0x53, 0xe6, 0x1f, 0xe7, 0x5d, 0xf1, 0x21, 0x68, 0xad, 0x85, 0x53, 0xdb, 0x6b,
2492  0x1e, 0xeb, 0x65, 0x97, 0x03, 0x86, 0x60, 0xde, 0xf3, 0x6c, 0x38, 0x75, 0xe0,
2493  0x4c, 0x61, 0xbb, 0xbc, 0x62, 0x17, 0xa9, 0xcd, 0x79, 0x3f, 0x21, 0x4e, 0x96,
2494  0xcb, 0x0e, 0xdc, 0x61, 0x94, 0x30, 0x18, 0x10, 0x6b, 0xd0, 0x1c, 0x10, 0x79,
2495  0x02, 0x03, 0x01, 0x00, 0x01, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02,
2496  0x1d, 0x05, 0x00, 0x03, 0x41, 0x00, 0x25, 0x90, 0x53, 0x34, 0xd9, 0x56, 0x41,
2497  0x5e, 0xdb, 0x7e, 0x01, 0x36, 0xec, 0x27, 0x61, 0x5e, 0xb7, 0x4d, 0x90, 0x66,
2498  0xa2, 0xe1, 0x9d, 0x58, 0x76, 0xd4, 0x9c, 0xba, 0x2c, 0x84, 0xc6, 0x83, 0x7a,
2499  0x22, 0x0d, 0x03, 0x69, 0x32, 0x1a, 0x6d, 0xcb, 0x0c, 0x15, 0xb3, 0x6b, 0xc7,
2500  0x0a, 0x8c, 0xb4, 0x5c, 0x34, 0x78, 0xe0, 0x3c, 0x9c, 0xe9, 0xf3, 0x30, 0x9f,
2501  0xa8, 0x76, 0x57, 0x92, 0x36 };
2502
2503 static const BYTE exportedPublicKeyBlob[] = {
2504 0x06,0x02,0x00,0x00,0x00,0xa4,0x00,0x00,0x52,0x53,0x41,0x31,0x00,0x02,0x00,0x00,
2505 0x01,0x00,0x01,0x00,0x79,0x10,0x1c,0xd0,0x6b,0x10,0x18,0x30,0x94,0x61,0xdc,0x0e,
2506 0xcb,0x96,0x4e,0x21,0x3f,0x79,0xcd,0xa9,0x17,0x62,0xbc,0xbb,0x61,0x4c,0xe0,0x75,
2507 0x38,0x6c,0xf3,0xde,0x60,0x86,0x03,0x97,0x65,0xeb,0x1e,0x6b,0xdb,0x53,0x85,0xad,
2508 0x68,0x21,0xf1,0x5d,0xe7,0x1f,0xe6,0x53,0xb4,0xbb,0x59,0x3e,0x14,0x27,0xb1,0x83,
2509 0xa7,0x3a,0x54,0xe2 };
2510
2511 static const BYTE asnEncodedPublicKey[] = {
2512 0x30,0x48,0x02,0x41,0x00,0xe2,0x54,0x3a,0xa7,0x83,0xb1,0x27,0x14,0x3e,0x59,0xbb,
2513 0xb4,0x53,0xe6,0x1f,0xe7,0x5d,0xf1,0x21,0x68,0xad,0x85,0x53,0xdb,0x6b,0x1e,0xeb,
2514 0x65,0x97,0x03,0x86,0x60,0xde,0xf3,0x6c,0x38,0x75,0xe0,0x4c,0x61,0xbb,0xbc,0x62,
2515 0x17,0xa9,0xcd,0x79,0x3f,0x21,0x4e,0x96,0xcb,0x0e,0xdc,0x61,0x94,0x30,0x18,0x10,
2516 0x6b,0xd0,0x1c,0x10,0x79,0x02,0x03,0x01,0x00,0x01 };
2517
2518 static void testAcquireCertPrivateKey(void)
2519 {
2520     BOOL ret;
2521     PCCERT_CONTEXT cert;
2522     HCRYPTPROV csp;
2523     DWORD size, keySpec;
2524     BOOL callerFree;
2525     CRYPT_KEY_PROV_INFO keyProvInfo;
2526     HCRYPTKEY key;
2527     WCHAR ms_def_prov_w[MAX_PATH];
2528
2529     lstrcpyW(ms_def_prov_w, MS_DEF_PROV_W);
2530
2531     keyProvInfo.pwszContainerName = cspNameW;
2532     keyProvInfo.pwszProvName = ms_def_prov_w;
2533     keyProvInfo.dwProvType = PROV_RSA_FULL;
2534     keyProvInfo.dwFlags = 0;
2535     keyProvInfo.cProvParam = 0;
2536     keyProvInfo.rgProvParam = NULL;
2537     keyProvInfo.dwKeySpec = AT_SIGNATURE;
2538
2539     pCryptAcquireContextW(NULL, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
2540      CRYPT_DELETEKEYSET);
2541
2542     cert = CertCreateCertificateContext(X509_ASN_ENCODING, selfSignedCert,
2543      sizeof(selfSignedCert));
2544
2545     /* Crash
2546     ret = CryptAcquireCertificatePrivateKey(NULL, 0, NULL, NULL, NULL, NULL);
2547     ret = CryptAcquireCertificatePrivateKey(NULL, 0, NULL, NULL, NULL,
2548      &callerFree);
2549     ret = CryptAcquireCertificatePrivateKey(NULL, 0, NULL, NULL, &keySpec,
2550      NULL);
2551     ret = CryptAcquireCertificatePrivateKey(NULL, 0, NULL, &csp, NULL, NULL);
2552     ret = CryptAcquireCertificatePrivateKey(NULL, 0, NULL, &csp, &keySpec,
2553      &callerFree);
2554     ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, NULL, NULL, NULL);
2555      */
2556
2557     /* Missing private key */
2558     ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, &csp, NULL, NULL);
2559     ok(!ret && GetLastError() == CRYPT_E_NO_KEY_PROPERTY,
2560      "Expected CRYPT_E_NO_KEY_PROPERTY, got %08x\n", GetLastError());
