Secure Programming Cookbook for C and C++

10.11. Obtaining CRLs with CryptoAPI

Problem

You have a certificate that you want to verify, as well as the certificate that was used to issue it, but you need to check the issuing authority’s CRL to make sure that the certificate has not been revoked. We cover how to use a CRL once you have it in Recipe 10.6—but how do you get it in the first place?

Solution

Obtaining a CRL with CryptoAPI follows the same basic procedure as doing so with OpenSSL (see Recipe 10.10); the only difference is in the functions used to perform the work. We only provide support for retrieving CRLs via HTTP in this recipe and in Recipe 10.10. We will use the WinInet API (see Recipe 9.4) and the relevant CryptoAPI functions to create a CryptoAPI CRL_CONTEXT object from data retrieved from a CA.

Discussion

For Windows, we mostly duplicate the table that was built in Recipe 10.10, but for simplicity, we strip from the data structure some members we will not be using. The name of the CA, the length of the fingerprint, and the URL to the OCSP for the CA are all omitted, leaving only the fingerprint and URL to retrieve the CRL.

#include <windows.h> #include <wincrypt.h> #include <wininet.h> typedef struct { BYTE *pbFingerPrint; LPSTR lpszCRLURL; } SPC_CACERT; static SPC_CACERT rgLookupTable[ ] = { { "\x67\xcb\x9d\xc0\x13\x24\x8a\x82\x9b\xb2\x17\x1e\xd1\x1b\xec\xd4", "http://crl.geotrust.com/crls/secureca.crl" }, { "\x8f\x5d\x77\x06\x27\xc4\x98\x3c\x5b\x93\x78\xe7\xd7\x7d\x9b\xcc", "http://crl.geotrust.com/crls/globalca1.crl" ...