Re: Validate SSL server certificate??
- From: "ocean" <ocean@xxxxxxxx>
- Date: Sat, 17 Jun 2006 00:26:23 +0800
The client must install root-certificate and ca-certificate of server
certificate.Root-certificate will be stored into trusted root-certificates
list.
"Tim Ward" <tw2@xxxxxxxxxxxx> дÈëÏûÏ¢
news:4fd49jF1iptbvU1@xxxxxxxxxxxxxxxxx
I'm new to this SSPI / SSL / certificate / cyrpto stuff I'm afraid ...
I'm trying to adapt the WebClient.c SDK sample to my situation. So far I'm
trying to:
(a) make a connection to an SSL server (which is a telecoms device, not a
computer running a web server or anything like that)
(b) perform some validation on the certificate returned by the server, to
try to make sure I've connected to a legitmate device.
I get the SSL connection established OK (after a few days' work).
Following
WebClient.c I get the server's certificate with QueryContextAttributes,
but
then what validation to perform? WebClient.c seems to suggest that it's
helpful to call CertGetCertificateChain to make a chain from the server
certificate and then call CertVerifyCertificateChainPolicy on the result
and
see if that's happy.
Now, the root certificate against which the server certificate is to be
validated is *not* going to be in any Windows certificate store, as it's a
private certificate for use only by this application. So, I can load it
into
a certificate store (CertOpenStore to create a memory store, read the
certificate .der file into memory, CertAddEncodedCertificateToStore) but
...
... how do I present this memory store to CertGetCertificateChain in such
a
way that CertGetCertificateChain believes that it's a trusted root
certificate so that CertGetCertificateChain refrains from marking the
chain
as CERT_TRUST_IS_UNTRUSTED_ROOT?
(No, passing it in hRestrictedTrust to CertCreateCertificateChainEngine
does
*not* work.)
--
Tim Ward
Brett Ward Limited - www.brettward.co.uk
.
- References:
- Validate SSL server certificate??
- From: Tim Ward
- Validate SSL server certificate??
- Prev by Date: How to effectively change the status in custom gina
- Next by Date: Re: Determine AD group membership
- Previous by thread: Validate SSL server certificate??
- Next by thread: How to effectively change the status in custom gina
- Index(es):
Relevant Pages
|
