dlls/crypt32/tests/cert.c

   1 /*
   2  * crypt32 cert functions tests
   3  *
   4  * Copyright 2005-2006 Juan Lang
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  */
  20
  21 #include <stdio.h>
  22 #include <stdarg.h>
  23
  24 #include <windef.h>
  25 #include <winbase.h>
  26 #include <winreg.h>
  27 #include <winerror.h>
  28 #include <wincrypt.h>
  29
  30 #include "wine/test.h"
  31
  32 static BOOL (WINAPI *pCertAddStoreToCollection)(HCERTSTORE,HCERTSTORE,DWORD,DWORD);
  33 static PCCERT_CONTEXT (WINAPI *pCertCreateSelfSignCertificate)(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE,PCERT_NAME_BLOB,DWORD,PCRYPT_KEY_PROV_INFO,PCRYPT_ALGORITHM_IDENTIFIER,PSYSTEMTIME,PSYSTEMTIME,PCERT_EXTENSIONS);
  34 static BOOL (WINAPI *pCertGetValidUsages)(DWORD,PCCERT_CONTEXT*,int*,LPSTR*,DWORD*);
  35 static BOOL (WINAPI *pCryptAcquireCertificatePrivateKey)(PCCERT_CONTEXT,DWORD,void*,HCRYPTPROV_OR_NCRYPT_KEY_HANDLE*,DWORD*,BOOL*);
  36 static BOOL (WINAPI *pCryptEncodeObjectEx)(DWORD,LPCSTR,const void*,DWORD,PCRYPT_ENCODE_PARA,void*,DWORD*);
  37 static BOOL (WINAPI * pCryptVerifyCertificateSignatureEx)
  38                         (HCRYPTPROV, DWORD, DWORD, void *, DWORD, void *, DWORD, void *);
  39
  40 static BOOL (WINAPI * pCryptAcquireContextA)
  41                         (HCRYPTPROV *, LPCSTR, LPCSTR, DWORD, DWORD);
  42
  43 static void init_function_pointers(void)
  44 {
  45     HMODULE hCrypt32 = GetModuleHandleA("crypt32.dll");
  46     HMODULE hAdvapi32 = GetModuleHandleA("advapi32.dll");
  47
  48 #define GET_PROC(dll, func) \
  49     p ## func = (void *)GetProcAddress(dll, #func); \
  50     if(!p ## func) \
  51       trace("GetProcAddress(%s) failed\n", #func);
  52
  53     GET_PROC(hCrypt32, CertAddStoreToCollection)
  54     GET_PROC(hCrypt32, CertCreateSelfSignCertificate)
  55     GET_PROC(hCrypt32, CertGetValidUsages)
  56     GET_PROC(hCrypt32, CryptAcquireCertificatePrivateKey)
  57     GET_PROC(hCrypt32, CryptEncodeObjectEx)
  58     GET_PROC(hCrypt32, CryptVerifyCertificateSignatureEx)
  59
  60     GET_PROC(hAdvapi32, CryptAcquireContextA)
  61
  62 #undef GET_PROC
  63 }
  64
  65 static BYTE subjectName[] = { 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06,
  66  0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61,
  67  0x6e, 0x67, 0x00 };
  68 static BYTE serialNum[] = { 1 };
  69 static const BYTE bigCert[] = { 0x30, 0x7a, 0x02, 0x01, 0x01, 0x30, 0x02, 0x06,
  70  0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
  71  0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x22,
  72  0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30,
  73  0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
  74  0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30,
  75  0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20,
  76  0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03, 0x01,
  77  0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
  78  0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x01 };
  79 static BYTE bigCertHash[] = { 0x6e, 0x30, 0x90, 0x71, 0x5f, 0xd9, 0x23,
  80  0x56, 0xeb, 0xae, 0x25, 0x40, 0xe6, 0x22, 0xda, 0x19, 0x26, 0x02, 0xa6, 0x08 };
  81
  82 static const BYTE bigCertWithDifferentSubject[] = { 0x30, 0x7a, 0x02, 0x01, 0x02,
  83  0x30, 0x02, 0x06, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55,
  84  0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67,
  85  0x00, 0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31,
  86  0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31,
  87  0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15,
  88  0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c,
  89  0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06,
  90  0x00, 0x03, 0x01, 0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55,
  91  0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02,
  92  0x01, 0x01 };
  93 static const BYTE bigCertWithDifferentIssuer[] = { 0x30, 0x7a, 0x02, 0x01,
  94  0x01, 0x30, 0x02, 0x06, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
  95  0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e,
  96  0x67, 0x00, 0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
  97  0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30,
  98  0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30,
  99  0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a,
 100  0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02,
 101  0x06, 0x00, 0x03, 0x01, 0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03,
 102  0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff,
 103  0x02, 0x01, 0x01 };
 104
 105 static BYTE subjectName2[] = { 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06,
 106  0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61,
 107  0x6e, 0x67, 0x00 };
 108 static const BYTE bigCert2[] = { 0x30, 0x7a, 0x02, 0x01, 0x01, 0x30, 0x02, 0x06,
 109  0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
 110  0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x22,
 111  0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30,
 112  0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
 113  0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30,
 114  0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20,
 115  0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03, 0x01,
 116  0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
 117  0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x01 };
 118 static const BYTE bigCert2WithDifferentSerial[] = { 0x30, 0x7a, 0x02, 0x01,
 119  0x02, 0x30, 0x02, 0x06, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
 120  0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e,
 121  0x67, 0x00, 0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
 122  0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30,
 123  0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30,
 124  0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x41,
 125  0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02,
 126  0x06, 0x00, 0x03, 0x01, 0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03,
 127  0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff,
 128  0x02, 0x01, 0x01 };
 129 static BYTE bigCert2Hash[] = { 0x4a, 0x7f, 0x32, 0x1f, 0xcf, 0x3b, 0xc0,
 130  0x87, 0x48, 0x2b, 0xa1, 0x86, 0x54, 0x18, 0xe4, 0x3a, 0x0e, 0x53, 0x7e, 0x2b };
 131
 132 static const BYTE certWithUsage[] = { 0x30, 0x81, 0x93, 0x02, 0x01, 0x01, 0x30,
 133  0x02, 0x06, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04,
 134  0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00,
 135  0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30,
 136  0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30,
 137  0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15, 0x31,
 138  0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61,
 139  0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00,
 140  0x03, 0x01, 0x00, 0xa3, 0x2f, 0x30, 0x2d, 0x30, 0x2b, 0x06, 0x03, 0x55, 0x1d,
 141  0x25, 0x01, 0x01, 0xff, 0x04, 0x21, 0x30, 0x1f, 0x06, 0x08, 0x2b, 0x06, 0x01,
 142  0x05, 0x05, 0x07, 0x03, 0x03, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
 143  0x03, 0x02, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01 };
 144
 145 static void testAddCert(void)
 146 {
 147     HCERTSTORE store;
 148     HCERTSTORE collection;
 149     PCCERT_CONTEXT context;
 150     PCCERT_CONTEXT copyContext;
 151     BOOL ret;
 152
 153     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
 154      CERT_STORE_CREATE_NEW_FLAG, NULL);
 155     ok(store != NULL, "CertOpenStore failed: %d\n", GetLastError());
 156     if (!store)
 157         return;
 158
 159     /* Weird--bad add disposition leads to an access violation in Windows.
 160      * Both tests crash on some win9x boxes.
 161      */
 162     if (0)
 163     {
 164         ret = CertAddEncodedCertificateToStore(0, X509_ASN_ENCODING, bigCert,
 165          sizeof(bigCert), 0, NULL);
 166         ok(!ret && (GetLastError() == STATUS_ACCESS_VIOLATION ||
 167          GetLastError() == E_INVALIDARG),
 168          "Expected STATUS_ACCESS_VIOLATION or E_INVALIDARG, got %08x\n",
 169          GetLastError());
 170         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 171          bigCert, sizeof(bigCert), 0, NULL);
 172         ok(!ret && (GetLastError() == STATUS_ACCESS_VIOLATION ||
 173          GetLastError() == E_INVALIDARG),
 174          "Expected STATUS_ACCESS_VIOLATION or E_INVALIDARG, got %08x\n",
 175          GetLastError());
 176     }
 177
 178     /* Weird--can add a cert to the NULL store (does this have special
 179      * meaning?)
 180      */
 181     context = NULL;
 182     ret = CertAddEncodedCertificateToStore(0, X509_ASN_ENCODING, bigCert,
 183      sizeof(bigCert), CERT_STORE_ADD_ALWAYS, &context);
 184     ok(ret || broken(GetLastError() == OSS_DATA_ERROR /* win98 */),
 185      "CertAddEncodedCertificateToStore failed: %08x\n", GetLastError());
 186     if (context)
 187         CertFreeCertificateContext(context);
 188     if (!ret && GetLastError() == OSS_DATA_ERROR)
 189     {
 190         skip("bigCert can't be decoded, skipping tests\n");
 191         return;
 192     }
 193
 194     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 195      bigCert, sizeof(bigCert), CERT_STORE_ADD_ALWAYS, NULL);
 196     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 197      GetLastError());
 198     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 199      bigCert2, sizeof(bigCert2), CERT_STORE_ADD_NEW, NULL);
 200     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 201      GetLastError());
 202     /* This has the same name as bigCert, so finding isn't done by name */
 203     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 204      certWithUsage, sizeof(certWithUsage), CERT_STORE_ADD_NEW, &context);
 205     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 206      GetLastError());
 207     ok(context != NULL, "Expected a context\n");
 208     if (context)
 209     {
 210         CRYPT_DATA_BLOB hash = { sizeof(bigCert2Hash), bigCert2Hash };
 211
 212         /* Duplicate (AddRef) the context so we can still use it after
 213          * deleting it from the store.
 214          */
 215         CertDuplicateCertificateContext(context);
 216         CertDeleteCertificateFromStore(context);
 217         /* Set the same hash as bigCert2, and try to readd it */
 218         ret = CertSetCertificateContextProperty(context, CERT_HASH_PROP_ID,
 219          0, &hash);
 220         ok(ret, "CertSetCertificateContextProperty failed: %08x\n",
 221          GetLastError());
 222         ret = CertAddCertificateContextToStore(store, context,
 223          CERT_STORE_ADD_NEW, NULL);
 224         /* The failure is a bit odd (CRYPT_E_ASN1_BADTAG), so just check
 225          * that it fails.
 226          */
 227         ok(!ret, "Expected failure\n");
 228         CertFreeCertificateContext(context);
 229     }
 230     context = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert2,
 231      sizeof(bigCert2));
 232     ok(context != NULL, "Expected a context\n");
 233     if (context)
 234     {
 235         /* Try to readd bigCert2 to the store */
 236         ret = CertAddCertificateContextToStore(store, context,
 237          CERT_STORE_ADD_NEW, NULL);
 238         ok(!ret && GetLastError() == CRYPT_E_EXISTS,
 239          "Expected CRYPT_E_EXISTS, got %08x\n", GetLastError());
 240         CertFreeCertificateContext(context);
 241     }
 242
 243     /* Adding a cert with the same issuer name and serial number (but
 244      * different subject) as an existing cert succeeds.
 245      */
 246     context = NULL;
 247     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 248      bigCert2WithDifferentSerial, sizeof(bigCert2WithDifferentSerial),
 249      CERT_STORE_ADD_NEW, &context);
 250     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 251      GetLastError());
 252     if (context)
 253         CertDeleteCertificateFromStore(context);
 254
 255     /* Adding a cert with the same subject name and serial number (but
 256      * different issuer) as an existing cert succeeds.
 257      */
 258     context = NULL;
 259     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 260      bigCertWithDifferentSubject, sizeof(bigCertWithDifferentSubject),
 261      CERT_STORE_ADD_NEW, &context);
 262     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 263      GetLastError());
 264     if (context)
 265         CertDeleteCertificateFromStore(context);
 266
 267     /* Adding a cert with the same issuer name and serial number (but
 268      * different otherwise) as an existing cert succeeds.
 269      */
 270     context = NULL;
 271     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 272      bigCertWithDifferentIssuer, sizeof(bigCertWithDifferentIssuer),
 273      CERT_STORE_ADD_NEW, &context);
 274     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
 275      GetLastError());
 276     if (context)
 277         CertDeleteCertificateFromStore(context);
 278
 279     collection = CertOpenStore(CERT_STORE_PROV_COLLECTION, 0, 0,
 280      CERT_STORE_CREATE_NEW_FLAG, NULL);
 281     ok(collection != NULL, "CertOpenStore failed: %08x\n", GetLastError());
 282     if (collection && pCertAddStoreToCollection)
 283     {
 284         /* Add store to the collection, but disable updates */
 285         pCertAddStoreToCollection(collection, store, 0, 0);
 286
 287         context = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert2,
 288          sizeof(bigCert2));
 289         ok(context != NULL, "Expected a context\n");
 290         if (context)
 291         {
 292             /* Try to readd bigCert2 to the collection */
 293             ret = CertAddCertificateContextToStore(collection, context,
 294              CERT_STORE_ADD_NEW, NULL);
 295             ok(!ret && GetLastError() == CRYPT_E_EXISTS,
 296              "Expected CRYPT_E_EXISTS, got %08x\n", GetLastError());
 297             /* Replacing an existing certificate context is allowed, even
 298              * though updates to the collection aren't..
