retrieve the client certificate chain from an ISAPI request

Question

I would like to retrieve the entire client certificate chain from a request in ISAPI.

I already succeeded to get the first certificate in the client's certificate chain by invoking the code below:

LPEXTENSION_CONTROL_BLOCK ecb_;

...

CERT_CONTEXT_EX cce;
memset(&cce, 0, sizeof(CERT_CONTEXT_EX));
char certbuf[64*1024];
cce.cbAllocated = sizeof(certbuf);
cce.CertContext.pbCertEncoded = (BYTE *) &certbuf;
ecb_->ServerSupportFunction(ecb_->ConnID, HSE_REQ_GET_CERT_INFO_EX, &cce, 0, 0)

However, I did not find out how to retrieve the rest of the certificate chain from this CERT_CONTEXT_EX struct.

score 0 · Answer 1 · answered Jul 16 '12 at 21:32

I just came across this old question. I'm sorry I didn't see it sooner.

Many years ago I wrote a sample that shows how do do this using CAPICOM. Unfortunately CAPICOM is being phased out by Microsoft, though it still works.

I found the old isapiCertPolicy sample on Koders:

http://www.koders.com/cpp/fid977D79B2C51AD2423E4F57B6B36C3806F167CF79.aspx

Here are the relevant code fragments:

#import "capicom.dll"

char CertificateBuf[8192];
CERT_CONTEXT_EX ccex;
ccex.cbAllocated = sizeof(CertificateBuf);
ccex.CertContext.pbCertEncoded = (BYTE*)CertificateBuf;
ccex.dwCertificateFlags = 0;
DWORD dwSize = sizeof(ccex);

fOk = pCtxt->ServerSupportFunction(
    (enum SF_REQ_TYPE)HSE_REQ_GET_CERT_INFO_EX,
    (LPVOID)&ccex,
    &dwSize,
    NULL);

_bstr_t bstrCert(
    SysAllocStringLen(
        (OLECHAR * )ccex.CertContext.pbCertEncoded,
        (ccex.CertContext.cbCertEncoded+1)/2),
    FALSE);

CAPICOM::ICertificate2Ptr Cert(__uuidof(CAPICOM::Certificate));
Cert->Import(bstrCert);

CAPICOM::IChainPtr Chain(__uuidof(CAPICOM::Chain));
BOOL fOk = Chain->Build(Cert);

CAPICOM::ICertificatesPtr Certs(NULL);
Certs = Chain->Certificates;

CAPICOM::ICertificate2Ptr ParentCert(Certs->Item[2])

The Chain object builds the certificate chain. If you can't use CAPICOM, you can get the certificate chain using the Crypto API's CertGetCertificateChain function, but it's more work.

retrieve the client certificate chain from an ISAPI request

1 Answers1