自学教程：C++ CertFindCertificateInStore函数代码示例

BOOL ClientAuthenticate(const char *name, const char *hostname){	int rc, rcISC;	SEC_WINNT_AUTH_IDENTITY nameAndPwd = {0};	int bytesReceived = 0, bytesSent = 0;	char myTokenSource[256];	TimeStamp useBefore;	DWORD ctxReq, ctxAttr;	int dwRead,dwWritten;	// input and output buffers	SecBufferDesc obd, ibd;	SecBuffer ob, ib[2];	BOOL haveInbuffer = FALSE;	BOOL haveContext = FALSE;	SCHANNEL_CRED cred = {0};	PCCERT_CONTEXT cert = NULL;	HANDLE hMy = CertOpenSystemStore(0,"MY");	if(!hMy)	{		rcISC = SEC_E_NO_CREDENTIALS;		server_error(1,"[%08x] %s/n",rcISC,GetErrorString(rcISC));		return FALSE;    }	if(name)	{		cert = CertFindCertificateInStore(hMy, X509_ASN_ENCODING, 0, CERT_FIND_SUBJECT_STR, (const wchar_t *)cvs::wide(name),	NULL);		if(!cert)		{			rcISC = SEC_E_NO_CREDENTIALS;			server_error(1,"No certificate for '%s': %s/n",name,GetErrorString(rcISC));			return FALSE;		}	}	cred.dwVersion = SCHANNEL_CRED_VERSION;	cred.dwFlags = SCH_CRED_USE_DEFAULT_CREDS;	if(cert)	{		cred.cCreds     = 1;		cred.paCred     = &cert;	}	rc = AcquireCredentialsHandle( NULL, "SChannel", SECPKG_CRED_OUTBOUND, NULL, &cred, NULL, NULL, &credHandle, &useBefore );	ctxReq = ISC_REQ_MANUAL_CRED_VALIDATION | ISC_REQ_INTEGRITY | ISC_REQ_CONFIDENTIALITY | ISC_REQ_REPLAY_DETECT | ISC_REQ_SEQUENCE_DETECT | ISC_REQ_STREAM | ISC_REQ_USE_SUPPLIED_CREDS;	strncpy(myTokenSource,hostname,sizeof(myTokenSource));	CertCloseStore(hMy,0);	ib[0].pvBuffer = NULL;	while ( 1 )	{		obd.ulVersion = SECBUFFER_VERSION;		obd.cBuffers = 1;		obd.pBuffers = &ob; // just one buffer		ob.BufferType = SECBUFFER_TOKEN; // preping a token here		ob.cbBuffer = secPackInfo->cbMaxToken;		ob.pvBuffer = malloc(secPackInfo->cbMaxToken);		rcISC = InitializeSecurityContext( &credHandle, haveContext? &contextHandle: NULL,			myTokenSource, ctxReq, 0, SECURITY_NATIVE_DREP, haveInbuffer? &ibd: NULL,			0, &contextHandle, &obd, &ctxAttr, &useBefore );		if ( ib[0].pvBuffer != NULL )		{			free(ib[0].pvBuffer);			ib[0].pvBuffer = NULL;		}		if ( rcISC == SEC_I_COMPLETE_AND_CONTINUE || rcISC == SEC_I_COMPLETE_NEEDED )		{			CompleteAuthToken( &contextHandle, &obd );			if ( rcISC == SEC_I_COMPLETE_NEEDED )				rcISC = SEC_E_OK;			else if ( rcISC == SEC_I_COMPLETE_AND_CONTINUE )				rcISC = SEC_I_CONTINUE_NEEDED;		}		if(rcISC<0)		{			server_error(1,"[%08x] %s/n",rcISC,GetErrorString(rcISC));		}		// send the output buffer off to the server		if ( ob.cbBuffer != 0 )		{			if((dwWritten=tcp_write( (const char *) ob.pvBuffer, ob.cbBuffer))<=0)				break;			bytesSent += dwWritten;		}		free(ob.pvBuffer);		ob.pvBuffer = NULL;		ob.cbBuffer = 0;		if ( rcISC != SEC_I_CONTINUE_NEEDED )			break;//.........这里部分代码省略.........

