具有支持的内存存储和证书信任列表的CertGet证书链

Question

在证书链验证期间，我需要将自定义的自签名根证书标记为受信任的，总的来说，我希望尽可能依赖系统API。

我创建了一个临时内存存储。

HCERTSTORE certStore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0, 0, 0);

然后我将自定义根证书放入存储中。

CertAddCertificateContextToStore(certStore, rootCertContext, CERT_STORE_ADD_REPLACE_EXISTING, 0);

CertGet证书链MSDN留档表示

HadAdditional存储任何附加存储的句柄，以搜索支持证书和证书信任列表（CTL）。

据我所知，如果我用根证书创建一个CTL并将其放置到存储中，CertGet证书链将信任它。因此，我在分配的缓冲区中创建根证书CTL条目，然后将其复制到std::矢量ctlEntry

 CertCreateCTLEntryFromCertificateContextProperties(rootCertContext, 0, nullptr, CTL_ENTRY_FROM_PROP_CHAIN_FLAG, nullptr, ctlEntry, &size);

然后我创建CTL本身。

const std::wstring ctlID(L"TrustedRoots");

// I do not know what OIDs to use here. I tried different options.
std::vector<LPSTR> usageList;
usageList.push_back(szOID_SORTED_CTL);
usageList.push_back(szOID_PKIX_KP_CLIENT_AUTH);
usageList.push_back(szOID_PKIX_KP_SERVER_AUTH);

CTL_INFO ctlInfo;
ZeroMemory(&ctlInfo, sizeof(ctlInfo));
ctlInfo.dwVersion = CTL_V1;
ctlInfo.SubjectUsage.cUsageIdentifier = static_cast<DWORD>(usageList.size());
ctlInfo.SubjectUsage.rgpszUsageIdentifier = usageList.data();

ctlInfo.ListIdentifier.cbData = static_cast<DWORD>((ctlID.size() + 1) * sizeof(wchar_t));
ctlInfo.ListIdentifier.pbData = static_cast<BYTE*>(static_cast<void*>(const_cast<wchar_t*>(ctlID.data())));

ctlInfo.SubjectAlgorithm.pszObjId = szOID_OIWSEC_sha1;

ctlInfo.cCTLEntry = static_cast<DWORD>(ctlEntries.size());
ctlInfo.rgCTLEntry = const_cast<PCTL_ENTRY>(ctlEntries.data());

// From MSDN:
// The message can be encoded without signers if the cbSize member of the structure is set to the 
// size of the structure and all of the other members are set to zero.
CMSG_SIGNED_ENCODE_INFO encode;
ZeroMemory(&encode, sizeof(encode));
encode.cbSize = sizeof(encode);

DWORD size = 0, flags = CMSG_ENCODE_SORTED_CTL_FLAG | CMSG_ENCODE_HASHED_SUBJECT_IDENTIFIER_FLAG;
if (CryptMsgEncodeAndSignCTL(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, &ctlInfo, &encode, flags, nullptr, &size) == TRUE)
{
    std::string data;
    data.resize(size);

    BYTE* p = static_cast<BYTE*>(static_cast<void*>(&data.front()));
    if (CryptMsgEncodeAndSignCTL(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, &ctlInfo, &encode, flags, p, &size) == TRUE)
    {
        PCCTL_CONTEXT ctlContext = CertCreateCTLContext(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, p, size);
        if (ctlContext)
        {                   
            if (CertAddCTLContextToStore(certStore, ctlContext, CERT_STORE_ADD_REPLACE_EXISTING, nullptr) == TRUE)
            {
                // success
            }
        }
    }
}

上面的所有API调用都成功完成，但是当我调用CertGet证书链时，它仍然返回CERT_TRUST_IS_UNTRUSTED_ROOTTrustStatus.dw错误状态。

潜在的解决办法

如果我得到CERT_TRUST_IS_UNTRUSTED_ROOT错误，我只需从证书存储中提取CTL，并检查结果链（由CertGetCertificateChain返回）中的根是否在CTL中。它是有效的，但对我来说仍然不能完全接受。我想依靠CertGetCertificateChain。

这个解决方案有什么问题？我必须使用什么特定的证书信任列表？在这种情况下，是否需要信任根证书（如特定扩展）？

p、 s.使用本说明创建测试证书https://gist.github.com/fntlnz/cf14feb5a46b2eda428e000157447309

UPD:2020-01-31

CertModify证书ToTrust没有帮助。它成功完成，但链仍然被报告为具有不可信的根。问题可能在不同的领域。

PCCERT_CONTEXT copiedCert = nullptr;
BOOL result = CertAddCertificateContextToStore(certStore,
    cert, CERT_STORE_ADD_REPLACE_EXISTING, &copiedCert);
CertFreeCertificateContext(cert);
if (result)
{
     // Save the certificate to create a CTL entry later
     trustedRoots.push_back(copiedCert);
}

...