2561     ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, &csp, &keySpec,
2562      &callerFree);
2563     ok(!ret && GetLastError() == CRYPT_E_NO_KEY_PROPERTY,
2564      "Expected CRYPT_E_NO_KEY_PROPERTY, got %08x\n", GetLastError());
2565     CertSetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, 0,
2566      &keyProvInfo);
2567     ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, &csp, &keySpec,
2568      &callerFree);
2569     ok(!ret && GetLastError() == CRYPT_E_NO_KEY_PROPERTY,
2570      "Expected CRYPT_E_NO_KEY_PROPERTY, got %08x\n", GetLastError());
2571
2572     pCryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
2573      CRYPT_NEWKEYSET);
2574     ret = CryptImportKey(csp, privKey, sizeof(privKey), 0, 0, &key);
2575     ok(ret, "CryptImportKey failed: %08x\n", GetLastError());
2576     if (ret)
2577     {
2578         HCRYPTPROV certCSP;
2579         DWORD size;
2580         CERT_KEY_CONTEXT keyContext;
2581
2582         /* Don't cache provider */
2583         ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, &certCSP,
2584          &keySpec, &callerFree);
2585         ok(ret, "CryptAcquireCertificatePrivateKey failed: %08x\n",
2586          GetLastError());
2587         ok(callerFree, "Expected callerFree to be TRUE\n");
2588         CryptReleaseContext(certCSP, 0);
2589         ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, &certCSP,
2590          NULL, NULL);
2591         ok(ret, "CryptAcquireCertificatePrivateKey failed: %08x\n",
2592          GetLastError());
2593         CryptReleaseContext(certCSP, 0);
2594
2595         /* Use the key prov info's caching (there shouldn't be any) */
2596         ret = CryptAcquireCertificatePrivateKey(cert,
2597          CRYPT_ACQUIRE_USE_PROV_INFO_FLAG, NULL, &certCSP, &keySpec,
2598          &callerFree);
2599         ok(ret, "CryptAcquireCertificatePrivateKey failed: %08x\n",
2600          GetLastError());
2601         ok(callerFree, "Expected callerFree to be TRUE\n");
2602         CryptReleaseContext(certCSP, 0);
2603
2604         /* Cache it (and check that it's cached) */
2605         ret = CryptAcquireCertificatePrivateKey(cert,
2606          CRYPT_ACQUIRE_CACHE_FLAG, NULL, &certCSP, &keySpec, &callerFree);
2607         ok(ret, "CryptAcquireCertificatePrivateKey failed: %08x\n",
2608          GetLastError());
2609         ok(!callerFree, "Expected callerFree to be FALSE\n");
2610         size = sizeof(keyContext);
2611         ret = CertGetCertificateContextProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
2612          &keyContext, &size);
2613         ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
2614          GetLastError());
2615
2616         /* Remove the cached provider */
2617         CryptReleaseContext(keyContext.hCryptProv, 0);
2618         CertSetCertificateContextProperty(cert, CERT_KEY_CONTEXT_PROP_ID, 0,
2619          NULL);
2620         /* Allow caching via the key prov info */
2621         keyProvInfo.dwFlags = CERT_SET_KEY_CONTEXT_PROP_ID;
2622         CertSetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, 0,
2623          &keyProvInfo);
2624         /* Now use the key prov info's caching */
2625         ret = CryptAcquireCertificatePrivateKey(cert,
2626          CRYPT_ACQUIRE_USE_PROV_INFO_FLAG, NULL, &certCSP, &keySpec,
2627          &callerFree);
2628         ok(ret, "CryptAcquireCertificatePrivateKey failed: %08x\n",
2629          GetLastError());
2630         ok(!callerFree, "Expected callerFree to be FALSE\n");
2631         size = sizeof(keyContext);
2632         ret = CertGetCertificateContextProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