BOOL MSCAPI_Manager::BuildCertificateChain(HCRYPTPROV provider, OpString &label, OpString &shortname, SSL_ASN1Cert_list &cert){	CERT_PUBLIC_KEY_INFO *pubkey = (CERT_PUBLIC_KEY_INFO *) g_memory_manager->GetTempBuf2k();	DWORD len;	label.Empty();	shortname.Empty();	cert.Resize(0);	if(!hMYSystemStore)		return FALSE;	len = g_memory_manager->GetTempBuf2kLen();	if(!CryptExportPublicKeyInfo(provider,  /*AT_SIGNATURE*/ AT_KEYEXCHANGE, (X509_ASN_ENCODING | PKCS_7_ASN_ENCODING), pubkey, &len))	{		int err0 = GetLastError();		op_memset(&pubkey, 0, sizeof(pubkey));		len = g_memory_manager->GetTempBufLen();		if(!CryptExportPublicKeyInfo(provider, /* AT_KEYEXCHANGE */ AT_SIGNATURE, (X509_ASN_ENCODING | PKCS_7_ASN_ENCODING), pubkey, &len))		{			int err = GetLastError();			return FALSE;		}	}			PCCERT_CONTEXT cert_item = NULL;		cert_item = CertFindCertificateInStore(hMYSystemStore, (X509_ASN_ENCODING | PKCS_7_ASN_ENCODING), 0, CERT_FIND_PUBLIC_KEY, pubkey, cert_item);	if(!cert_item && hUserDSSystemStore)		cert_item = CertFindCertificateInStore(hUserDSSystemStore, (X509_ASN_ENCODING | PKCS_7_ASN_ENCODING), 0, CERT_FIND_PUBLIC_KEY, pubkey, cert_item);	if(!cert_item)		return FALSE;		len = CertNameToStr((X509_ASN_ENCODING | PKCS_7_ASN_ENCODING), 		&cert_item->pCertInfo->Subject, CERT_SIMPLE_NAME_STR, NULL, 0);		if(len)	{		if(shortname.Reserve(len+1) == NULL)			return OpStatus::ERR_NO_MEMORY;				len = CertNameToStr((X509_ASN_ENCODING | PKCS_7_ASN_ENCODING), 			&cert_item->pCertInfo->Subject, CERT_SIMPLE_NAME_STR, shortname.DataPtr(), shortname.Capacity());	}		cert.Resize(1);	if(cert.Error())		return FALSE();		cert[0].Set(cert_item->pbCertEncoded, cert_item->cbCertEncoded);		if(cert.Error() || cert[0].GetLength() == 0)		return FALSE;	return TRUE;}

static const CERT_CONTEXT *find_certificate_in_store(const char *cert_prop, HCERTSTORE cert_store){    /* Find, and use, the desired certificate from the store. The     * 'cert_prop' certificate search string can look like this:     * SUBJ:<certificate substring to match>     * THUMB:<certificate thumbprint hex value>, e.g.     *     THUMB:f6 49 24 41 01 b4 fb 44 0c ce f4 36 ae d0 c4 c9 df 7a b6 28     */    const CERT_CONTEXT *rv = NULL;    if (!strncmp(cert_prop, "SUBJ:", 5)) {	/* skip the tag */	cert_prop += 5;	rv = CertFindCertificateInStore(cert_store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,		0, CERT_FIND_SUBJECT_STR_A, cert_prop, NULL);    } else if (!strncmp(cert_prop, "THUMB:", 6)) {	unsigned char hash[255];	char *p;	int i, x = 0;	CRYPT_HASH_BLOB blob;	/* skip the tag */	cert_prop += 6;	for (p = (char *) cert_prop, i = 0; *p && i < sizeof(hash); i++) {	    if (*p >= '0' && *p <= '9')		x = (*p - '0') << 4;	    else if (*p >= 'A' && *p <= 'F')		x = (*p - 'A' + 10) << 4;	    else if (*p >= 'a' && *p <= 'f')		x = (*p - 'a' + 10) << 4;	    if (!*++p)	/* unexpected end of string */		break;	    if (*p >= '0' && *p <= '9')		x += *p - '0';	    else if (*p >= 'A' && *p <= 'F')		x += *p - 'A' + 10;	    else if (*p >= 'a' && *p <= 'f')		x += *p - 'a' + 10;	    hash[i] = x;	    /* skip any space(s) between hex numbers */	    for (p++; *p && *p == ' '; p++);	}	blob.cbData = i;	blob.pbData = (unsigned char *) &hash;	rv = CertFindCertificateInStore(cert_store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,		0, CERT_FIND_HASH, &blob, NULL);    }    return rv;}