 299              */
 300             ret = CertAddCertificateContextToStore(collection, context,
 301              CERT_STORE_ADD_REPLACE_EXISTING, NULL);
 302             ok(ret, "CertAddCertificateContextToStore failed: %08x\n",
 303              GetLastError());
 304             /* use the existing certificate and ask for a copy of the context*/
 305             copyContext = NULL;
 306             ret = CertAddCertificateContextToStore(collection, context,
 307              CERT_STORE_ADD_USE_EXISTING, &copyContext);
 308             ok(ret, "CertAddCertificateContextToStore failed: %08x\n",
 309              GetLastError());
 310             ok(copyContext != NULL, "Expected on output a non NULL copyContext\n");
 311             if (copyContext)
 312                 CertFreeCertificateContext(copyContext);
 313             /* but adding a new certificate isn't allowed. */
 314             ret = CertAddCertificateContextToStore(collection, context,
 315              CERT_STORE_ADD_ALWAYS, NULL);
 316             ok(!ret && GetLastError() == E_ACCESSDENIED,
 317              "Expected E_ACCESSDENIED, got %08x\n", GetLastError());
 318             CertFreeCertificateContext(context);
 319         }
 320
 321         CertCloseStore(collection, 0);
 322     }
 323
 324     CertCloseStore(store, 0);
 325 }
 326
 327 static void checkHash(const BYTE *data, DWORD dataLen, ALG_ID algID,
 328  PCCERT_CONTEXT context, DWORD propID)
 329 {
 330     BYTE hash[20] = { 0 }, hashProperty[20];
 331     BOOL ret;
 332     DWORD size;
 333     DWORD dwSizeWithNull;
 334
 335     memset(hash, 0, sizeof(hash));
 336     memset(hashProperty, 0, sizeof(hashProperty));
 337     size = sizeof(hash);
 338     ret = CryptHashCertificate(0, algID, 0, data, dataLen, hash, &size);
 339     ok(ret, "CryptHashCertificate failed: %08x\n", GetLastError());
 340     ret = CertGetCertificateContextProperty(context, propID, NULL,
 341      &dwSizeWithNull);
 342     ok(ret, "algID %08x, propID %d: CertGetCertificateContextProperty failed: %08x\n",
 343      algID, propID, GetLastError());
 344     ret = CertGetCertificateContextProperty(context, propID, hashProperty,
 345      &size);
 346     ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
 347      GetLastError());
 348     ok(!memcmp(hash, hashProperty, size), "Unexpected hash for property %d\n",
 349      propID);
 350     ok(size == dwSizeWithNull, "Unexpected length of hash for property: received %d instead of %d\n",
 351      dwSizeWithNull,size);
 352 }
 353
 354 static const CHAR cspNameA[] = "WineCryptTemp";
 355 static WCHAR cspNameW[] = { 'W','i','n','e','C','r','y','p','t','T','e','m','p',0 };
 356 static const BYTE v1CertWithPubKey[] = {
 357 0x30,0x81,0x95,0x02,0x01,0x01,0x30,0x02,0x06,0x00,0x30,0x15,0x31,0x13,0x30,
 358 0x11,0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,
 359 0x6e,0x67,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,0x31,
 360 0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,
 361 0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x15,0x31,0x13,0x30,0x11,
 362 0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,
 363 0x67,0x00,0x30,0x22,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,
 364 0x01,0x01,0x05,0x00,0x03,0x11,0x00,0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,
 365 0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f,0xa3,0x16,0x30,0x14,0x30,0x12,0x06,
 366 0x03,0x55,0x1d,0x13,0x01,0x01,0xff,0x04,0x08,0x30,0x06,0x01,0x01,0xff,0x02,
 367 0x01,0x01 };
 368 static const BYTE v1CertWithSubjectKeyId[] = {
 369 0x30,0x7b,0x02,0x01,0x01,0x30,0x02,0x06,0x00,0x30,0x15,0x31,0x13,0x30,0x11,
 370 0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,
 371 0x67,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,0x31,0x30,
 372 0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,
 373 0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x15,0x31,0x13,0x30,0x11,0x06,
 374 0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,
 375 0x00,0x30,0x07,0x30,0x02,0x06,0x00,0x03,0x01,0x00,0xa3,0x17,0x30,0x15,0x30,
 376 0x13,0x06,0x03,0x55,0x1d,0x0e,0x04,0x0c,0x04,0x0a,0x4a,0x75,0x61,0x6e,0x20,
 377 0x4c,0x61,0x6e,0x67,0x00 };
 378 static const BYTE subjectKeyId[] = {
 379 0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x00 };
 380 static const BYTE selfSignedCert[] = {
 381  0x30, 0x82, 0x01, 0x1f, 0x30, 0x81, 0xce, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02,
 382  0x10, 0xeb, 0x0d, 0x57, 0x2a, 0x9c, 0x09, 0xba, 0xa4, 0x4a, 0xb7, 0x25, 0x49,
 383  0xd9, 0x3e, 0xb5, 0x73, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1d,
 384  0x05, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03,
 385  0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30,
 386  0x1e, 0x17, 0x0d, 0x30, 0x36, 0x30, 0x36, 0x32, 0x39, 0x30, 0x35, 0x30, 0x30,
 387  0x34, 0x36, 0x5a, 0x17, 0x0d, 0x30, 0x37, 0x30, 0x36, 0x32, 0x39, 0x31, 0x31,
 388  0x30, 0x30, 0x34, 0x36, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
 389  0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e,
 390  0x67, 0x00, 0x30, 0x5c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
 391  0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x4b, 0x00, 0x30, 0x48, 0x02, 0x41,
 392  0x00, 0xe2, 0x54, 0x3a, 0xa7, 0x83, 0xb1, 0x27, 0x14, 0x3e, 0x59, 0xbb, 0xb4,
 393  0x53, 0xe6, 0x1f, 0xe7, 0x5d, 0xf1, 0x21, 0x68, 0xad, 0x85, 0x53, 0xdb, 0x6b,
 394  0x1e, 0xeb, 0x65, 0x97, 0x03, 0x86, 0x60, 0xde, 0xf3, 0x6c, 0x38, 0x75, 0xe0,
 395  0x4c, 0x61, 0xbb, 0xbc, 0x62, 0x17, 0xa9, 0xcd, 0x79, 0x3f, 0x21, 0x4e, 0x96,
 396  0xcb, 0x0e, 0xdc, 0x61, 0x94, 0x30, 0x18, 0x10, 0x6b, 0xd0, 0x1c, 0x10, 0x79,
 397  0x02, 0x03, 0x01, 0x00, 0x01, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02,
 398  0x1d, 0x05, 0x00, 0x03, 0x41, 0x00, 0x25, 0x90, 0x53, 0x34, 0xd9, 0x56, 0x41,
 399  0x5e, 0xdb, 0x7e, 0x01, 0x36, 0xec, 0x27, 0x61, 0x5e, 0xb7, 0x4d, 0x90, 0x66,
 400  0xa2, 0xe1, 0x9d, 0x58, 0x76, 0xd4, 0x9c, 0xba, 0x2c, 0x84, 0xc6, 0x83, 0x7a,
 401  0x22, 0x0d, 0x03, 0x69, 0x32, 0x1a, 0x6d, 0xcb, 0x0c, 0x15, 0xb3, 0x6b, 0xc7,
 402  0x0a, 0x8c, 0xb4, 0x5c, 0x34, 0x78, 0xe0, 0x3c, 0x9c, 0xe9, 0xf3, 0x30, 0x9f,
 403  0xa8, 0x76, 0x57, 0x92, 0x36 };
 404 static const BYTE selfSignedSignatureHash[] = { 0x07,0x5a,0x3e,0xfd,0x0d,0xf6,
 405  0x88,0xeb,0x00,0x64,0xbd,0xc9,0xd6,0xea,0x0a,0x7c,0xcc,0x24,0xdb,0x5d };
 406
 407 static void testCertProperties(void)
 408 {
 409     PCCERT_CONTEXT context = CertCreateCertificateContext(X509_ASN_ENCODING,
 410      bigCert, sizeof(bigCert));
 411     DWORD propID, numProps, access, size;
 412     BOOL ret;
 413     BYTE hash[20] = { 0 }, hashProperty[20];
 414     CRYPT_DATA_BLOB blob;
 415     CERT_KEY_CONTEXT keyContext;
 416
 417     ok(context != NULL || broken(GetLastError() == OSS_DATA_ERROR /* win98 */),
 418      "CertCreateCertificateContext failed: %08x\n", GetLastError());
 419     if (!context)
 420         return;
 421
 422     /* This crashes
 423     propID = CertEnumCertificateContextProperties(NULL, 0);
 424      */
 425
 426     propID = 0;
 427     numProps = 0;
 428     do {
 429         propID = CertEnumCertificateContextProperties(context, propID);
 430         if (propID)
 431             numProps++;
 432     } while (propID != 0);
 433     ok(numProps == 0, "Expected 0 properties, got %d\n", numProps);
 434
 435     /* Tests with a NULL cert context.  Prop ID 0 fails.. */
 436     ret = CertSetCertificateContextProperty(NULL, 0, 0, NULL);
 437     ok(!ret && GetLastError() == E_INVALIDARG,
 438      "Expected E_INVALIDARG, got %08x\n", GetLastError());
 439     /* while this just crashes.
 440     ret = CertSetCertificateContextProperty(NULL,
 441      CERT_KEY_PROV_HANDLE_PROP_ID, 0, NULL);
 442      */
 443
 444     ret = CertSetCertificateContextProperty(context, 0, 0, NULL);
 445     ok(!ret && GetLastError() == E_INVALIDARG,
 446      "Expected E_INVALIDARG, got %08x\n", GetLastError());
 447     /* Can't set the cert property directly, this crashes.
 448     ret = CertSetCertificateContextProperty(context,
 449      CERT_CERT_PROP_ID, 0, bigCert2);
 450      */
 451
 452     /* These all crash.
 453     ret = CertGetCertificateContextProperty(context,
 454      CERT_ACCESS_STATE_PROP_ID, 0, NULL);
 455     ret = CertGetCertificateContextProperty(context, CERT_HASH_PROP_ID,
 456      NULL, NULL);
 457     ret = CertGetCertificateContextProperty(context, CERT_HASH_PROP_ID,
 458      hashProperty, NULL);
 459      */
 460     /* A missing prop */
 461     size = 0;
 462     ret = CertGetCertificateContextProperty(context,
 463      CERT_KEY_PROV_INFO_PROP_ID, NULL, &size);
 464     ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
 465      "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
 466     /* And, an implicit property */
 467     size = sizeof(access);
 468     ret = CertGetCertificateContextProperty(context,
 469      CERT_ACCESS_STATE_PROP_ID, &access, &size);
 470     ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
 471      GetLastError());
 472     ok(!(access & CERT_ACCESS_STATE_WRITE_PERSIST_FLAG),
 473      "Didn't expect a persisted cert\n");
 474     /* Trying to set this "read only" property crashes.
 475     access |= CERT_ACCESS_STATE_WRITE_PERSIST_FLAG;
 476     ret = CertSetCertificateContextProperty(context,
 477      CERT_ACCESS_STATE_PROP_ID, 0, &access);
 478      */
 479
 480     /* Can I set the hash to an invalid hash? */
 481     blob.pbData = hash;
 482     blob.cbData = sizeof(hash);
 483     ret = CertSetCertificateContextProperty(context, CERT_HASH_PROP_ID, 0,
 484      &blob);
 485     ok(ret, "CertSetCertificateContextProperty failed: %08x\n",
 486      GetLastError());
 487     size = sizeof(hashProperty);
 488     ret = CertGetCertificateContextProperty(context, CERT_HASH_PROP_ID,
 489      hashProperty, &size);
 490     ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
 491      GetLastError());
 492     ok(!memcmp(hashProperty, hash, sizeof(hash)), "Unexpected hash\n");
 493     /* Delete the (bogus) hash, and get the real one */
 494     ret = CertSetCertificateContextProperty(context, CERT_HASH_PROP_ID, 0,
 495      NULL);
 496     ok(ret, "CertSetCertificateContextProperty failed: %08x\n",
 497      GetLastError());
 498     checkHash(bigCert, sizeof(bigCert), CALG_SHA1, context,
 499      CERT_HASH_PROP_ID);
 500
 501     /* Now that the hash property is set, we should get one property when
 502      * enumerating.
 503      */
 504     propID = 0;
 505     numProps = 0;
 506     do {
 507         propID = CertEnumCertificateContextProperties(context, propID);
 508         if (propID)
 509             numProps++;
 510     } while (propID != 0);
 511     ok(numProps == 1, "Expected 1 properties, got %d\n", numProps);
 512
 513     /* Check a few other implicit properties */
 514     checkHash(bigCert, sizeof(bigCert), CALG_MD5, context,
 515      CERT_MD5_HASH_PROP_ID);
 516
 517     /* Getting the signature hash fails with this bogus certificate */
 518     size = 0;
 519     ret = CertGetCertificateContextProperty(context,
 520      CERT_SIGNATURE_HASH_PROP_ID, NULL, &size);
 521     ok(!ret &&
 522        (GetLastError() == CRYPT_E_ASN1_BADTAG ||
 523         GetLastError() == CRYPT_E_NOT_FOUND ||
 524         GetLastError() == OSS_DATA_ERROR), /* win9x */
 525        "Expected CRYPT_E_ASN1_BADTAG, got %08x\n", GetLastError());
 526
 527     /* Test key contexts and handles and such */
 528     size = 0;
 529     ret = CertGetCertificateContextProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 530      NULL, &size);
 531     ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
 532      "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
 533     size = sizeof(CERT_KEY_CONTEXT);
 534     ret = CertGetCertificateContextProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 535      NULL, &size);
 536     ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
 537      "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
 538     ret = CertGetCertificateContextProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 539      &keyContext, &size);
 540     ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
 541      "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
 542     /* Key context with an invalid size */
 543     keyContext.cbSize = 0;
 544     ret = CertSetCertificateContextProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 545      0, &keyContext);
 546     ok(!ret && GetLastError() == E_INVALIDARG,
 547      "Expected E_INVALIDARG, got %08x\n", GetLastError());
 548     size = sizeof(keyContext);
 549     ret = CertGetCertificateContextProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 550      &keyContext, &size);
 551     ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
 552      "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
 553     keyContext.cbSize = sizeof(keyContext);
 554     keyContext.hCryptProv = 0;
 555     keyContext.dwKeySpec = AT_SIGNATURE;
 556     ret = CertSetCertificateContextProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 557      0, &keyContext);
 558     ok(ret, "CertSetCertificateContextProperty failed: %08x\n", GetLastError());
 559     /* Now that that's set, the key prov handle property is also gettable.