2633          &keyContext, &size);
2634         ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
2635          GetLastError());
2636
2637         CryptDestroyKey(key);
2638     }
2639
2640     /* Some sanity-checking on public key exporting */
2641     ret = CryptImportPublicKeyInfo(csp, X509_ASN_ENCODING,
2642      &cert->pCertInfo->SubjectPublicKeyInfo, &key);
2643     ok(ret, "CryptImportPublicKeyInfo failed: %08x\n", GetLastError());
2644     if (ret)
2645     {
2646         ret = CryptExportKey(key, 0, PUBLICKEYBLOB, 0, NULL, &size);
2647         ok(ret, "CryptExportKey failed: %08x\n", GetLastError());
2648         if (ret)
2649         {
2650             LPBYTE buf = HeapAlloc(GetProcessHeap(), 0, size), encodedKey;
2651
2652             ret = CryptExportKey(key, 0, PUBLICKEYBLOB, 0, buf, &size);
2653             ok(ret, "CryptExportKey failed: %08x\n", GetLastError());
2654             ok(size == sizeof(exportedPublicKeyBlob), "Unexpected size %d\n",
2655              size);
2656             ok(!memcmp(buf, exportedPublicKeyBlob, size), "Unexpected value\n");
2657             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, RSA_CSP_PUBLICKEYBLOB,
2658              buf, CRYPT_ENCODE_ALLOC_FLAG, NULL, &encodedKey, &size);
2659             ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
2660             if (ret)
2661             {
2662                 ok(size == sizeof(asnEncodedPublicKey), "Unexpected size %d\n",
2663                  size);
2664                 ok(!memcmp(encodedKey, asnEncodedPublicKey, size),
2665                  "Unexpected value\n");
2666                 LocalFree(encodedKey);
2667             }
2668             HeapFree(GetProcessHeap(), 0, buf);
2669         }
2670         CryptDestroyKey(key);
2671     }
2672     ret = CryptExportPublicKeyInfoEx(csp, AT_SIGNATURE, X509_ASN_ENCODING,
2673      NULL, 0, NULL, NULL, &size);
2674     ok(ret, "CryptExportPublicKeyInfoEx failed: %08x\n", GetLastError());
2675     if (ret)
2676     {
2677         PCERT_PUBLIC_KEY_INFO info = HeapAlloc(GetProcessHeap(), 0, size);
2678
2679         ret = CryptExportPublicKeyInfoEx(csp, AT_SIGNATURE, X509_ASN_ENCODING,
2680          NULL, 0, NULL, info, &size);
2681         ok(ret, "CryptExportPublicKeyInfoEx failed: %08x\n", GetLastError());
2682         if (ret)
2683         {
2684             ok(info->PublicKey.cbData == sizeof(asnEncodedPublicKey),
2685              "Unexpected size %d\n", info->PublicKey.cbData);
2686             ok(!memcmp(info->PublicKey.pbData, asnEncodedPublicKey,
2687              info->PublicKey.cbData), "Unexpected value\n");
2688         }
2689         HeapFree(GetProcessHeap(), 0, info);
2690     }
2691
2692     CryptReleaseContext(csp, 0);
2693     pCryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
2694      CRYPT_DELETEKEYSET);
2695
2696     CertFreeCertificateContext(cert);
2697 }
2698
2699 static void testGetPublicKeyLength(void)
2700 {
2701     static char oid_rsa_rsa[] = szOID_RSA_RSA;
2702     static char oid_rsa_dh[] = szOID_RSA_DH;
2703     static char bogusOID[] = "1.2.3";
2704     DWORD ret;
2705     CERT_PUBLIC_KEY_INFO info = { { 0 } };
2706     BYTE bogusKey[] = { 1, 2, 3, 4, 5, 6, 7, 8 };
2707     BYTE key[] = { 0x30,0x0f,0x02,0x08,0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,
2708      0x02,0x03,0x01,0x00,0x01 };
2709
2710     /* Crashes
2711     ret = CertGetPublicKeyLength(0, NULL);
2712      */
2713     /* With an empty public key info */
2714     SetLastError(0xdeadbeef);
2715     ret = CertGetPublicKeyLength(0, &info);