int _gnutls_x509_crt_import_system_url(gnutls_x509_crt_t crt, const char *url){	uint8_t id[MAX_WID_SIZE];	HCERTSTORE store = NULL;	size_t id_size;	const CERT_CONTEXT *cert = NULL;	CRYPT_HASH_BLOB blob;	int ret;	gnutls_datum_t data;	if (ncrypt_init == 0)		return gnutls_assert_val(GNUTLS_E_UNIMPLEMENTED_FEATURE);	id_size = sizeof(id);	ret = get_id(url, id, &id_size, 0);	if (ret < 0)		return gnutls_assert_val(ret);	blob.cbData = id_size;	blob.pbData = id;	store = CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, 0, CERT_SYSTEM_STORE_CURRENT_USER, L"MY");	if (store == NULL) {		gnutls_assert();		ret = GNUTLS_E_FILE_ERROR;		goto cleanup;	}	cert = CertFindCertificateInStore(store,					  X509_ASN_ENCODING,					  0,					  CERT_FIND_KEY_IDENTIFIER,					  &blob, NULL);	if (cert == NULL) {		char buf[64];		_gnutls_debug_log("cannot find ID: %s from %s/n",				  _gnutls_bin2hex(id, id_size,						  buf, sizeof(buf), NULL), url);		ret = gnutls_assert_val(GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE);		goto cleanup;	}	data.data = cert->pbCertEncoded;	data.size = cert->cbCertEncoded;	ret = gnutls_x509_crt_import(crt, &data, GNUTLS_X509_FMT_DER);	if (ret < 0) {		gnutls_assert();		goto cleanup;	}	ret = 0; cleanup:	if (cert != 0)		CertFreeCertificateContext(cert);	CertCloseStore(store, 0);	return ret;}

//Function to obtain the certificatePCCERT_CONTEXT MyGetCertificate (void){        //---------------------------------------------------------        // Declare and initialize variables.        HCERTSTORE  hStoreHandle;         // The system store handle.        PCCERT_CONTEXT  pCert = NULL;     // Set to NULL for the first call to                                          // CertFindCertificateInStore.        //-------------------------------------------------------------------        // Open the certificate store to be searched.        hStoreHandle = CertOpenStore(           CERT_STORE_PROV_SYSTEM,          // the store provider type           0,                               // the encoding type is not needed           NULL,                            // use the default HCRYPTPROV           CERT_SYSTEM_STORE_CURRENT_USER,  // set the store location in a                                             //  registry location           CERT_STORE_NAME);                // the store name         if (NULL == hStoreHandle)        {           wprintf( L"Could not open the store./n");		   goto done;        }        else        {           wprintf( L"Opened the store./n");        }        //-------------------------------------------------------------------        // Get a certificate that has the specified Subject Name        pCert = CertFindCertificateInStore(               hStoreHandle,			   CRYPT_ASN_ENCODING,          // Use X509_ASN_ENCODING			   0,                         // No dwFlags needed			   CERT_FIND_SUBJECT_STR,     // Find a certificate with a										  //  subject that matches the 										  //  string in the next parameter			   SUBJECT_NAME,              // The Unicode string to be found										  //  in a certificate's subject			   NULL);                     // NULL for the first call to the										  //  function; In all subsequent										  //  calls, it is the last pointer										  //  returned by the function        if (NULL == pCert)        {            wprintf( L"Could not find the desired certificate./n");		}        else        {            wprintf( L"The desired certificate was found. /n");          }done:        if(NULL != hStoreHandle)        {            CertCloseStore( hStoreHandle, 0);        }            return pCert;}

static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore)	{	PCCERT_CONTEXT cert = NULL;	char *fname = NULL;	int match;	switch(ctx->lookup_method)		{		case CAPI_LU_SUBSTR:			return CertFindCertificateInStore(hstore,					X509_ASN_ENCODING, 0,					CERT_FIND_SUBJECT_STR_A, id, NULL);		case CAPI_LU_FNAME:			for(;;)				{				cert = CertEnumCertificatesInStore(hstore, cert);				if (!cert)					return NULL;				fname = capi_cert_get_fname(ctx, cert);				if (fname)					{					if (strcmp(fname, id))						match = 0;					else						match = 1;					OPENSSL_free(fname);					if (match)						return cert;					}				}		default:			return NULL;		}	}

CertificateCollection qca_get_systemstore(const QString &provider){    CertificateCollection col;    HCERTSTORE hSystemStore;    hSystemStore = CertOpenSystemStoreA(0, "ROOT");    if(!hSystemStore)        return col;    PCCERT_CONTEXT pc = NULL;    while(1)    {        pc = CertFindCertificateInStore(                 hSystemStore,                 X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,                 0,                 CERT_FIND_ANY,                 NULL,                 pc);        if(!pc)            break;        int size = pc->cbCertEncoded;        QByteArray der(size, 0);        memcpy(der.data(), pc->pbCertEncoded, size);        Certificate cert = Certificate::fromDER(der, 0, provider);        if(!cert.isNull())            col.addCertificate(cert);    }    CertCloseStore(hSystemStore, 0);    return col;}