 560      */
 561     size = sizeof(keyContext.hCryptProv);
 562     ret = CertGetCertificateContextProperty(context,
 563      CERT_KEY_PROV_HANDLE_PROP_ID, &keyContext.hCryptProv, &size);
 564     ok(ret, "Expected to get the CERT_KEY_PROV_HANDLE_PROP_ID, got %08x\n",
 565      GetLastError());
 566     /* Remove the key prov handle property.. */
 567     ret = CertSetCertificateContextProperty(context,
 568      CERT_KEY_PROV_HANDLE_PROP_ID, 0, NULL);
 569     ok(ret, "CertSetCertificateContextProperty failed: %08x\n",
 570      GetLastError());
 571     /* and the key context's CSP is set to NULL. */
 572     size = sizeof(keyContext);
 573     ret = CertGetCertificateContextProperty(context,
 574      CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
 575     ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
 576      GetLastError());
 577     ok(keyContext.hCryptProv == 0, "Expected no hCryptProv\n");
 578
 579     /* According to MSDN the subject key id can be stored as a property,
 580      * as a subject key extension, or as the SHA1 hash of the public key,
 581      * but this cert has none of them:
 582      */
 583     ret = CertGetCertificateContextProperty(context,
 584      CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
 585     ok(!ret && GetLastError() == ERROR_INVALID_DATA,
 586      "Expected ERROR_INVALID_DATA, got %08x\n", GetLastError());
 587     CertFreeCertificateContext(context);
 588     /* This cert does have a public key, but its subject key identifier still
 589      * isn't available: */
 590     context = CertCreateCertificateContext(X509_ASN_ENCODING,
 591      v1CertWithPubKey, sizeof(v1CertWithPubKey));
 592     ret = CertGetCertificateContextProperty(context,
 593      CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
 594     ok(!ret && GetLastError() == ERROR_INVALID_DATA,
 595      "Expected ERROR_INVALID_DATA, got %08x\n", GetLastError());
 596     CertFreeCertificateContext(context);
 597     /* This cert with a subject key extension can have its key identifier
 598      * property retrieved:
 599      */
 600     context = CertCreateCertificateContext(X509_ASN_ENCODING,
 601      v1CertWithSubjectKeyId, sizeof(v1CertWithSubjectKeyId));
 602     ret = CertGetCertificateContextProperty(context,
 603      CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
 604     ok(ret, "CertGetCertificateContextProperty failed: %08x\n", GetLastError());
 605     if (ret)
 606     {
 607         LPBYTE buf = HeapAlloc(GetProcessHeap(), 0, size);
 608
 609         if (buf)
 610         {
 611             ret = CertGetCertificateContextProperty(context,
 612              CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
 613             ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
 614              GetLastError());
 615             ok(!memcmp(buf, subjectKeyId, size), "Unexpected subject key id\n");
 616             HeapFree(GetProcessHeap(), 0, buf);
 617         }
 618     }
 619     CertFreeCertificateContext(context);
 620
 621     context = CertCreateCertificateContext(X509_ASN_ENCODING,
 622      selfSignedCert, sizeof(selfSignedCert));
 623     /* Getting the signature hash of a valid (self-signed) cert succeeds */
 624     size = 0;
 625     ret = CertGetCertificateContextProperty(context,
 626      CERT_SIGNATURE_HASH_PROP_ID, NULL, &size);
 627     ok(ret, "CertGetCertificateContextProperty failed: %08x\n", GetLastError());
 628     ok(size == sizeof(selfSignedSignatureHash), "unexpected size %d\n", size);
 629     ret = CertGetCertificateContextProperty(context,
 630      CERT_SIGNATURE_HASH_PROP_ID, hashProperty, &size);
 631     if (ret)
 632         ok(!memcmp(hashProperty, selfSignedSignatureHash, size),
 633          "unexpected value\n");
 634     CertFreeCertificateContext(context);
 635 }
 636
 637 static void testCreateCert(void)
 638 {
 639     PCCERT_CONTEXT cert, enumCert;
 640     DWORD count, size;
 641     BOOL ret;
 642
 643     SetLastError(0xdeadbeef);
 644     cert = CertCreateCertificateContext(0, NULL, 0);
 645     ok(!cert && GetLastError() == E_INVALIDARG,
 646      "expected E_INVALIDARG, got %08x\n", GetLastError());
 647     SetLastError(0xdeadbeef);
 648     cert = CertCreateCertificateContext(0, selfSignedCert,
 649      sizeof(selfSignedCert));
 650     ok(!cert && GetLastError() == E_INVALIDARG,
 651      "expected E_INVALIDARG, got %08x\n", GetLastError());
 652     SetLastError(0xdeadbeef);
 653     cert = CertCreateCertificateContext(X509_ASN_ENCODING, NULL, 0);
 654     ok(!cert &&
 655      (GetLastError() == CRYPT_E_ASN1_EOD ||
 656      broken(GetLastError() == OSS_MORE_INPUT /* NT4 */)),
 657      "expected CRYPT_E_ASN1_EOD, got %08x\n", GetLastError());
 658
 659     cert = CertCreateCertificateContext(X509_ASN_ENCODING,
 660      selfSignedCert, sizeof(selfSignedCert));
 661     ok(cert != NULL, "creating cert failed: %08x\n", GetLastError());
 662     /* Even in-memory certs are expected to have a store associated with them */
 663     ok(cert->hCertStore != NULL, "expected created cert to have a store\n");
 664     /* The cert doesn't have the archived property set (which would imply it
 665      * doesn't show up in enumerations.)
 666      */
 667     size = 0;
 668     ret = CertGetCertificateContextProperty(cert, CERT_ARCHIVED_PROP_ID,
 669      NULL, &size);
 670     ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
 671        "expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
 672     /* Strangely, enumerating the certs in the store finds none. */
 673     enumCert = NULL;
 674     count = 0;
 675     while ((enumCert = CertEnumCertificatesInStore(cert->hCertStore, enumCert)))
 676         count++;
 677     ok(!count, "expected 0, got %d\n", count);
 678     CertFreeCertificateContext(cert);
 679 }
 680
 681 static void testDupCert(void)
 682 {
 683     PCCERT_CONTEXT context, dupContext, storeContext, storeContext2, context2;
 684     HCERTSTORE store, store2;
 685     BOOL ret;
 686
 687     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
 688      CERT_STORE_CREATE_NEW_FLAG, NULL);
 689     ok(store != NULL, "CertOpenStore failed: %d\n", GetLastError());
 690     if (!store)
 691         return;
 692
 693     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 694      bigCert, sizeof(bigCert), CERT_STORE_ADD_ALWAYS, &context);
 695     ok(ret || broken(GetLastError() == OSS_DATA_ERROR /* win98 */),
 696      "CertAddEncodedCertificateToStore failed: %08x\n", GetLastError());
 697     if (!ret && GetLastError() == OSS_DATA_ERROR)
 698     {
 699         skip("bigCert can't be decoded, skipping tests\n");
 700         return;
 701     }
 702     ok(context != NULL, "Expected a valid cert context\n");
 703     if (context)
 704     {
 705         ok(context->cbCertEncoded == sizeof(bigCert),
 706          "Wrong cert size %d\n", context->cbCertEncoded);
 707         ok(!memcmp(context->pbCertEncoded, bigCert, sizeof(bigCert)),
 708          "Unexpected encoded cert in context\n");
 709         ok(context->hCertStore == store, "Unexpected store\n");
 710
 711         dupContext = CertDuplicateCertificateContext(context);
 712         ok(dupContext != NULL, "Expected valid duplicate\n");
 713         /* Not only is it a duplicate, it's identical: the address is the
 714          * same.
 715          */
 716         ok(dupContext == context, "Expected identical context addresses\n");
 717         CertFreeCertificateContext(dupContext);
 718         CertFreeCertificateContext(context);
 719     }
 720     CertCloseStore(store, 0);
 721
 722     context = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert, sizeof(bigCert));
 723     ok(context != NULL, "CertCreateCertificateContext failed\n");
 724
 725     dupContext = CertDuplicateCertificateContext(context);
 726     ok(dupContext == context, "context != dupContext\n");
 727
 728     ret = CertFreeCertificateContext(dupContext);
 729     ok(ret, "CertFreeCertificateContext failed\n");
 730
 731     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0, CERT_STORE_CREATE_NEW_FLAG, NULL);
 732     ok(store != NULL, "CertOpenStore failed: %d\n", GetLastError());
 733
 734     ret = CertAddCertificateContextToStore(store, context, CERT_STORE_ADD_NEW, &storeContext);
 735     ok(ret, "CertAddCertificateContextToStore failed\n");
 736     ok(storeContext != NULL && storeContext != context, "unexpected storeContext\n");
 737     ok(storeContext->hCertStore == store, "unexpected hCertStore\n");
 738
 739     ok(storeContext->pbCertEncoded != context->pbCertEncoded, "unexpected pbCertEncoded\n");
 740     ok(storeContext->cbCertEncoded == context->cbCertEncoded, "unexpected cbCertEncoded\n");
 741     ok(storeContext->pCertInfo != context->pCertInfo, "unexpected pCertInfo\n");
 742
 743     store2 = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0, CERT_STORE_CREATE_NEW_FLAG, NULL);
 744     ok(store2 != NULL, "CertOpenStore failed: %d\n", GetLastError());
 745
 746     ret = CertAddCertificateContextToStore(store2, storeContext, CERT_STORE_ADD_NEW, &storeContext2);
 747     ok(ret, "CertAddCertificateContextToStore failed\n");
 748     ok(storeContext2 != NULL && storeContext2 != storeContext, "unexpected storeContext\n");
 749     ok(storeContext2->hCertStore == store2, "unexpected hCertStore\n");
 750
 751     ok(storeContext2->pbCertEncoded != storeContext->pbCertEncoded, "unexpected pbCertEncoded\n");
 752     ok(storeContext2->cbCertEncoded == storeContext->cbCertEncoded, "unexpected cbCertEncoded\n");
 753     ok(storeContext2->pCertInfo != storeContext->pCertInfo, "unexpected pCertInfo\n");
 754
 755     CertFreeCertificateContext(storeContext2);
 756     CertFreeCertificateContext(storeContext);
 757
 758     context2 = CertCreateCertificateContext(X509_ASN_ENCODING, certWithUsage, sizeof(certWithUsage));
 759     ok(context2 != NULL, "CertCreateCertificateContext failed\n");
 760
 761     ok(context2->hCertStore == context->hCertStore, "Unexpected hCertStore\n");
 762
 763     CertFreeCertificateContext(context2);
 764     ret = CertFreeCertificateContext(context);
 765     ok(ret, "CertFreeCertificateContext failed\n");
 766
 767     CertCloseStore(store, 0);
 768     CertCloseStore(store2, 0);
 769
 770     SetLastError(0xdeadbeef);
 771     context = CertDuplicateCertificateContext(NULL);
 772     ok(context == NULL, "Expected context to be NULL\n");
 773
 774     ret = CertFreeCertificateContext(NULL);
 775     ok(ret, "CertFreeCertificateContext failed\n");
 776 }
 777
 778 static void testLinkCert(void)
 779 {
 780     const CERT_CONTEXT *context, *link;
 781     HCERTSTORE store;
 782     BOOL ret;
 783
 784     context = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert, sizeof(bigCert));
 785     ok(context != NULL, "CertCreateCertificateContext failed\n");
 786
 787     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0, CERT_STORE_CREATE_NEW_FLAG, NULL);
 788     ok(store != NULL, "CertOpenStore failed: %d\n", GetLastError());
