10.6. Performing X.509 Certificate Verification with CryptoAPI
You have an X.509 certificate, and you want to verify its validity using Microsoft’s CryptoAPI on Windows.
CryptoAPI represents an X.509 certificate using a
object. Another object, referenced by a
HCERTSTORE handle, must be created to hold the
certificates that will be required for verification, as well as any
certificate revocation lists (CRLs) that may be necessary. The actual
certificate verification is performed by calling the
function for each certificate in the
hierarchy. This function will verify the signature, certificate
validity times, and revocation status of each certificate as it
obtains the issuer for each call. The last certificate in the
hierarchy will have no issuing certificate and should be self-signed.
function for each certificate in the hierarchy, beginning with the
subject certificate at the end of the chain. Each time
CertGetIssuerCertificateFromStore( ) is called,
CryptoAPI will attempt to locate the issuer of the subject
certificate passed into it. If the issuer certificate is found, the
signature of the subject certificate will be verified with the public
key of the issuer certificate. In addition, time validity checks will
be performed on the subject certificate, and the subject certificate
will be compared against the issuer’s CRL if it is
present in the store.