// Creating the CTL entries
...

std::vector<LPSTR> usageList;
usageList.push_back(szOID_CTL); // I really do not know what IDs I must use here

...

CTL_INFO ctlInfo;
ZeroMemory(&ctlInfo, sizeof(ctlInfo));
ctlInfo.dwVersion = CTL_V1;
ctlInfo.SubjectUsage.cUsageIdentifier = static_cast<DWORD>(usageList.size());
ctlInfo.SubjectUsage.rgpszUsageIdentifier = usageList.data();    

...

// Should I use any of the flags?
DWORD size = 0, flags = 0; /*CMSG_ENCODE_SORTED_CTL_FLAG | CMSG_ENCODE_HASHED_SUBJECT_IDENTIFIER_FLAG;*/
if (CryptMsgEncodeAndSignCTL(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, &ctlInfo, &encode, flags, nullptr, &size) == TRUE)

...

if (CertAddCTLContextToStore(certStore, ctlContext, CERT_STORE_ADD_REPLACE_EXISTING, nullptr) == TRUE)
{
    // Check that the CTL is in the store and the root certificate is in the CTL
    CTL_FIND_USAGE_PARA usagePara;
    ZeroMemory(&usagePara, sizeof(usagePara));
    usagePara.cbSize = sizeof(usagePara);
    usagePara.SubjectUsage.cUsageIdentifier = 0;
    usagePara.ListIdentifier.cbData = static_cast<DWORD>((ctlID.size() + 1) * sizeof(wchar_t));
    usagePara.ListIdentifier.pbData = static_cast<BYTE*>(static_cast<void*>(const_cast<wchar_t*>(ctlID.data())));

    PCCTL_CONTEXT foundCTLContext = CertFindCTLInStore(certStore, 
        X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, CTL_FIND_USAGE,
        static_cast<void*>(&usagePara), nullptr);
    if (foundCTLContext != nullptr)
    {
        PCTL_ENTRY ctlEntry = CertFindSubjectInCTL(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
       CTL_CERT_SUBJECT_TYPE, const_cast<void*>(*trustedRoots.begin()), foundCTLContext, 0);
       if (ctlEntry != nullptr)
       {
           // It means the root certificate has been correctly added to the CTL and the CTL is in the store.
           std::cout << "Found the certificate in the CTL" << std::endl;
       }
   }

   // Make the certificate trusted via CertModifyCertificatesToTrust
   HMODULE module = LoadLibrary(L"CryptDlg.dll");
   if (module)
   {
        CertModifyCertificatesToTrustPfn pfn =                               
            (CertModifyCertificatesToTrustPfn)GetProcAddress(hModule, "CertModifyCertificatesToTrust");
        if (pfn != nullptr)
        {
            CTL_MODIFY_REQUEST req;
            // Only one certificate is in the trustedRoots store curretly
            req.pccert = static_cast<PCCERT_CONTEXT>(*trustedRoots.begin());
            req.dwOperation = CTL_MODIFY_REQUEST_ADD_TRUSTED;
            req.dwError = 0;

            HRESULT hr = pfn(1, &req, szOID_CTL, NULL, certStore, nullptr);
            if (hr == S_OK)
            {
                // Success
                std::cout << "Modified" << std::endl;
            }
       }
   }                                    

}

Answer 1

您可以尝试使用以下api:CertModifyCertificateSTorust

请注意

此函数没有关联的导入库。您必须使用LoadGallery和GetProc地址函数来动态链接到CryptDlg.dll.

设置CTL\u MODIFY\u请求dwOperation到标志CTL\u MODIFY\u REQUEST\u ADD\u TRUSTED将证书添加到CTL。证书是显式受信任的。