2716     ok(ret == 0 && GetLastError() == ERROR_FILE_NOT_FOUND,
2717      "Expected length 0 and ERROR_FILE_NOT_FOUND, got length %d, %08x\n",
2718      ret, GetLastError());
2719     SetLastError(0xdeadbeef);
2720     ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
2721     ok(ret == 0 && GetLastError() == CRYPT_E_ASN1_EOD,
2722      "Expected length 0 and CRYPT_E_ASN1_EOD, got length %d, %08x\n",
2723      ret, GetLastError());
2724     /* With a nearly-empty public key info */
2725     info.Algorithm.pszObjId = oid_rsa_rsa;
2726     SetLastError(0xdeadbeef);
2727     ret = CertGetPublicKeyLength(0, &info);
2728     ok(ret == 0 && GetLastError() == ERROR_FILE_NOT_FOUND,
2729      "Expected length 0 and ERROR_FILE_NOT_FOUND, got length %d, %08x\n",
2730      ret, GetLastError());
2731     SetLastError(0xdeadbeef);
2732     ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
2733     ok(ret == 0 && GetLastError() == CRYPT_E_ASN1_EOD,
2734      "Expected length 0 and CRYPT_E_ASN1_EOD, got length %d, %08x\n",
2735      ret, GetLastError());
2736     /* With a bogus key */
2737     info.PublicKey.cbData = sizeof(bogusKey);
2738     info.PublicKey.pbData = bogusKey;
2739     SetLastError(0xdeadbeef);
2740     ret = CertGetPublicKeyLength(0, &info);
2741     ok(ret == 0 && GetLastError() == ERROR_FILE_NOT_FOUND,
2742      "Expected length 0 and ERROR_FILE_NOT_FOUND, got length %d, %08x\n",
2743      ret, GetLastError());
2744     SetLastError(0xdeadbeef);
2745     ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
2746     ok(ret == 0 && GetLastError() == CRYPT_E_ASN1_BADTAG,
2747      "Expected length 0 and CRYPT_E_ASN1_BADTAGTAG, got length %d, %08x\n",
2748      ret, GetLastError());
2749     /* With a believable RSA key but a bogus OID */
2750     info.Algorithm.pszObjId = bogusOID;
2751     info.PublicKey.cbData = sizeof(key);
2752     info.PublicKey.pbData = key;
2753     SetLastError(0xdeadbeef);
2754     ret = CertGetPublicKeyLength(0, &info);
2755     ok(ret == 0 && GetLastError() == ERROR_FILE_NOT_FOUND,
2756      "Expected length 0 and ERROR_FILE_NOT_FOUND, got length %d, %08x\n",
2757      ret, GetLastError());
2758     SetLastError(0xdeadbeef);
2759     ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
2760     ok(ret == 56, "Expected length 56, got %d\n", ret);
2761     /* An RSA key with the DH OID */
2762     info.Algorithm.pszObjId = oid_rsa_dh;
2763     SetLastError(0xdeadbeef);
2764     ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
2765     ok(ret == 0 && GetLastError() == CRYPT_E_ASN1_BADTAG,
2766      "Expected length 0 and CRYPT_E_ASN1_BADTAG, got length %d, %08x\n",
2767      ret, GetLastError());
2768     /* With the RSA OID */
2769     info.Algorithm.pszObjId = oid_rsa_rsa;
2770     SetLastError(0xdeadbeef);
2771     ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
2772     ok(ret == 56, "Expected length 56, got %d\n", ret);
2773 }
2774
2775 START_TEST(cert)
2776 {
2777     init_function_pointers();
2778
2779     testAddCert();
2780     testCertProperties();
2781     testDupCert();
2782     testFindCert();
2783     testGetSubjectCert();
2784     testGetIssuerCert();
2785
2786     testCryptHashCert();
2787     testCertSigs();
2788     testSignAndEncodeCert();
2789     testCreateSelfSignCert();
2790     testKeyUsage();
2791     testCompareCertName();
2792     testCompareIntegerBlob();
2793     testComparePublicKeyInfo();
2794     testHashPublicKeyInfo();
2795     testCompareCert();
2796     testVerifySubjectCert();
2797     testAcquireCertPrivateKey();
2798     testGetPublicKeyLength();
2799 }