 789
 790     ret = CertAddCertificateLinkToStore(store, context, CERT_STORE_ADD_NEW, &link);
 791     ok(ret, "CertAddCertificateContextToStore failed\n");
 792     ok(link != NULL && link != context, "unexpected storeContext\n");
 793     ok(link->hCertStore == store, "unexpected hCertStore\n");
 794
 795     ok(link->pbCertEncoded == context->pbCertEncoded, "unexpected pbCertEncoded\n");
 796     ok(link->cbCertEncoded == context->cbCertEncoded, "unexpected cbCertEncoded\n");
 797     ok(link->pCertInfo == context->pCertInfo, "unexpected pCertInfo\n");
 798
 799     CertFreeCertificateContext(link);
 800     CertFreeCertificateContext(context);
 801     CertCloseStore(store, 0);
 802 }
 803
 804 static BYTE subjectName3[] = { 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06,
 805  0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x52, 0x6f, 0x62, 0x20, 0x20, 0x4c, 0x61,
 806  0x6e, 0x67, 0x00 };
 807 static const BYTE iTunesCert0[] = {
 808 0x30,0x82,0x03,0xc4,0x30,0x82,0x03,0x2d,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 809 0x47,0xbf,0x19,0x95,0xdf,0x8d,0x52,0x46,0x43,0xf7,0xdb,0x6d,0x48,0x0d,0x31,
 810 0xa4,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 811 0x00,0x30,0x81,0x8b,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,
 812 0x5a,0x41,0x31,0x15,0x30,0x13,0x06,0x03,0x55,0x04,0x08,0x13,0x0c,0x57,0x65,
 813 0x73,0x74,0x65,0x72,0x6e,0x20,0x43,0x61,0x70,0x65,0x31,0x14,0x30,0x12,0x06,
 814 0x03,0x55,0x04,0x07,0x13,0x0b,0x44,0x75,0x72,0x62,0x61,0x6e,0x76,0x69,0x6c,
 815 0x6c,0x65,0x31,0x0f,0x30,0x0d,0x06,0x03,0x55,0x04,0x0a,0x13,0x06,0x54,0x68,
 816 0x61,0x77,0x74,0x65,0x31,0x1d,0x30,0x1b,0x06,0x03,0x55,0x04,0x0b,0x13,0x14,
 817 0x54,0x68,0x61,0x77,0x74,0x65,0x20,0x43,0x65,0x72,0x74,0x69,0x66,0x69,0x63,
 818 0x61,0x74,0x69,0x6f,0x6e,0x31,0x1f,0x30,0x1d,0x06,0x03,0x55,0x04,0x03,0x13,
 819 0x16,0x54,0x68,0x61,0x77,0x74,0x65,0x20,0x54,0x69,0x6d,0x65,0x73,0x74,0x61,
 820 0x6d,0x70,0x69,0x6e,0x67,0x20,0x43,0x41,0x30,0x1e,0x17,0x0d,0x30,0x33,0x31,
 821 0x32,0x30,0x34,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x31,0x33,0x31,
 822 0x32,0x30,0x33,0x32,0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x53,0x31,0x0b,0x30,
 823 0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x17,0x30,0x15,0x06,
 824 0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x2c,
 825 0x20,0x49,0x6e,0x63,0x2e,0x31,0x2b,0x30,0x29,0x06,0x03,0x55,0x04,0x03,0x13,
 826 0x22,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x20,0x54,0x69,0x6d,0x65,0x20,
 827 0x53,0x74,0x61,0x6d,0x70,0x69,0x6e,0x67,0x20,0x53,0x65,0x72,0x76,0x69,0x63,
 828 0x65,0x73,0x20,0x43,0x41,0x30,0x82,0x01,0x22,0x30,0x0d,0x06,0x09,0x2a,0x86,
 829 0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x82,0x01,0x0f,0x00,0x30,
 830 0x82,0x01,0x0a,0x02,0x82,0x01,0x01,0x00,0xa9,0xca,0xb2,0xa4,0xcc,0xcd,0x20,
 831 0xaf,0x0a,0x7d,0x89,0xac,0x87,0x75,0xf0,0xb4,0x4e,0xf1,0xdf,0xc1,0x0f,0xbf,
 832 0x67,0x61,0xbd,0xa3,0x64,0x1c,0xda,0xbb,0xf9,0xca,0x33,0xab,0x84,0x30,0x89,
 833 0x58,0x7e,0x8c,0xdb,0x6b,0xdd,0x36,0x9e,0x0f,0xbf,0xd1,0xec,0x78,0xf2,0x77,
 834 0xa6,0x7e,0x6f,0x3c,0xbf,0x93,0xaf,0x0d,0xba,0x68,0xf4,0x6c,0x94,0xca,0xbd,
 835 0x52,0x2d,0xab,0x48,0x3d,0xf5,0xb6,0xd5,0x5d,0x5f,0x1b,0x02,0x9f,0xfa,0x2f,
 836 0x6b,0x1e,0xa4,0xf7,0xa3,0x9a,0xa6,0x1a,0xc8,0x02,0xe1,0x7f,0x4c,0x52,0xe3,
 837 0x0e,0x60,0xec,0x40,0x1c,0x7e,0xb9,0x0d,0xde,0x3f,0xc7,0xb4,0xdf,0x87,0xbd,
 838 0x5f,0x7a,0x6a,0x31,0x2e,0x03,0x99,0x81,0x13,0xa8,0x47,0x20,0xce,0x31,0x73,
 839 0x0d,0x57,0x2d,0xcd,0x78,0x34,0x33,0x95,0x12,0x99,0x12,0xb9,0xde,0x68,0x2f,
 840 0xaa,0xe6,0xe3,0xc2,0x8a,0x8c,0x2a,0xc3,0x8b,0x21,0x87,0x66,0xbd,0x83,0x58,
 841 0x57,0x6f,0x75,0xbf,0x3c,0xaa,0x26,0x87,0x5d,0xca,0x10,0x15,0x3c,0x9f,0x84,
 842 0xea,0x54,0xc1,0x0a,0x6e,0xc4,0xfe,0xc5,0x4a,0xdd,0xb9,0x07,0x11,0x97,0x22,
 843 0x7c,0xdb,0x3e,0x27,0xd1,0x1e,0x78,0xec,0x9f,0x31,0xc9,0xf1,0xe6,0x22,0x19,
 844 0xdb,0xc4,0xb3,0x47,0x43,0x9a,0x1a,0x5f,0xa0,0x1e,0x90,0xe4,0x5e,0xf5,0xee,
 845 0x7c,0xf1,0x7d,0xab,0x62,0x01,0x8f,0xf5,0x4d,0x0b,0xde,0xd0,0x22,0x56,0xa8,
 846 0x95,0xcd,0xae,0x88,0x76,0xae,0xee,0xba,0x0d,0xf3,0xe4,0x4d,0xd9,0xa0,0xfb,
 847 0x68,0xa0,0xae,0x14,0x3b,0xb3,0x87,0xc1,0xbb,0x02,0x03,0x01,0x00,0x01,0xa3,
 848 0x81,0xdb,0x30,0x81,0xd8,0x30,0x34,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,
 849 0x01,0x01,0x04,0x28,0x30,0x26,0x30,0x24,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,
 850 0x07,0x30,0x01,0x86,0x18,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x6f,0x63,0x73,
 851 0x70,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x30,
 852 0x12,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,0xff,0x04,0x08,0x30,0x06,0x01,0x01,
 853 0xff,0x02,0x01,0x00,0x30,0x41,0x06,0x03,0x55,0x1d,0x1f,0x04,0x3a,0x30,0x38,
 854 0x30,0x36,0xa0,0x34,0xa0,0x32,0x86,0x30,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,
 855 0x63,0x72,0x6c,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,
 856 0x6d,0x2f,0x54,0x68,0x61,0x77,0x74,0x65,0x54,0x69,0x6d,0x65,0x73,0x74,0x61,
 857 0x6d,0x70,0x69,0x6e,0x67,0x43,0x41,0x2e,0x63,0x72,0x6c,0x30,0x13,0x06,0x03,
 858 0x55,0x1d,0x25,0x04,0x0c,0x30,0x0a,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,
 859 0x03,0x08,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,0x01,0xff,0x04,0x04,0x03,
 860 0x02,0x01,0x06,0x30,0x24,0x06,0x03,0x55,0x1d,0x11,0x04,0x1d,0x30,0x1b,0xa4,
 861 0x19,0x30,0x17,0x31,0x15,0x30,0x13,0x06,0x03,0x55,0x04,0x03,0x13,0x0c,0x54,
 862 0x53,0x41,0x32,0x30,0x34,0x38,0x2d,0x31,0x2d,0x35,0x33,0x30,0x0d,0x06,0x09,
 863 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,
 864 0x4a,0x6b,0xf9,0xea,0x58,0xc2,0x44,0x1c,0x31,0x89,0x79,0x99,0x2b,0x96,0xbf,
 865 0x82,0xac,0x01,0xd6,0x1c,0x4c,0xcd,0xb0,0x8a,0x58,0x6e,0xdf,0x08,0x29,0xa3,
 866 0x5e,0xc8,0xca,0x93,0x13,0xe7,0x04,0x52,0x0d,0xef,0x47,0x27,0x2f,0x00,0x38,
 867 0xb0,0xe4,0xc9,0x93,0x4e,0x9a,0xd4,0x22,0x62,0x15,0xf7,0x3f,0x37,0x21,0x4f,
 868 0x70,0x31,0x80,0xf1,0x8b,0x38,0x87,0xb3,0xe8,0xe8,0x97,0x00,0xfe,0xcf,0x55,
 869 0x96,0x4e,0x24,0xd2,0xa9,0x27,0x4e,0x7a,0xae,0xb7,0x61,0x41,0xf3,0x2a,0xce,
 870 0xe7,0xc9,0xd9,0x5e,0xdd,0xbb,0x2b,0x85,0x3e,0xb5,0x9d,0xb5,0xd9,0xe1,0x57,
 871 0xff,0xbe,0xb4,0xc5,0x7e,0xf5,0xcf,0x0c,0x9e,0xf0,0x97,0xfe,0x2b,0xd3,0x3b,
 872 0x52,0x1b,0x1b,0x38,0x27,0xf7,0x3f,0x4a };
 873 static const BYTE iTunesCert1[] = {
 874 0x30,0x82,0x03,0xff,0x30,0x82,0x02,0xe7,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 875 0x0d,0xe9,0x2b,0xf0,0xd4,0xd8,0x29,0x88,0x18,0x32,0x05,0x09,0x5e,0x9a,0x76,
 876 0x88,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 877 0x00,0x30,0x53,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,
 878 0x53,0x31,0x17,0x30,0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,
 879 0x69,0x53,0x69,0x67,0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x2b,0x30,0x29,
 880 0x06,0x03,0x55,0x04,0x03,0x13,0x22,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,
 881 0x20,0x54,0x69,0x6d,0x65,0x20,0x53,0x74,0x61,0x6d,0x70,0x69,0x6e,0x67,0x20,
 882 0x53,0x65,0x72,0x76,0x69,0x63,0x65,0x73,0x20,0x43,0x41,0x30,0x1e,0x17,0x0d,
 883 0x30,0x33,0x31,0x32,0x30,0x34,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,
 884 0x30,0x38,0x31,0x32,0x30,0x33,0x32,0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x57,
 885 0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x17,
 886 0x30,0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,0x69,0x53,0x69,
 887 0x67,0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x2f,0x30,0x2d,0x06,0x03,0x55,
 888 0x04,0x03,0x13,0x26,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x20,0x54,0x69,
 889 0x6d,0x65,0x20,0x53,0x74,0x61,0x6d,0x70,0x69,0x6e,0x67,0x20,0x53,0x65,0x72,
 890 0x76,0x69,0x63,0x65,0x73,0x20,0x53,0x69,0x67,0x6e,0x65,0x72,0x30,0x82,0x01,
 891 0x22,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,
 892 0x00,0x03,0x82,0x01,0x0f,0x00,0x30,0x82,0x01,0x0a,0x02,0x82,0x01,0x01,0x00,
 893 0xb2,0x50,0x28,0x48,0xdd,0xd3,0x68,0x7a,0x84,0x18,0x44,0x66,0x75,0x5d,0x7e,
 894 0xc4,0xb8,0x9f,0x63,0x26,0xff,0x3d,0x43,0x9c,0x7c,0x11,0x38,0x10,0x25,0x55,
 895 0x73,0xd9,0x75,0x27,0x69,0xfd,0x4e,0xb9,0x20,0x5c,0xd3,0x0a,0xf9,0xa0,0x1b,
 896 0x2a,0xed,0x55,0x56,0x21,0x61,0xd8,0x1e,0xdb,0xe4,0xbc,0x33,0x6b,0xc7,0xef,
 897 0xdd,0xa3,0x37,0x65,0x8e,0x1b,0x93,0x0c,0xb6,0x53,0x1e,0x5c,0x7c,0x66,0x35,
 898 0x5f,0x05,0x8a,0x45,0xfe,0x76,0x4e,0xdf,0x53,0x80,0xa2,0x81,0x20,0x9d,0xae,
 899 0x88,0x5c,0xa2,0x08,0xf7,0xe5,0x30,0xf9,0xee,0x22,0x37,0x4c,0x42,0x0a,0xce,
 900 0xdf,0xc6,0x1f,0xc4,0xd6,0x55,0xe9,0x81,0x3f,0xb5,0x52,0xa3,0x2c,0xaa,0x01,
 901 0x7a,0xf2,0xa2,0xaa,0x8d,0x35,0xfe,0x9f,0xe6,0x5d,0x6a,0x05,0x9f,0x3d,0x6b,
 902 0xe3,0xbf,0x96,0xc0,0xfe,0xcc,0x60,0xf9,0x40,0xe7,0x07,0xa0,0x44,0xeb,0x81,
 903 0x51,0x6e,0xa5,0x2a,0xf2,0xb6,0x8a,0x10,0x28,0xed,0x8f,0xdc,0x06,0xa0,0x86,
 904 0x50,0x9a,0x7b,0x4a,0x08,0x0d,0x30,0x1d,0xca,0x10,0x9e,0x6b,0xf7,0xe9,0x58,
 905 0xae,0x04,0xa9,0x40,0x99,0xb2,0x28,0xe8,0x8f,0x16,0xac,0x3c,0xe3,0x53,0x6f,
 906 0x4b,0xd3,0x35,0x9d,0xb5,0x6f,0x64,0x1d,0xb3,0x96,0x2c,0xbb,0x3d,0xe7,0x79,
 907 0xeb,0x6d,0x7a,0xf9,0x16,0xe6,0x26,0xad,0xaf,0xef,0x99,0x53,0xb7,0x40,0x2c,
 908 0x95,0xb8,0x79,0xaa,0xfe,0xd4,0x52,0xab,0x29,0x74,0x7e,0x42,0xec,0x39,0x1e,
 909 0xa2,0x6a,0x16,0xe6,0x59,0xbb,0x24,0x68,0xd8,0x00,0x80,0x43,0x10,0x87,0x80,
 910 0x6b,0x02,0x03,0x01,0x00,0x01,0xa3,0x81,0xca,0x30,0x81,0xc7,0x30,0x34,0x06,
 911 0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x01,0x01,0x04,0x28,0x30,0x26,0x30,0x24,
 912 0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x30,0x01,0x86,0x18,0x68,0x74,0x74,
 913 0x70,0x3a,0x2f,0x2f,0x6f,0x63,0x73,0x70,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,
 914 0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x30,0x0c,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,
 915 0xff,0x04,0x02,0x30,0x00,0x30,0x33,0x06,0x03,0x55,0x1d,0x1f,0x04,0x2c,0x30,
 916 0x2a,0x30,0x28,0xa0,0x26,0xa0,0x24,0x86,0x22,0x68,0x74,0x74,0x70,0x3a,0x2f,
 917 0x2f,0x63,0x72,0x6c,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,
 918 0x6f,0x6d,0x2f,0x74,0x73,0x73,0x2d,0x63,0x61,0x2e,0x63,0x72,0x6c,0x30,0x16,
 919 0x06,0x03,0x55,0x1d,0x25,0x01,0x01,0xff,0x04,0x0c,0x30,0x0a,0x06,0x08,0x2b,
 920 0x06,0x01,0x05,0x05,0x07,0x03,0x08,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,
 921 0x01,0xff,0x04,0x04,0x03,0x02,0x06,0xc0,0x30,0x24,0x06,0x03,0x55,0x1d,0x11,
 922 0x04,0x1d,0x30,0x1b,0xa4,0x19,0x30,0x17,0x31,0x15,0x30,0x13,0x06,0x03,0x55,
 923 0x04,0x03,0x13,0x0c,0x54,0x53,0x41,0x32,0x30,0x34,0x38,0x2d,0x31,0x2d,0x35,
 924 0x34,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 925 0x00,0x03,0x82,0x01,0x01,0x00,0x87,0x78,0x70,0xda,0x4e,0x52,0x01,0x20,0x5b,
 926 0xe0,0x79,0xc9,0x82,0x30,0xc4,0xfd,0xb9,0x19,0x96,0xbd,0x91,0x00,0xc3,0xbd,
 927 0xcd,0xcd,0xc6,0xf4,0x0e,0xd8,0xff,0xf9,0x4d,0xc0,0x33,0x62,0x30,0x11,0xc5,
 928 0xf5,0x74,0x1b,0xd4,0x92,0xde,0x5f,0x9c,0x20,0x13,0xb1,0x7c,0x45,0xbe,0x50,
 929 0xcd,0x83,0xe7,0x80,0x17,0x83,0xa7,0x27,0x93,0x67,0x13,0x46,0xfb,0xca,0xb8,