/* Returns TRUE if pCert is not in the Disallowed system store, or FALSE if it * is. */static BOOL CRYPTDLG_IsCertAllowed(PCCERT_CONTEXT pCert){    BOOL ret;    BYTE hash[20];    DWORD size = sizeof(hash);    if ((ret = CertGetCertificateContextProperty(pCert,     CERT_SIGNATURE_HASH_PROP_ID, hash, &size)))    {        static const WCHAR disallowedW[] =         { 'D','i','s','a','l','l','o','w','e','d',0 };        HCERTSTORE disallowed = CertOpenStore(CERT_STORE_PROV_SYSTEM_W,         X509_ASN_ENCODING, 0, CERT_SYSTEM_STORE_CURRENT_USER, disallowedW);        if (disallowed)        {            PCCERT_CONTEXT found = CertFindCertificateInStore(disallowed,             X509_ASN_ENCODING, 0, CERT_FIND_SIGNATURE_HASH, hash, NULL);            if (found)            {                ret = FALSE;                CertFreeCertificateContext(found);            }            CertCloseStore(disallowed, 0);        }    }    return ret;}

		bool SelectCertificate(const std::wstring& certStoreName, const std::string& certHash)		{			certStore = CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, NULL, CERT_SYSTEM_STORE_CURRENT_USER, certStoreName.c_str());			if (!certStore)			{				std::wcerr << L"Failed to open cert store. Error: " << std::hex << GetLastError() << L", Store: " << certStoreName << std::endl;				return false;			}			CRYPT_HASH_BLOB hashBlob;			hashBlob.pbData = (BYTE*)certHash.data();			hashBlob.cbData = (DWORD)certHash.size();			CERT_ID id;			id.dwIdChoice = CERT_ID_SHA1_HASH;			id.HashId = hashBlob;			certContext = CertFindCertificateInStore(certStore, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, CERT_FIND_CERT_ID, (void *)&id, NULL);			if (!certContext)			{				std::cerr << "Failed to open cert context. Error: " << std::hex << GetLastError() << ", Certificate: " << certHash << std::endl;				return false;			}			return true;		}

void CEstEIDCertificate::readFromCertContext() {	PCCERT_CONTEXT certContext = NULL;	HCERTSTORE cert_store = NULL;	cert_store = CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, NULL, CERT_SYSTEM_STORE_CURRENT_USER | CERT_STORE_READONLY_FLAG, L"MY");	if(!cert_store){		throw CryptoException();	}	if(!CertFindCertificateInStore(cert_store, X509_ASN_ENCODING  | PKCS_7_ASN_ENCODING, 0, CERT_FIND_ANY, NULL, NULL)) {		CertCloseStore(cert_store, CERT_CLOSE_STORE_FORCE_FLAG);		throw CryptoException();	}		while(certContext = CertFindCertificateInStore(cert_store, X509_ASN_ENCODING  | PKCS_7_ASN_ENCODING, 0, CERT_FIND_ANY, NULL, certContext)) {		BYTE keyUsage;		CertGetIntendedKeyUsage(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, certContext->pCertInfo, &keyUsage, 1);		if (keyUsage & CERT_NON_REPUDIATION_KEY_USAGE) {			this->certificates.push_back(CertDuplicateCertificateContext(certContext));		}		}		//PCCERT_CONTEXT ct = CryptUIDlgSelectCertificateFromStore(cert_store, NULL, L"TIITEL", L"Vali cert:", NULL, 0, 0);	//loadCertContexts(ct);	CCertificateSelectionDlg *dlg = new CCertificateSelectionDlg();	dlg->setCertificate(this->certificates);	INT_PTR selectedItem = dlg->DoModal();	EstEID_log("selected item index = %i", selectedItem);		if(selectedItem == -1) {		throw CryptoException(ESTEID_USER_CANCEL);	}	loadCertContexts(this->certificates[selectedItem]);	if(certContext){		CertFreeCertificateContext(certContext);	}	if(cert_store) {		CertCloseStore(cert_store, CERT_CLOSE_STORE_FORCE_FLAG);	}}

