问具有支持内存存储和证书信任列表的CertGetCertificateChain

EN

HCERTSTORE certStore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0, 0, 0);

CertAddCertificateContextToStore(certStore, rootCertContext, CERT_STORE_ADD_REPLACE_EXISTING, 0);

 CertCreateCTLEntryFromCertificateContextProperties(rootCertContext, 0, nullptr, CTL_ENTRY_FROM_PROP_CHAIN_FLAG, nullptr, ctlEntry, &size);

const std::wstring ctlID(L"TrustedRoots");

// I do not know what OIDs to use here. I tried different options.
std::vector<LPSTR> usageList;
usageList.push_back(szOID_SORTED_CTL);
usageList.push_back(szOID_PKIX_KP_CLIENT_AUTH);
usageList.push_back(szOID_PKIX_KP_SERVER_AUTH);

CTL_INFO ctlInfo;
ZeroMemory(&ctlInfo, sizeof(ctlInfo));
ctlInfo.dwVersion = CTL_V1;
ctlInfo.SubjectUsage.cUsageIdentifier = static_cast<DWORD>(usageList.size());
ctlInfo.SubjectUsage.rgpszUsageIdentifier = usageList.data();

ctlInfo.ListIdentifier.cbData = static_cast<DWORD>((ctlID.size() + 1) * sizeof(wchar_t));
ctlInfo.ListIdentifier.pbData = static_cast<BYTE*>(static_cast<void*>(const_cast<wchar_t*>(ctlID.data())));

ctlInfo.SubjectAlgorithm.pszObjId = szOID_OIWSEC_sha1;

ctlInfo.cCTLEntry = static_cast<DWORD>(ctlEntries.size());
ctlInfo.rgCTLEntry = const_cast<PCTL_ENTRY>(ctlEntries.data());

// From MSDN:
// The message can be encoded without signers if the cbSize member of the structure is set to the 
// size of the structure and all of the other members are set to zero.
CMSG_SIGNED_ENCODE_INFO encode;
ZeroMemory(&encode, sizeof(encode));
encode.cbSize = sizeof(encode);

DWORD size = 0, flags = CMSG_ENCODE_SORTED_CTL_FLAG | CMSG_ENCODE_HASHED_SUBJECT_IDENTIFIER_FLAG;
if (CryptMsgEncodeAndSignCTL(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, &ctlInfo, &encode, flags, nullptr, &size) == TRUE)
{
    std::string data;
    data.resize(size);

    BYTE* p = static_cast<BYTE*>(static_cast<void*>(&data.front()));
    if (CryptMsgEncodeAndSignCTL(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, &ctlInfo, &encode, flags, p, &size) == TRUE)
    {
        PCCTL_CONTEXT ctlContext = CertCreateCTLContext(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, p, size);
        if (ctlContext)
        {                   
            if (CertAddCTLContextToStore(certStore, ctlContext, CERT_STORE_ADD_REPLACE_EXISTING, nullptr) == TRUE)
            {
                // success
            }
        }
    }
}

PCCERT_CONTEXT copiedCert = nullptr;
BOOL result = CertAddCertificateContextToStore(certStore,
    cert, CERT_STORE_ADD_REPLACE_EXISTING, &copiedCert);
CertFreeCertificateContext(cert);
if (result)
{
     // Save the certificate to create a CTL entry later
     trustedRoots.push_back(copiedCert);
}

...

// Creating the CTL entries
...

std::vector<LPSTR> usageList;
usageList.push_back(szOID_CTL); // I really do not know what IDs I must use here

...

CTL_INFO ctlInfo;
ZeroMemory(&ctlInfo, sizeof(ctlInfo));
ctlInfo.dwVersion = CTL_V1;
ctlInfo.SubjectUsage.cUsageIdentifier = static_cast<DWORD>(usageList.size());
ctlInfo.SubjectUsage.rgpszUsageIdentifier = usageList.data();    

...

// Should I use any of the flags?
DWORD size = 0, flags = 0; /*CMSG_ENCODE_SORTED_CTL_FLAG | CMSG_ENCODE_HASHED_SUBJECT_IDENTIFIER_FLAG;*/
if (CryptMsgEncodeAndSignCTL(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, &ctlInfo, &encode, flags, nullptr, &size) == TRUE)

...

if (CertAddCTLContextToStore(certStore, ctlContext, CERT_STORE_ADD_REPLACE_EXISTING, nullptr) == TRUE)
{
    // Check that the CTL is in the store and the root certificate is in the CTL
    CTL_FIND_USAGE_PARA usagePara;
    ZeroMemory(&usagePara, sizeof(usagePara));
    usagePara.cbSize = sizeof(usagePara);
    usagePara.SubjectUsage.cUsageIdentifier = 0;
    usagePara.ListIdentifier.cbData = static_cast<DWORD>((ctlID.size() + 1) * sizeof(wchar_t));
    usagePara.ListIdentifier.pbData = static_cast<BYTE*>(static_cast<void*>(const_cast<wchar_t*>(ctlID.data())));

    PCCTL_CONTEXT foundCTLContext = CertFindCTLInStore(certStore, 
        X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, CTL_FIND_USAGE,
        static_cast<void*>(&usagePara), nullptr);
    if (foundCTLContext != nullptr)
    {
        PCTL_ENTRY ctlEntry = CertFindSubjectInCTL(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
       CTL_CERT_SUBJECT_TYPE, const_cast<void*>(*trustedRoots.begin()), foundCTLContext, 0);
       if (ctlEntry != nullptr)
       {
           // It means the root certificate has been correctly added to the CTL and the CTL is in the store.
           std::cout << "Found the certificate in the CTL" << std::endl;
       }
   }

   // Make the certificate trusted via CertModifyCertificatesToTrust
   HMODULE module = LoadLibrary(L"CryptDlg.dll");
   if (module)
   {
        CertModifyCertificatesToTrustPfn pfn =                               
            (CertModifyCertificatesToTrustPfn)GetProcAddress(hModule, "CertModifyCertificatesToTrust");
        if (pfn != nullptr)
        {
            CTL_MODIFY_REQUEST req;
            // Only one certificate is in the trustedRoots store curretly
            req.pccert = static_cast<PCCERT_CONTEXT>(*trustedRoots.begin());
            req.dwOperation = CTL_MODIFY_REQUEST_ADD_TRUSTED;
            req.dwError = 0;

            HRESULT hr = pfn(1, &req, szOID_CTL, NULL, certStore, nullptr);
            if (hr == S_OK)
            {
                // Success
                std::cout << "Modified" << std::endl;
            }
       }
   }