 930 0x98,0x41,0x03,0xcc,0x9b,0x51,0x5b,0x05,0x8b,0x7f,0xa8,0x6f,0xf3,0x1b,0x50,
 931 0x1b,0x24,0x2e,0xf2,0x69,0x8d,0x6c,0x22,0xf7,0xbb,0xca,0x16,0x95,0xed,0x0c,
 932 0x74,0xc0,0x68,0x77,0xd9,0xeb,0x99,0x62,0x87,0xc1,0x73,0x90,0xf8,0x89,0x74,
 933 0x7a,0x23,0xab,0xa3,0x98,0x7b,0x97,0xb1,0xf7,0x8f,0x29,0x71,0x4d,0x2e,0x75,
 934 0x1b,0x48,0x41,0xda,0xf0,0xb5,0x0d,0x20,0x54,0xd6,0x77,0xa0,0x97,0x82,0x63,
 935 0x69,0xfd,0x09,0xcf,0x8a,0xf0,0x75,0xbb,0x09,0x9b,0xd9,0xf9,0x11,0x55,0x26,
 936 0x9a,0x61,0x32,0xbe,0x7a,0x02,0xb0,0x7b,0x86,0xbe,0xa2,0xc3,0x8b,0x22,0x2c,
 937 0x78,0xd1,0x35,0x76,0xbc,0x92,0x73,0x5c,0xf9,0xb9,0xe6,0x4c,0x15,0x0a,0x23,
 938 0xcc,0xe4,0xd2,0xd4,0x34,0x2e,0x49,0x40,0x15,0x3c,0x0f,0x60,0x7a,0x24,0xc6,
 939 0xa5,0x66,0xef,0x96,0xcf,0x70,0xeb,0x3e,0xe7,0xf4,0x0d,0x7e,0xdc,0xd1,0x7c,
 940 0xa3,0x76,0x71,0x69,0xc1,0x9c,0x4f,0x47,0x30,0x35,0x21,0xb1,0xa2,0xaf,0x1a,
 941 0x62,0x3c,0x2b,0xd9,0x8e,0xaa,0x2a,0x07,0x7b,0xd8,0x18,0xb3,0x5c,0x7b,0xe2,
 942 0x9d,0xa5,0x6f,0xfe,0x3c,0x89,0xad };
 943 static const BYTE iTunesCert2[] = {
 944 0x30,0x82,0x04,0xbf,0x30,0x82,0x04,0x28,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 945 0x41,0x91,0xa1,0x5a,0x39,0x78,0xdf,0xcf,0x49,0x65,0x66,0x38,0x1d,0x4c,0x75,
 946 0xc2,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 947 0x00,0x30,0x5f,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,
 948 0x53,0x31,0x17,0x30,0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,
 949 0x69,0x53,0x69,0x67,0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x37,0x30,0x35,
 950 0x06,0x03,0x55,0x04,0x0b,0x13,0x2e,0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,
 951 0x50,0x75,0x62,0x6c,0x69,0x63,0x20,0x50,0x72,0x69,0x6d,0x61,0x72,0x79,0x20,
 952 0x43,0x65,0x72,0x74,0x69,0x66,0x69,0x63,0x61,0x74,0x69,0x6f,0x6e,0x20,0x41,
 953 0x75,0x74,0x68,0x6f,0x72,0x69,0x74,0x79,0x30,0x1e,0x17,0x0d,0x30,0x34,0x30,
 954 0x37,0x31,0x36,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x31,0x34,0x30,
 955 0x37,0x31,0x35,0x32,0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x81,0xb4,0x31,0x0b,
 956 0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x17,0x30,0x15,
 957 0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,
 958 0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x1f,0x30,0x1d,0x06,0x03,0x55,0x04,0x0b,
 959 0x13,0x16,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x20,0x54,0x72,0x75,0x73,
 960 0x74,0x20,0x4e,0x65,0x74,0x77,0x6f,0x72,0x6b,0x31,0x3b,0x30,0x39,0x06,0x03,
 961 0x55,0x04,0x0b,0x13,0x32,0x54,0x65,0x72,0x6d,0x73,0x20,0x6f,0x66,0x20,0x75,
 962 0x73,0x65,0x20,0x61,0x74,0x20,0x68,0x74,0x74,0x70,0x73,0x3a,0x2f,0x2f,0x77,
 963 0x77,0x77,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,
 964 0x2f,0x72,0x70,0x61,0x20,0x28,0x63,0x29,0x30,0x34,0x31,0x2e,0x30,0x2c,0x06,
 965 0x03,0x55,0x04,0x03,0x13,0x25,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x20,
 966 0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,0x43,0x6f,0x64,0x65,0x20,0x53,0x69,
 967 0x67,0x6e,0x69,0x6e,0x67,0x20,0x32,0x30,0x30,0x34,0x20,0x43,0x41,0x30,0x82,
 968 0x01,0x22,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,
 969 0x05,0x00,0x03,0x82,0x01,0x0f,0x00,0x30,0x82,0x01,0x0a,0x02,0x82,0x01,0x01,
 970 0x00,0xbe,0xbc,0xee,0xbc,0x7e,0xef,0x83,0xeb,0xe0,0x37,0x4f,0xfb,0x03,0x10,
 971 0x38,0xbe,0x08,0xd2,0x8c,0x7d,0x9d,0xfa,0x92,0x7f,0x19,0x0c,0xc2,0x6b,0xee,
 972 0x42,0x52,0x8c,0xde,0xd3,0x1c,0x48,0x13,0x25,0xea,0xc1,0x63,0x7a,0xf9,0x51,
 973 0x65,0xee,0xd3,0xaa,0x3b,0xf5,0xf0,0x94,0x9c,0x2b,0xfb,0xf2,0x66,0xd4,0x24,
 974 0xda,0xf7,0xf5,0x9f,0x6e,0x19,0x39,0x36,0xbc,0xd0,0xa3,0x76,0x08,0x1e,0x22,
 975 0x27,0x24,0x6c,0x38,0x91,0x27,0xe2,0x84,0x49,0xae,0x1b,0x8a,0xa1,0xfd,0x25,
 976 0x82,0x2c,0x10,0x30,0xe8,0x71,0xab,0x28,0xe8,0x77,0x4a,0x51,0xf1,0xec,0xcd,
 977 0xf8,0xf0,0x54,0xd4,0x6f,0xc0,0xe3,0x6d,0x0a,0x8f,0xd9,0xd8,0x64,0x8d,0x63,
 978 0xb2,0x2d,0x4e,0x27,0xf6,0x85,0x0e,0xfe,0x6d,0xe3,0x29,0x99,0xe2,0x85,0x47,
 979 0x7c,0x2d,0x86,0x7f,0xe8,0x57,0x8f,0xad,0x67,0xc2,0x33,0x32,0x91,0x13,0x20,
 980 0xfc,0xa9,0x23,0x14,0x9a,0x6d,0xc2,0x84,0x4b,0x76,0x68,0x04,0xd5,0x71,0x2c,
 981 0x5d,0x21,0xfa,0x88,0x0d,0x26,0xfd,0x1f,0x2d,0x91,0x2b,0xe7,0x01,0x55,0x4d,
 982 0xf2,0x6d,0x35,0x28,0x82,0xdf,0xd9,0x6b,0x5c,0xb6,0xd6,0xd9,0xaa,0x81,0xfd,
 983 0x5f,0xcd,0x83,0xba,0x63,0x9d,0xd0,0x22,0xfc,0xa9,0x3b,0x42,0x69,0xb2,0x8e,
 984 0x3a,0xb5,0xbc,0xb4,0x9e,0x0f,0x5e,0xc4,0xea,0x2c,0x82,0x8b,0x28,0xfd,0x53,
 985 0x08,0x96,0xdd,0xb5,0x01,0x20,0xd1,0xf9,0xa5,0x18,0xe7,0xc0,0xee,0x51,0x70,
 986 0x37,0xe1,0xb6,0x05,0x48,0x52,0x48,0x6f,0x38,0xea,0xc3,0xe8,0x6c,0x7b,0x44,
 987 0x84,0xbb,0x02,0x03,0x01,0x00,0x01,0xa3,0x82,0x01,0xa0,0x30,0x82,0x01,0x9c,
 988 0x30,0x12,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,0xff,0x04,0x08,0x30,0x06,0x01,
 989 0x01,0xff,0x02,0x01,0x00,0x30,0x44,0x06,0x03,0x55,0x1d,0x20,0x04,0x3d,0x30,
 990 0x3b,0x30,0x39,0x06,0x0b,0x60,0x86,0x48,0x01,0x86,0xf8,0x45,0x01,0x07,0x17,
 991 0x03,0x30,0x2a,0x30,0x28,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x02,0x01,
 992 0x16,0x1c,0x68,0x74,0x74,0x70,0x73,0x3a,0x2f,0x2f,0x77,0x77,0x77,0x2e,0x76,
 993 0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x72,0x70,0x61,
 994 0x30,0x31,0x06,0x03,0x55,0x1d,0x1f,0x04,0x2a,0x30,0x28,0x30,0x26,0xa0,0x24,
 995 0xa0,0x22,0x86,0x20,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x63,0x72,0x6c,0x2e,
 996 0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x70,0x63,
 997 0x61,0x33,0x2e,0x63,0x72,0x6c,0x30,0x1d,0x06,0x03,0x55,0x1d,0x25,0x04,0x16,
 998 0x30,0x14,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x03,0x02,0x06,0x08,0x2b,
 999 0x06,0x01,0x05,0x05,0x07,0x03,0x03,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,
1000 0x01,0xff,0x04,0x04,0x03,0x02,0x01,0x06,0x30,0x11,0x06,0x09,0x60,0x86,0x48,
1001 0x01,0x86,0xf8,0x42,0x01,0x01,0x04,0x04,0x03,0x02,0x00,0x01,0x30,0x29,0x06,
1002 0x03,0x55,0x1d,0x11,0x04,0x22,0x30,0x20,0xa4,0x1e,0x30,0x1c,0x31,0x1a,0x30,
1003 0x18,0x06,0x03,0x55,0x04,0x03,0x13,0x11,0x43,0x6c,0x61,0x73,0x73,0x33,0x43,
1004 0x41,0x32,0x30,0x34,0x38,0x2d,0x31,0x2d,0x34,0x33,0x30,0x1d,0x06,0x03,0x55,
1005 0x1d,0x0e,0x04,0x16,0x04,0x14,0x08,0xf5,0x51,0xe8,0xfb,0xfe,0x3d,0x3d,0x64,
1006 0x36,0x7c,0x68,0xcf,0x5b,0x78,0xa8,0xdf,0xb9,0xc5,0x37,0x30,0x81,0x80,0x06,
1007 0x03,0x55,0x1d,0x23,0x04,0x79,0x30,0x77,0xa1,0x63,0xa4,0x61,0x30,0x5f,0x31,
1008 0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x17,0x30,
1009 0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,0x69,0x53,0x69,0x67,
1010 0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x37,0x30,0x35,0x06,0x03,0x55,0x04,
1011 0x0b,0x13,0x2e,0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,0x50,0x75,0x62,0x6c,
1012 0x69,0x63,0x20,0x50,0x72,0x69,0x6d,0x61,0x72,0x79,0x20,0x43,0x65,0x72,0x74,
1013 0x69,0x66,0x69,0x63,0x61,0x74,0x69,0x6f,0x6e,0x20,0x41,0x75,0x74,0x68,0x6f,
1014 0x72,0x69,0x74,0x79,0x82,0x10,0x70,0xba,0xe4,0x1d,0x10,0xd9,0x29,0x34,0xb6,
1015 0x38,0xca,0x7b,0x03,0xcc,0xba,0xbf,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,
1016 0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0xae,0x3a,0x17,0xb8,
1017 0x4a,0x7b,0x55,0xfa,0x64,0x55,0xec,0x40,0xa4,0xed,0x49,0x41,0x90,0x99,0x9c,
1018 0x89,0xbc,0xaf,0x2e,0x1d,0xca,0x78,0x23,0xf9,0x1c,0x19,0x0f,0x7f,0xeb,0x68,
1019 0xbc,0x32,0xd9,0x88,0x38,0xde,0xdc,0x3f,0xd3,0x89,0xb4,0x3f,0xb1,0x82,0x96,
1020 0xf1,0xa4,0x5a,0xba,0xed,0x2e,0x26,0xd3,0xde,0x7c,0x01,0x6e,0x00,0x0a,0x00,
1021 0xa4,0x06,0x92,0x11,0x48,0x09,0x40,0xf9,0x1c,0x18,0x79,0x67,0x23,0x24,0xe0,
1022 0xbb,0xd5,0xe1,0x50,0xae,0x1b,0xf5,0x0e,0xdd,0xe0,0x2e,0x81,0xcd,0x80,0xa3,
1023 0x6c,0x52,0x4f,0x91,0x75,0x55,0x8a,0xba,0x22,0xf2,0xd2,0xea,0x41,0x75,0x88,
1024 0x2f,0x63,0x55,0x7d,0x1e,0x54,0x5a,0x95,0x59,0xca,0xd9,0x34,0x81,0xc0,0x5f,
1025 0x5e,0xf6,0x7a,0xb5 };
1026 static const BYTE iTunesCert3[] = {
1027 0x30,0x82,0x04,0xf1,0x30,0x82,0x03,0xd9,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
1028 0x0f,0x1a,0xa0,0xe0,0x9b,0x9b,0x61,0xa6,0xb6,0xfe,0x40,0xd2,0xdf,0x6a,0xf6,
1029 0x8d,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
1030 0x00,0x30,0x81,0xb4,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,
1031 0x55,0x53,0x31,0x17,0x30,0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,
1032 0x72,0x69,0x53,0x69,0x67,0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x1f,0x30,
1033 0x1d,0x06,0x03,0x55,0x04,0x0b,0x13,0x16,0x56,0x65,0x72,0x69,0x53,0x69,0x67,
1034 0x6e,0x20,0x54,0x72,0x75,0x73,0x74,0x20,0x4e,0x65,0x74,0x77,0x6f,0x72,0x6b,
1035 0x31,0x3b,0x30,0x39,0x06,0x03,0x55,0x04,0x0b,0x13,0x32,0x54,0x65,0x72,0x6d,
1036 0x73,0x20,0x6f,0x66,0x20,0x75,0x73,0x65,0x20,0x61,0x74,0x20,0x68,0x74,0x74,
1037 0x70,0x73,0x3a,0x2f,0x2f,0x77,0x77,0x77,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,
1038 0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x72,0x70,0x61,0x20,0x28,0x63,0x29,0x30,
1039 0x34,0x31,0x2e,0x30,0x2c,0x06,0x03,0x55,0x04,0x03,0x13,0x25,0x56,0x65,0x72,
1040 0x69,0x53,0x69,0x67,0x6e,0x20,0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,0x43,
1041 0x6f,0x64,0x65,0x20,0x53,0x69,0x67,0x6e,0x69,0x6e,0x67,0x20,0x32,0x30,0x30,
1042 0x34,0x20,0x43,0x41,0x30,0x1e,0x17,0x0d,0x30,0x36,0x30,0x31,0x31,0x37,0x30,
1043 0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x38,0x30,0x31,0x32,0x32,0x32,
1044 0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x81,0xb4,0x31,0x0b,0x30,0x09,0x06,0x03,
1045 0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,
1046 0x08,0x13,0x0a,0x43,0x61,0x6c,0x69,0x66,0x6f,0x72,0x6e,0x69,0x61,0x31,0x12,
1047 0x30,0x10,0x06,0x03,0x55,0x04,0x07,0x13,0x09,0x43,0x75,0x70,0x65,0x72,0x74,
1048 0x69,0x6e,0x6f,0x31,0x1d,0x30,0x1b,0x06,0x03,0x55,0x04,0x0a,0x14,0x14,0x41,
1049 0x70,0x70,0x6c,0x65,0x20,0x43,0x6f,0x6d,0x70,0x75,0x74,0x65,0x72,0x2c,0x20,
1050 0x49,0x6e,0x63,0x2e,0x31,0x3e,0x30,0x3c,0x06,0x03,0x55,0x04,0x0b,0x13,0x35,
1051 0x44,0x69,0x67,0x69,0x74,0x61,0x6c,0x20,0x49,0x44,0x20,0x43,0x6c,0x61,0x73,
1052 0x73,0x20,0x33,0x20,0x2d,0x20,0x4d,0x69,0x63,0x72,0x6f,0x73,0x6f,0x66,0x74,
1053 0x20,0x53,0x6f,0x66,0x74,0x77,0x61,0x72,0x65,0x20,0x56,0x61,0x6c,0x69,0x64,
1054 0x61,0x74,0x69,0x6f,0x6e,0x20,0x76,0x32,0x31,0x1d,0x30,0x1b,0x06,0x03,0x55,
1055 0x04,0x03,0x14,0x14,0x41,0x70,0x70,0x6c,0x65,0x20,0x43,0x6f,0x6d,0x70,0x75,
1056 0x74,0x65,0x72,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x30,0x81,0x9f,0x30,0x0d,0x06,
1057 0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,
1058 0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xd3,0xab,0x3b,0x7f,0xec,0x48,0x84,
1059 0xce,0xa8,0x1a,0x12,0xf3,0x3c,0x87,0xcb,0x24,0x58,0x96,0x02,0x87,0x66,0x49,
1060 0xeb,0x89,0xee,0x79,0x44,0x70,0x8d,0xe7,0xd4,0x1f,0x30,0x92,0xc0,0x9c,0x35,
1061 0x78,0xc0,0xaf,0x1c,0xb6,0x28,0xd3,0xe0,0xe0,0x9d,0xd3,0x49,0x76,0x73,0x57,
1062 0x19,0x4d,0x8d,0x70,0x85,0x64,0x4d,0x1d,0xc6,0x02,0x3e,0xe5,0x2c,0x66,0x07,
1063 0xd2,0x27,0x4b,0xd6,0xc8,0x3c,0x93,0xb6,0x15,0x0c,0xde,0x5b,0xd7,0x93,0xdd,
1064 0xbe,0x85,0x62,0x34,0x17,0x8a,0x05,0x60,0xf0,0x8a,0x1c,0x5a,0x40,0x21,0x8d,