DWORD StoreAuthorityCert(PCCERT_CONTEXT pCertContext, unsigned char KeyUsageBits){	DWORD dwRet = 0;	HCERTSTORE hMemoryStore = NULL;	PCCERT_CONTEXT pDesiredCert = NULL;	if ( 0 == memcmp ( pCertContext->pCertInfo->Issuer.pbData, pCertContext->pCertInfo->Subject.pbData, pCertContext->pCertInfo->Subject.cbData	)	)	{		hMemoryStore = CertOpenSystemStore ((HCRYPTPROV_LEGACY)NULL, TEXT("ROOT"));	}	else	{		hMemoryStore = CertOpenSystemStore ((HCRYPTPROV_LEGACY)NULL, TEXT("CA"));	}	if (hMemoryStore == NULL)	{		dwRet = GetLastError();		printf("StoreAuthorityCerts: Unable to open the system certificate store. Error code: %d./n",dwRet);		return dwRet;	}	pDesiredCert = CertFindCertificateInStore( hMemoryStore		, X509_ASN_ENCODING		, 0		, CERT_FIND_EXISTING		, pCertContext		, NULL		);	if( pDesiredCert )	{		CertFreeCertificateContext(pDesiredCert);	}	else if (GetLastError())	{		CertAddEnhancedKeyUsageIdentifier (pCertContext, szOID_PKIX_KP_EMAIL_PROTECTION);		CertAddEnhancedKeyUsageIdentifier (pCertContext, szOID_PKIX_KP_SERVER_AUTH);		if(CertAddCertificateContextToStore(hMemoryStore, pCertContext, CERT_STORE_ADD_NEWER, NULL))		{			printf("StoreUserCerts: Certificate context added to store./n");			dwRet = 0;		}		else		{			dwRet = GetLastError();			printf("StoreAuthorityCerts: Unable to add certificate context to store. Error code: %d./n",dwRet);		}	}	CertCloseStore (hMemoryStore, CERT_CLOSE_STORE_FORCE_FLAG);	return dwRet;}

PCCERT_CONTEXT GetCertificateContextFromName(    LPTSTR lpszCertificateName,    LPTSTR lpszCertificateStoreName,    DWORD  dwCertStoreOpenFlags){    PCCERT_CONTEXT pCertContext = NULL;    HCERTSTORE hCertStore = NULL;    LPSTR szStoreProvider;    DWORD dwFindType;#ifdef UNICODE    szStoreProvider = (LPSTR)CERT_STORE_PROV_SYSTEM_W;#else    szStoreProvider = (LPSTR)CERT_STORE_PROV_SYSTEM_A;#endif    // Open the specified certificate store    hCertStore = CertOpenStore(szStoreProvider,                               0,                               NULL,                               CERT_STORE_READONLY_FLAG|                               dwCertStoreOpenFlags,                               lpszCertificateStoreName);    if (hCertStore == NULL)    {        MyPrintf(_T("CertOpenStore failed with %X/n"), GetLastError());        return pCertContext;    }#ifdef UNICODE    dwFindType = CERT_FIND_SUBJECT_STR_W;#else    dwFindType = CERT_FIND_SUBJECT_STR_A;#endif    // Find the certificate by CN.    pCertContext = CertFindCertificateInStore(                       hCertStore,                       MY_ENCODING,                       0,                       dwFindType,                       lpszCertificateName,                       NULL);    if (pCertContext == NULL)    {        MyPrintf(_T("CertFindCertificateInStore failed with %X/n"), GetLastError());    }    CertCloseStore(hCertStore, 0);    return pCertContext;}

bool CertStore::find( const QSslCertificate &cert ) const{	if( !d->s )		return false;	PCCERT_CONTEXT context = d->certContext( cert );	if( !context )		return false;	PCCERT_CONTEXT result = CertFindCertificateInStore( d->s, X509_ASN_ENCODING,		0, CERT_FIND_SUBJECT_CERT, context->pCertInfo, 0 );	CertFreeCertificateContext( context );	return result;}

std::auto_ptr<Certificate> Store::findCertificate(CERT_INFO* ci){    PCCERT_CONTEXT cert = CertFindCertificateInStore(m_hCertStore,                          X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,                          0,                          CERT_FIND_SUBJECT_CERT,                          ci,                          NULL);    std::auto_ptr<Certificate> certificate = new Certificate(cert);    return certificate;}

Certificado* AlmacenCertificadoCAPI::loadCertificado(ClaveBusqueda claveBusqueda, void *data){	Certificado		*ret;	PCCERT_CONTEXT	cert;	DWORD tipoBusqueda;	void *parametros;	bool ok;	// Obtener el certificado.	//	// Para firmar, no vale un certificado cualquiera, sino uno que contenga una clave	// privada. Si lo que queremos es validar una firma, con que tenga clave pública	// (todos la tienen) es suficiente.	//	// La búsqueda del certificado se puede hacer por varios campos de los que aparecen	// en la pesta
C++ CertOpenStore函数代码示例
C++ CertEnumCertificatesInStore函数代码示例