Manually validate server certificate in WinINet

Question

I'm trying to implement manual self-signed SSL certificate validation to a WinINet client. I tried to approach it by calling InternetQueryOption with INTERNET_OPTION_SECURITY_CERTIFICATE or INTERNET_OPTION_SECURITY_CERTIFICATE_STRUCT parameters, but both return some internal interpretation of server's certificate, none allows accessing raw certificate public key or at least thumbprimnt.

How am I supposed to validate certificate?...

Answer 1

WinInet will already validate returned certificate's domain name matches the certificate and the certificate chain is trusted if you set INTERNET_FLAG_SECURE when calling HttpOpenRequest.

Few things you can do afterwards:

1. Use INTERNET_OPTION_SECURITY_CERTIFICATE_STRUCT's lpszIssuerInfo to compare returned domain name and certificate name match to parent certificate that is expected.

2. Parse out Issuer name from lpszIssuerInfo and call to CertFindCertificateInStore to get certificate context pointer.

3. Get and validate certificate chain using CertGetCertificateChain and certificate context pointer, such as comparing thumbprints of issuing certificates, but not the actual certificate itself to my knowledge.

For future reference, from MSDN: "http://msdn.microsoft.com/en-us/library/aa385328(VS.85).aspx". If IE8.0 is installed, there is a new option that exposes server's certificate chain.

INTERNET_OPTION_SERVER_CERT_CHAIN_CONTEXT 105

Retrieves the server’s certificate-chain context as a duplicated PCCERT_CHAIN_CONTEXT. You may pass this duplicated context to any Crypto API function which takes a PCCERT_CHAIN_CONTEXT. You must call CertFreeCertificateChain on the returned PCCERT_CHAIN_CONTEXT when you are done with the certificate-chain context.

Version: Requires Internet Explorer 8.0.