1065 0x51,0x6c,0xb0,0x62,0xd8,0xb5,0xd4,0xf9,0xb1,0xd0,0x58,0x7a,0x7a,0x82,0x55,
1066 0xb3,0xf9,0x53,0x71,0xde,0xd2,0xc9,0x37,0x8c,0xf6,0x5a,0x1f,0x2d,0xcd,0x7c,
1067 0x67,0x02,0x03,0x01,0x00,0x01,0xa3,0x82,0x01,0x7f,0x30,0x82,0x01,0x7b,0x30,
1068 0x09,0x06,0x03,0x55,0x1d,0x13,0x04,0x02,0x30,0x00,0x30,0x0e,0x06,0x03,0x55,
1069 0x1d,0x0f,0x01,0x01,0xff,0x04,0x04,0x03,0x02,0x07,0x80,0x30,0x40,0x06,0x03,
1070 0x55,0x1d,0x1f,0x04,0x39,0x30,0x37,0x30,0x35,0xa0,0x33,0xa0,0x31,0x86,0x2f,
1071 0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x43,0x53,0x43,0x33,0x2d,0x32,0x30,0x30,
1072 0x34,0x2d,0x63,0x72,0x6c,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,
1073 0x63,0x6f,0x6d,0x2f,0x43,0x53,0x43,0x33,0x2d,0x32,0x30,0x30,0x34,0x2e,0x63,
1074 0x72,0x6c,0x30,0x44,0x06,0x03,0x55,0x1d,0x20,0x04,0x3d,0x30,0x3b,0x30,0x39,
1075 0x06,0x0b,0x60,0x86,0x48,0x01,0x86,0xf8,0x45,0x01,0x07,0x17,0x03,0x30,0x2a,
1076 0x30,0x28,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x02,0x01,0x16,0x1c,0x68,
1077 0x74,0x74,0x70,0x73,0x3a,0x2f,0x2f,0x77,0x77,0x77,0x2e,0x76,0x65,0x72,0x69,
1078 0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x72,0x70,0x61,0x30,0x13,0x06,
1079 0x03,0x55,0x1d,0x25,0x04,0x0c,0x30,0x0a,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,
1080 0x07,0x03,0x03,0x30,0x75,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x01,0x01,
1081 0x04,0x69,0x30,0x67,0x30,0x24,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x30,
1082 0x01,0x86,0x18,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x6f,0x63,0x73,0x70,0x2e,
1083 0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x30,0x3f,0x06,
1084 0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x30,0x02,0x86,0x33,0x68,0x74,0x74,0x70,
1085 0x3a,0x2f,0x2f,0x43,0x53,0x43,0x33,0x2d,0x32,0x30,0x30,0x34,0x2d,0x61,0x69,
1086 0x61,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,
1087 0x43,0x53,0x43,0x33,0x2d,0x32,0x30,0x30,0x34,0x2d,0x61,0x69,0x61,0x2e,0x63,
1088 0x65,0x72,0x30,0x1f,0x06,0x03,0x55,0x1d,0x23,0x04,0x18,0x30,0x16,0x80,0x14,
1089 0x08,0xf5,0x51,0xe8,0xfb,0xfe,0x3d,0x3d,0x64,0x36,0x7c,0x68,0xcf,0x5b,0x78,
1090 0xa8,0xdf,0xb9,0xc5,0x37,0x30,0x11,0x06,0x09,0x60,0x86,0x48,0x01,0x86,0xf8,
1091 0x42,0x01,0x01,0x04,0x04,0x03,0x02,0x04,0x10,0x30,0x16,0x06,0x0a,0x2b,0x06,
1092 0x01,0x04,0x01,0x82,0x37,0x02,0x01,0x1b,0x04,0x08,0x30,0x06,0x01,0x01,0x00,
1093 0x01,0x01,0xff,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,
1094 0x05,0x05,0x00,0x03,0x82,0x01,0x01,0x00,0x6a,0xa6,0x06,0xd0,0x33,0x18,0x64,
1095 0xe2,0x69,0x82,0xee,0x6e,0x36,0x9e,0x9d,0x9a,0x0e,0x18,0xa8,0xac,0x9d,0x10,
1096 0xed,0x01,0x3c,0xb9,0x61,0x04,0x62,0xf3,0x85,0x8f,0xcc,0x4f,0x2c,0x66,0x35,
1097 0x54,0x25,0x45,0x8d,0x95,0x1c,0xd2,0x33,0xbe,0x2e,0xdd,0x7f,0x74,0xaf,0x03,
1098 0x7b,0x86,0x63,0xb0,0xc9,0xe6,0xbd,0xc7,0x8e,0xde,0x03,0x18,0x98,0x82,0xc3,
1099 0xbb,0xf8,0x15,0x99,0x1a,0xa9,0xdd,0xb9,0x5d,0xb9,0xbd,0x53,0x95,0x25,0x76,
1100 0xfb,0x5c,0x53,0x90,0xea,0x01,0x0a,0xa0,0xb1,0xbf,0x09,0x1b,0x97,0x8f,0x40,
1101 0xfa,0x85,0x12,0x74,0x01,0xdb,0xf6,0xdb,0x09,0xd6,0x5f,0x4f,0xd7,0x17,0xb4,
1102 0xbf,0x9e,0x2f,0x86,0x52,0x5d,0x70,0x24,0x52,0x32,0x1e,0xa5,0x1d,0x39,0x8b,
1103 0x66,0xf6,0xba,0x9b,0x69,0x8e,0x12,0x60,0xdb,0xb6,0xcf,0xe6,0x0d,0xd6,0x1c,
1104 0x8f,0xd4,0x5b,0x4b,0x00,0xde,0x21,0x93,0xfb,0x6e,0xc7,0x3d,0xb4,0x66,0x0d,
1105 0x29,0x0c,0x4e,0xe9,0x3f,0x94,0xd6,0xd6,0xdc,0xec,0xf8,0x53,0x3b,0x62,0xd5,
1106 0x97,0x50,0x53,0x84,0x17,0xfe,0xe2,0xed,0x4c,0x23,0x0a,0x49,0xce,0x5b,0xe9,
1107 0x70,0x31,0xc1,0x04,0x02,0x02,0x6c,0xb8,0x52,0xcd,0xc7,0x4e,0x70,0xb4,0x13,
1108 0xd7,0xe0,0x92,0xba,0x44,0x1a,0x10,0x4c,0x6e,0x45,0xc6,0x86,0x04,0xc6,0x64,
1109 0xd3,0x9c,0x6e,0xc1,0x9c,0xac,0x74,0x3d,0x77,0x06,0x5e,0x28,0x28,0x5c,0xf5,
1110 0xe0,0x9c,0x19,0xd8,0xba,0x74,0x81,0x2d,0x67,0x77,0x93,0x8d,0xbf,0xd2,0x52,
1111 0x00,0xe6,0xa5,0x38,0x4e,0x2e,0x73,0x66,0x7a };
1112 static BYTE iTunesIssuer[] = {
1113 0x30,0x81,0xb4,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,
1114 0x13,0x02,0x55,0x53,0x31,0x17,0x30,0x15,0x06,0x03,0x55,0x04,
1115 0x0a,0x13,0x0e,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x2c,
1116 0x20,0x49,0x6e,0x63,0x2e,0x31,0x1f,0x30,0x1d,0x06,0x03,0x55,
1117 0x04,0x0b,0x13,0x16,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,
1118 0x20,0x54,0x72,0x75,0x73,0x74,0x20,0x4e,0x65,0x74,0x77,0x6f,
1119 0x72,0x6b,0x31,0x3b,0x30,0x39,0x06,0x03,0x55,0x04,0x0b,0x13,
1120 0x32,0x54,0x65,0x72,0x6d,0x73,0x20,0x6f,0x66,0x20,0x75,0x73,
1121 0x65,0x20,0x61,0x74,0x20,0x68,0x74,0x74,0x70,0x73,0x3a,0x2f,
1122 0x2f,0x77,0x77,0x77,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,
1123 0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x72,0x70,0x61,0x20,0x28,0x63,
1124 0x29,0x30,0x34,0x31,0x2e,0x30,0x2c,0x06,0x03,0x55,0x04,0x03,
1125 0x13,0x25,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x20,0x43,
1126 0x6c,0x61,0x73,0x73,0x20,0x33,0x20,0x43,0x6f,0x64,0x65,0x20,
1127 0x53,0x69,0x67,0x6e,0x69,0x6e,0x67,0x20,0x32,0x30,0x30,0x34,
1128 0x20,0x43,0x41 };
1129 static BYTE iTunesSerialNum[] = {
1130 0x8d,0xf6,0x6a,0xdf,0xd2,0x40,0xfe,0xb6,0xa6,0x61,0x9b,0x9b,
1131 0xe0,0xa0,0x1a,0x0f };
1132
1133 static void testFindCert(void)
1134 {
1135     HCERTSTORE store;
1136     PCCERT_CONTEXT context = NULL, subject;
1137     BOOL ret;
1138     CERT_INFO certInfo = { 0 };
1139     CRYPT_HASH_BLOB blob;
1140     BYTE otherSerialNumber[] = { 2 };
1141     DWORD count;
1142     static const WCHAR juan[] = { 'j','u','a','n',0 };
1143     static const WCHAR lang[] = { 'L','A','N','G',0 };
1144     static const WCHAR malcolm[] = { 'm','a','l','c','o','l','m',0 };
1145
1146     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1147      CERT_STORE_CREATE_NEW_FLAG, NULL);
1148     ok(store != NULL, "CertOpenStore failed: %d\n", GetLastError());
1149     if (!store)
1150         return;
1151
1152     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1153      bigCert, sizeof(bigCert), CERT_STORE_ADD_NEW, NULL);
1154     ok(ret || broken(GetLastError() == OSS_DATA_ERROR /* win98 */),
1155      "CertAddEncodedCertificateToStore failed: %08x\n", GetLastError());
1156     if (!ret && GetLastError() == OSS_DATA_ERROR)
1157     {
1158         skip("bigCert can't be decoded, skipping tests\n");
1159         return;
1160     }
1161     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1162      bigCert2, sizeof(bigCert2), CERT_STORE_ADD_NEW, NULL);
1163     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1164      GetLastError());
1165     /* This has the same name as bigCert */
1166     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1167      certWithUsage, sizeof(certWithUsage), CERT_STORE_ADD_NEW, NULL);
1168     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1169      GetLastError());
1170
1171     /* Crashes
1172     context = CertFindCertificateInStore(NULL, 0, 0, 0, NULL, NULL);
1173      */
1174
1175     /* Check first cert's there, by issuer */
1176     certInfo.Subject.pbData = subjectName;
1177     certInfo.Subject.cbData = sizeof(subjectName);
1178     certInfo.SerialNumber.pbData = serialNum;
1179     certInfo.SerialNumber.cbData = sizeof(serialNum);
1180     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1181      CERT_FIND_ISSUER_NAME, &certInfo.Subject, NULL);
1182     ok(context != NULL, "CertFindCertificateInStore failed: %08x\n",
1183      GetLastError());
1184     if (context)
1185     {
1186         context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1187          CERT_FIND_ISSUER_NAME, &certInfo.Subject, context);
1188         ok(context != NULL, "Expected more than one cert\n");
1189         if (context)
1190         {
1191             context = CertFindCertificateInStore(store, X509_ASN_ENCODING,
1192              0, CERT_FIND_ISSUER_NAME, &certInfo.Subject, context);
1193             ok(context == NULL, "Expected precisely two certs\n");
1194         }
1195     }
1196
1197     /* Check second cert's there as well, by subject name */
1198     certInfo.Subject.pbData = subjectName2;
1199     certInfo.Subject.cbData = sizeof(subjectName2);
1200     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1201      CERT_FIND_SUBJECT_NAME, &certInfo.Subject, NULL);
1202     ok(context != NULL, "CertFindCertificateInStore failed: %08x\n",
1203      GetLastError());
1204     if (context)
1205     {
1206         context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1207          CERT_FIND_SUBJECT_NAME, &certInfo.Subject, context);
1208         ok(context == NULL, "Expected one cert only\n");
1209     }
1210
1211     /* Strange but true: searching for the subject cert requires you to set
1212      * the issuer, not the subject
1213      */
1214     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1215      CERT_FIND_SUBJECT_CERT, &certInfo, NULL);
1216     ok(context == NULL, "Expected no certificate\n");
1217     certInfo.Subject.pbData = NULL;
1218     certInfo.Subject.cbData = 0;
1219     certInfo.Issuer.pbData = subjectName2;
1220     certInfo.Issuer.cbData = sizeof(subjectName2);
1221     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1222      CERT_FIND_SUBJECT_CERT, &certInfo, NULL);
1223     ok(context != NULL, "CertFindCertificateInStore failed: %08x\n",
1224      GetLastError());
1225     if (context)
1226     {
1227         context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1228          CERT_FIND_SUBJECT_CERT, &certInfo, context);
1229         ok(context == NULL, "Expected one cert only\n");
1230     }
1231     /* A non-matching serial number will not match. */
1232     certInfo.SerialNumber.pbData = otherSerialNumber;
1233     certInfo.SerialNumber.cbData = sizeof(otherSerialNumber);
1234     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1235      CERT_FIND_SUBJECT_CERT, &certInfo, NULL);
1236     ok(context == NULL, "Expected no match\n");
1237     /* No serial number will not match */
1238     certInfo.SerialNumber.cbData = 0;
1239     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1240      CERT_FIND_SUBJECT_CERT, &certInfo, NULL);
1241     ok(context == NULL, "Expected no match\n");
1242     /* A serial number still won't match if the name doesn't */
1243     certInfo.SerialNumber.pbData = serialNum;
1244     certInfo.SerialNumber.cbData = sizeof(serialNum);
1245     certInfo.Issuer.pbData = subjectName3;
1246     certInfo.Issuer.cbData = sizeof(subjectName3);
1247     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1248      CERT_FIND_SUBJECT_CERT, &certInfo, NULL);
1249     ok(context == NULL, "Expected no match\n");
1250
1251     /* The nice thing about hashes, they're unique */
1252     blob.pbData = bigCertHash;
1253     blob.cbData = sizeof(bigCertHash);
1254     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1255      CERT_FIND_SHA1_HASH, &blob, NULL);
1256     ok(context != NULL, "CertFindCertificateInStore failed: %08x\n",
1257      GetLastError());
1258     if (context)
1259     {
1260         context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1261          CERT_FIND_SHA1_HASH, &certInfo.Subject, context);
1262         ok(context == NULL, "Expected one cert only\n");
1263     }
1264
1265     /* Searching for NULL string matches any context. */
1266     count = 0;
1267     context = NULL;
1268     do {
1269         context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1270          CERT_FIND_ISSUER_STR, NULL, context);
1271         if (context)
1272             count++;
1273     } while (context);
1274     ok(count == 3, "expected 3 contexts\n");
1275     count = 0;
1276     context = NULL;
1277     do {
1278         context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1279          CERT_FIND_ISSUER_STR, juan, context);
1280         if (context)
1281             count++;
1282     } while (context);
1283     ok(count == 2, "expected 2 contexts\n");
1284     count = 0;
1285     context = NULL;
1286     do {
1287         context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1288          CERT_FIND_ISSUER_STR, lang, context);
1289         if (context)
1290             count++;
1291     } while (context);
1292     ok(count == 3, "expected 3 contexts\n");
1293     SetLastError(0xdeadbeef);
1294     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1295      CERT_FIND_ISSUER_STR, malcolm, NULL);
1296     ok(!context, "expected no certs\n");
1297     ok(GetLastError() == CRYPT_E_NOT_FOUND,
1298      "expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
1299
1300     CertCloseStore(store, 0);
1301
1302     /* Another subject cert search, using iTunes's certs */
1303     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1304      CERT_STORE_CREATE_NEW_FLAG, NULL);
1305     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1306      iTunesCert0, sizeof(iTunesCert0), CERT_STORE_ADD_NEW, NULL);
1307     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1308      GetLastError());
1309     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1310      iTunesCert1, sizeof(iTunesCert1), CERT_STORE_ADD_NEW, NULL);
1311     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1312      GetLastError());
1313     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1314      iTunesCert2, sizeof(iTunesCert2), CERT_STORE_ADD_NEW, NULL);
1315     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1316      GetLastError());
1317     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1318      iTunesCert3, sizeof(iTunesCert3), CERT_STORE_ADD_NEW, &subject);
1319     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1320      GetLastError());
1321
1322     /* The certInfo's issuer does not match any subject, but the serial
1323      * number does match a cert whose issuer matches certInfo's issuer.
1324      * This yields a match.
1325      */
1326     certInfo.SerialNumber.cbData = sizeof(iTunesSerialNum);
1327     certInfo.SerialNumber.pbData = iTunesSerialNum;
1328     certInfo.Issuer.cbData = sizeof(iTunesIssuer);
1329     certInfo.Issuer.pbData = iTunesIssuer;
1330     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1331      CERT_FIND_SUBJECT_CERT, &certInfo, NULL);
1332     ok(context != NULL, "Expected a match\n");
1333     if (context)
1334     {
1335         ret = CertCompareCertificateName(context->dwCertEncodingType,
1336          &certInfo.Issuer, &context->pCertInfo->Subject);
1337         ok(!ret, "Expected subject name not to match\n");
1338         ret = CertCompareCertificateName(context->dwCertEncodingType,
1339          &certInfo.Issuer, &context->pCertInfo->Issuer);
1340         ok(ret, "Expected issuer name to match\n");
1341         ret = CertCompareIntegerBlob(&certInfo.SerialNumber,
1342          &context->pCertInfo->SerialNumber);
1343         ok(ret, "Expected serial number to match\n");
1344         context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1345          CERT_FIND_SUBJECT_CERT, &certInfo, context);
1346         ok(context == NULL, "Expected one cert only\n");
1347     }
1348
1349     context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
1350      CERT_FIND_ISSUER_OF, subject, NULL);
1351     ok(context != NULL, "Expected an issuer\n");
1352     if (context)
1353     {
1354         PCCERT_CONTEXT none = CertFindCertificateInStore(store,
1355          X509_ASN_ENCODING, 0, CERT_FIND_ISSUER_OF, context, NULL);
1356
1357         ok(!none, "Expected no parent of issuer\n");
1358         CertFreeCertificateContext(context);
1359     }
1360     CertFreeCertificateContext(subject);
1361     CertCloseStore(store, 0);
1362 }
1363
1364 static void testGetSubjectCert(void)
1365 {
1366     HCERTSTORE store;
1367     PCCERT_CONTEXT context1, context2;
1368     CERT_INFO info = { 0 };
1369     BOOL ret;
1370
1371     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1372      CERT_STORE_CREATE_NEW_FLAG, NULL);
1373     ok(store != NULL, "CertOpenStore failed: %d\n", GetLastError());
1374     if (!store)
1375         return;
1376
1377     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1378      bigCert, sizeof(bigCert), CERT_STORE_ADD_ALWAYS, NULL);
1379     ok(ret || broken(GetLastError() == OSS_DATA_ERROR /* win98 */),
1380      "CertAddEncodedCertificateToStore failed: %08x\n", GetLastError());
1381     if (!ret && GetLastError() == OSS_DATA_ERROR)
1382     {
1383         skip("bigCert can't be decoded, skipping tests\n");
1384         return;
1385     }
1386     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1387      bigCert2, sizeof(bigCert2), CERT_STORE_ADD_NEW, &context1);
1388     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1389      GetLastError());
1390     ok(context1 != NULL, "Expected a context\n");
1391     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1392      certWithUsage, sizeof(certWithUsage), CERT_STORE_ADD_NEW, NULL);
1393     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1394      GetLastError());
1395
1396     context2 = CertGetSubjectCertificateFromStore(store, X509_ASN_ENCODING,
1397      NULL);
1398     ok(!context2 && GetLastError() == E_INVALIDARG,
1399      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1400     context2 = CertGetSubjectCertificateFromStore(store, X509_ASN_ENCODING,
1401      &info);
1402     ok(!context2 && GetLastError() == CRYPT_E_NOT_FOUND,
1403      "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
1404     info.SerialNumber.cbData = sizeof(serialNum);
1405     info.SerialNumber.pbData = serialNum;
1406     context2 = CertGetSubjectCertificateFromStore(store, X509_ASN_ENCODING,
1407      &info);
1408     ok(!context2 && GetLastError() == CRYPT_E_NOT_FOUND,
1409      "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
1410     info.Issuer.cbData = sizeof(subjectName2);
1411     info.Issuer.pbData = subjectName2;
1412     context2 = CertGetSubjectCertificateFromStore(store, X509_ASN_ENCODING,
1413      &info);
1414     ok(context2 != NULL,
1415      "CertGetSubjectCertificateFromStore failed: %08x\n", GetLastError());
1416     /* Not only should this find a context, but it should be the same
1417      * (same address) as context1.
1418      */
1419     ok(context1 == context2, "Expected identical context addresses\n");
1420     CertFreeCertificateContext(context2);
1421
1422     CertFreeCertificateContext(context1);
1423     CertCloseStore(store, 0);
1424 }
1425
1426 /* This expires in 1970 or so */
1427 static const BYTE expiredCert[] = { 0x30, 0x82, 0x01, 0x33, 0x30, 0x81, 0xe2,
1428  0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x10, 0xc4, 0xd7, 0x7f, 0x0e, 0x6f, 0xa6,
1429  0x8c, 0xaa, 0x47, 0x47, 0x40, 0xe7, 0xb7, 0x0b, 0x4a, 0x7f, 0x30, 0x09, 0x06,
1430  0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1d, 0x05, 0x00, 0x30, 0x1f, 0x31, 0x1d, 0x30,
1431  0x1b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x14, 0x61, 0x72, 0x69, 0x63, 0x40,
1432  0x63, 0x6f, 0x64, 0x65, 0x77, 0x65, 0x61, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x63,
1433  0x6f, 0x6d, 0x30, 0x1e, 0x17, 0x0d, 0x36, 0x39, 0x30, 0x31, 0x30, 0x31, 0x30,
1434  0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x37, 0x30, 0x30, 0x31, 0x30,
1435  0x31, 0x30, 0x36, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x1f, 0x31, 0x1d, 0x30,
1436  0x1b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x14, 0x61, 0x72, 0x69, 0x63, 0x40,
1437  0x63, 0x6f, 0x64, 0x65, 0x77, 0x65, 0x61, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x63,
1438  0x6f, 0x6d, 0x30, 0x5c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
1439  0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x4b, 0x00, 0x30, 0x48, 0x02, 0x41,
1440  0x00, 0xa1, 0xaf, 0x4a, 0xea, 0xa7, 0x83, 0x57, 0xc0, 0x37, 0x33, 0x7e, 0x29,
1441  0x5e, 0x0d, 0xfc, 0x44, 0x74, 0x3a, 0x1d, 0xc3, 0x1b, 0x1d, 0x96, 0xed, 0x4e,
1442  0xf4, 0x1b, 0x98, 0xec, 0x69, 0x1b, 0x04, 0xea, 0x25, 0xcf, 0xb3, 0x2a, 0xf5,
1443  0xd9, 0x22, 0xd9, 0x8d, 0x08, 0x39, 0x81, 0xc6, 0xe0, 0x4f, 0x12, 0x37, 0x2a,
1444  0x3f, 0x80, 0xa6, 0x6c, 0x67, 0x43, 0x3a, 0xdd, 0x95, 0x0c, 0xbb, 0x2f, 0x6b,
1445  0x02, 0x03, 0x01, 0x00, 0x01, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02,
1446  0x1d, 0x05, 0x00, 0x03, 0x41, 0x00, 0x8f, 0xa2, 0x5b, 0xd6, 0xdf, 0x34, 0xd0,
1447  0xa2, 0xa7, 0x47, 0xf1, 0x13, 0x79, 0xd3, 0xf3, 0x39, 0xbd, 0x4e, 0x2b, 0xa3,
1448  0xf4, 0x63, 0x37, 0xac, 0x5a, 0x0c, 0x5e, 0x4d, 0x0d, 0x54, 0x87, 0x4f, 0x31,
1449  0xfb, 0xa0, 0xce, 0x8f, 0x9a, 0x2f, 0x4d, 0x48, 0xc6, 0x84, 0x8d, 0xf5, 0x70,
1450  0x74, 0x17, 0xa5, 0xf3, 0x66, 0x47, 0x06, 0xd6, 0x64, 0x45, 0xbc, 0x52, 0xef,
1451  0x49, 0xe5, 0xf9, 0x65, 0xf3 };
1452
1453 /* This expires in 2036 or so */
1454 static const BYTE childOfExpired[] = { 0x30, 0x81, 0xcc, 0x30, 0x78, 0xa0,
1455  0x03, 0x02, 0x01, 0x02, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86,
1456  0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x1f, 0x31, 0x1d,
1457  0x30, 0x1b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x14, 0x61, 0x72, 0x69, 0x63,
1458  0x40, 0x63, 0x6f, 0x64, 0x65, 0x77, 0x65, 0x61, 0x76, 0x65, 0x72, 0x73, 0x2e,
1459  0x63, 0x6f, 0x6d, 0x30, 0x1e, 0x17, 0x0d, 0x30, 0x36, 0x30, 0x35, 0x30, 0x35,
1460  0x31, 0x37, 0x31, 0x32, 0x34, 0x39, 0x5a, 0x17, 0x0d, 0x33, 0x36, 0x30, 0x35,
1461  0x30, 0x35, 0x31, 0x37, 0x31, 0x32, 0x34, 0x39, 0x5a, 0x30, 0x15, 0x31, 0x13,
1462  0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e,
1463  0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03,
1464  0x01, 0x00, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
1465  0x01, 0x05, 0x05, 0x00, 0x03, 0x41, 0x00, 0x20, 0x3b, 0xdb, 0x4d, 0x67, 0x50,
1466  0xec, 0x73, 0x9d, 0xf9, 0x85, 0x5d, 0x18, 0xe9, 0xb4, 0x98, 0xe3, 0x31, 0xb7,
1467  0x03, 0x0b, 0xc0, 0x39, 0x93, 0x56, 0x81, 0x0a, 0xfc, 0x78, 0xa8, 0x29, 0x42,
1468  0x5f, 0x69, 0xfb, 0xbc, 0x5b, 0xf2, 0xa6, 0x2a, 0xbe, 0x91, 0x2c, 0xfc, 0x89,
1469  0x69, 0x15, 0x18, 0x58, 0xe5, 0x02, 0x75, 0xf7, 0x2a, 0xb6, 0xa9, 0xfb, 0x47,
1470  0x6a, 0x6e, 0x0a, 0x9b, 0xe9, 0xdc };
1471 /* chain10_0 -+
1472  *            +-> chain7_1
1473  * chain10_1 -+
1474  * A chain with two issuers, only one of whose dates is valid.
1475  */
1476 static const BYTE chain10_0[] = {
1477 0x30,0x82,0x01,0x9b,0x30,0x82,0x01,0x08,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
1478 0x4a,0x30,0x3a,0x42,0xa2,0x5a,0xb3,0x93,0x4d,0x94,0x06,0xad,0x6d,0x1c,0x34,
1479 0xe6,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
1480 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
1481 0x30,0x1e,0x17,0x0d,0x30,0x36,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
1482 0x30,0x5a,0x17,0x0d,0x30,0x36,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
1483 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
1484 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
1485 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
1486 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
1487 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
1488 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
1489 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
1490 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
1491 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
1492 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
1493 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
1494 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
1495 0x00,0x01,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x81,
1496 0x81,0x00,0x85,0x6e,0x35,0x2f,0x2c,0x51,0x4f,0xd6,0x2a,0xe4,0x9e,0xd0,0x4b,
1497 0xe6,0x90,0xfd,0xf7,0x20,0xad,0x76,0x3f,0x93,0xea,0x7f,0x0d,0x1f,0xb3,0x8e,
1498 0xfd,0xe0,0xe1,0xd6,0xd7,0x9c,0x7d,0x46,0x6b,0x15,0x5c,0xe6,0xc9,0x62,0x3b,
1499 0x70,0x4a,0x4b,0xb2,0x82,0xe3,0x55,0x0c,0xc4,0x90,0x44,0x06,0x6c,0x86,0x1c,
1500 0x6d,0x47,0x12,0xda,0x33,0x95,0x5d,0x98,0x43,0xcb,0x7c,0xfa,0x2b,0xee,0xc4,
1501 0x2d,0xc8,0x95,0x33,0x89,0x08,0x3f,0x9f,0x87,0xea,0x20,0x04,0xaf,0x58,0x4b,
1502 0x9d,0xc0,0x7c,0x0a,0x1b,0x05,0x31,0x3b,0xbb,0x13,0x58,0x2e,0x3f,0x61,0x6b,
1503 0x10,0xb4,0xeb,0xb9,0x1a,0x30,0xfd,0xea,0xca,0x29,0x99,0x5f,0x42,0x2b,0x00,
1504 0xb0,0x08,0xc3,0xf0,0xb6,0xd6,0x6b,0xf9,0x35,0x95 };
1505 static const BYTE chain10_1[] = {
1506 0x30,0x82,0x01,0x9b,0x30,0x82,0x01,0x08,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
1507 0xbf,0x99,0x4f,0x14,0x03,0x77,0x44,0xb8,0x49,0x02,0x70,0xa1,0xb8,0x9c,0xa7,
1508 0x24,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
1509 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
1510 0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
1511 0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
1512 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
1513 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
1514 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
1515 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
1516 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
1517 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
1518 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
1519 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
1520 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
1521 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
1522 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
1523 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
1524 0x00,0x01,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x81,
1525 0x81,0x00,0xa8,0xec,0x8c,0x34,0xe7,0x2c,0xdf,0x75,0x87,0xc4,0xf7,0xda,0x71,
1526 0x72,0x29,0xb2,0x48,0xa8,0x2a,0xec,0x7b,0x7d,0x19,0xb9,0x5f,0x1d,0xd9,0x91,
1527 0x2b,0xc4,0x28,0x7e,0xd6,0xb5,0x91,0x69,0xa5,0x8a,0x1a,0x1f,0x97,0x98,0x46,
1528 0x9d,0xdf,0x12,0xf6,0x45,0x62,0xad,0x60,0xb6,0xba,0xb0,0xfd,0xf5,0x9f,0xc6,
1529 0x98,0x05,0x4f,0x4d,0x48,0xdc,0xee,0x69,0xbe,0xb8,0xc4,0xc4,0xd7,0x1b,0xb1,
1530 0x1f,0x64,0xd6,0x45,0xa7,0xdb,0xb3,0x87,0x63,0x0f,0x54,0xe1,0x3a,0x6b,0x57,
1531 0x36,0xd7,0x68,0x65,0xcf,0xda,0x57,0x8d,0xcd,0x84,0x75,0x47,0x26,0x2c,0xef,
1532 0x1e,0x8f,0xc7,0x3b,0xee,0x5d,0x03,0xa6,0xdf,0x3a,0x20,0xb2,0xcc,0xc9,0x09,
1533 0x2c,0xfe,0x2b,0x79,0xb0,0xca,0x2c,0x9a,0x81,0x6b };
1534 static const BYTE chain7_1[] = {
1535 0x30,0x82,0x01,0x93,0x30,0x81,0xfd,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
1536 0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,
1537 0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,
1538 0x72,0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,
1539 0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,
1540 0x35,0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,
1541 0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,
1542 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,
1543 0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,0x33,
1544 0x0e,0x67,0x5f,0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,0xdc,
1545 0xb6,0x17,0x8e,0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,0x48,
1546 0x9f,0x6e,0xfe,0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,0x47,
1547 0xd1,0x57,0x71,0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,0x05,
1548 0x72,0xa7,0x87,0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,0x6a,
1549 0x80,0x83,0x68,0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,0x85,
1550 0xb5,0x46,0x36,0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,0xd3,
1551 0x51,0x9a,0x22,0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,0xa3,
1552 0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,
1553 0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0x9f,0x69,0xfd,0x26,0xd5,0x4b,
1554 0xe0,0xab,0x12,0x21,0xb9,0xfc,0xf7,0xe0,0x0c,0x09,0x94,0xad,0x27,0xd7,0x9d,
1555 0xa3,0xcc,0x46,0x2a,0x25,0x9a,0x24,0xa7,0x31,0x58,0x78,0xf5,0xfc,0x30,0xe1,
1556 0x6d,0xfd,0x59,0xab,0xbe,0x69,0xa0,0xea,0xe3,0x7d,0x7a,0x7b,0xe5,0x85,0xeb,
1557 0x86,0x6a,0x84,0x3c,0x96,0x01,0x1a,0x70,0xa7,0xb8,0xcb,0xf2,0x11,0xe7,0x52,
1558 0x9c,0x58,0x2d,0xac,0x63,0xce,0x72,0x4b,0xad,0x62,0xa8,0x1d,0x75,0x96,0xe2,
1559 0x27,0xf5,0x6f,0xba,0x91,0xf8,0xf1,0xb0,0xbf,0x90,0x24,0x6d,0xba,0x5d,0xd7,
1560 0x39,0x63,0x3b,0x7c,0x04,0x5d,0x89,0x9d,0x1c,0xf2,0xf7,0xcc,0xdf,0x6e,0x8a,
1561 0x43,0xa9,0xdd,0x86,0x05,0xa2,0xf3,0x22,0x2d,0x1e,0x70,0xa1,0x59,0xd7,0xa5,
1562 0x94,0x7d };
1563
1564 static void testGetIssuerCert(void)
1565 {
1566     BOOL ret;
1567     PCCERT_CONTEXT parent, child, cert1, cert2;
1568     DWORD flags = 0xffffffff;
1569     HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1570      CERT_STORE_CREATE_NEW_FLAG, NULL);
1571
1572     ok(store != NULL, "CertOpenStore failed: %08x\n", GetLastError());
1573
1574     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1575      expiredCert, sizeof(expiredCert), CERT_STORE_ADD_ALWAYS, NULL);
1576     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1577      GetLastError());
1578
1579     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1580      childOfExpired, sizeof(childOfExpired), CERT_STORE_ADD_ALWAYS, &child);
1581     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
1582      GetLastError());
1583
1584     /* These crash:
1585     parent = CertGetIssuerCertificateFromStore(NULL, NULL, NULL, NULL);
1586     parent = CertGetIssuerCertificateFromStore(store, NULL, NULL, NULL);
1587      */
1588     parent = CertGetIssuerCertificateFromStore(NULL, NULL, NULL, &flags);
1589     ok(!parent && GetLastError() == E_INVALIDARG,
1590      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1591     parent = CertGetIssuerCertificateFromStore(store, NULL, NULL, &flags);
1592     ok(!parent && GetLastError() == E_INVALIDARG,
1593      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1594     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1595     ok(!parent && GetLastError() == E_INVALIDARG,
1596      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1597     /* Confusing: the caller cannot set either of the
1598      * CERT_STORE_NO_*_FLAGs, as these are not checks,
1599      * they're results:
1600      */
1601     flags = CERT_STORE_NO_CRL_FLAG | CERT_STORE_NO_ISSUER_FLAG;
1602     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1603     ok(!parent && GetLastError() == E_INVALIDARG,
1604      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1605     /* Perform no checks */
1606     flags = 0;
1607     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1608     ok(parent != NULL, "CertGetIssuerCertificateFromStore failed: %08x\n",
1609      GetLastError());
1610     if (parent)
1611         CertFreeCertificateContext(parent);
1612     /* Check revocation and signature only */
1613     flags = CERT_STORE_REVOCATION_FLAG | CERT_STORE_SIGNATURE_FLAG;
1614     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1615     ok(parent != NULL, "CertGetIssuerCertificateFromStore failed: %08x\n",
1616      GetLastError());
1617     /* Confusing: CERT_STORE_REVOCATION_FLAG succeeds when there is no CRL by
1618      * setting CERT_STORE_NO_CRL_FLAG.
1619      */
1620     ok(flags == (CERT_STORE_REVOCATION_FLAG | CERT_STORE_NO_CRL_FLAG),
1621      "Expected CERT_STORE_REVOCATION_FLAG | CERT_STORE_NO_CRL_FLAG, got %08x\n",
1622      flags);
1623     if (parent)
1624         CertFreeCertificateContext(parent);
1625     /* Checking time validity is not productive, because while most Windows
1626      * versions return 0 (time valid) because the child is not expired,
1627      * Windows 2003 SP1 returns that it is expired.  Thus the range of
1628      * possibilities is covered, and a test verifies nothing.
1629      */
1630
1631     CertFreeCertificateContext(child);
1632     CertCloseStore(store, 0);
1633
1634     flags = 0;
1635     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1636      CERT_STORE_CREATE_NEW_FLAG, NULL);
1637     /* With only the child certificate, no issuer will be found */
1638     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1639      chain7_1, sizeof(chain7_1), CERT_STORE_ADD_ALWAYS, &child);
1640     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n", GetLastError());
1641     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1642     ok(parent == NULL, "Expected no issuer\n");
1643     /* Adding an issuer allows one (and only one) issuer to be found */
1644     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1645      chain10_1, sizeof(chain10_1), CERT_STORE_ADD_ALWAYS, &cert1);
1646     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n", GetLastError());
1647     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1648     ok(parent == cert1, "Expected cert1 to be the issuer\n");
1649     parent = CertGetIssuerCertificateFromStore(store, child, parent, &flags);
1650     ok(parent == NULL, "Expected only one issuer\n");
1651     /* Adding a second issuer allows two issuers to be found - and the second
1652      * issuer is found before the first, implying certs are added to the head
1653      * of a list.
1654      */
1655     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1656      chain10_0, sizeof(chain10_0), CERT_STORE_ADD_ALWAYS, &cert2);
1657     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n", GetLastError());
1658     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1659     ok(parent == cert2, "Expected cert2 to be the first issuer\n");
1660     parent = CertGetIssuerCertificateFromStore(store, child, parent, &flags);
1661     ok(parent == cert1, "Expected cert1 to be the second issuer\n");
1662     parent = CertGetIssuerCertificateFromStore(store, child, parent, &flags);
1663     ok(parent == NULL, "Expected no more than two issuers\n");
1664     CertFreeCertificateContext(child);
1665     CertFreeCertificateContext(cert1);
1666     CertFreeCertificateContext(cert2);
1667     CertCloseStore(store, 0);
1668
1669     /* Repeat the test, reversing the order in which issuers are added,
1670      * to show it's order-dependent.
1671      */
1672     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1673      CERT_STORE_CREATE_NEW_FLAG, NULL);
1674     /* With only the child certificate, no issuer will be found */
1675     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1676      chain7_1, sizeof(chain7_1), CERT_STORE_ADD_ALWAYS, &child);
1677     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n", GetLastError());
1678     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1679     ok(parent == NULL, "Expected no issuer\n");
1680     /* Adding an issuer allows one (and only one) issuer to be found */
1681     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1682      chain10_0, sizeof(chain10_0), CERT_STORE_ADD_ALWAYS, &cert1);
1683     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n", GetLastError());
1684     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1685     ok(parent == cert1, "Expected cert1 to be the issuer\n");
1686     parent = CertGetIssuerCertificateFromStore(store, child, parent, &flags);
1687     ok(parent == NULL, "Expected only one issuer\n");
1688     /* Adding a second issuer allows two issuers to be found - and the second
1689      * issuer is found before the first, implying certs are added to the head
1690      * of a list.
1691      */
1692     ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
1693      chain10_1, sizeof(chain10_1), CERT_STORE_ADD_ALWAYS, &cert2);
1694     ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n", GetLastError());
1695     parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
1696     ok(parent == cert2, "Expected cert2 to be the first issuer\n");
1697     parent = CertGetIssuerCertificateFromStore(store, child, parent, &flags);
1698     ok(parent == cert1, "Expected cert1 to be the second issuer\n");
1699     parent = CertGetIssuerCertificateFromStore(store, child, parent, &flags);
1700     ok(parent == NULL, "Expected no more than two issuers\n");
1701     CertFreeCertificateContext(child);
1702     CertFreeCertificateContext(cert1);
1703     CertFreeCertificateContext(cert2);
1704     CertCloseStore(store, 0);
1705 }
1706
1707 static void testCryptHashCert(void)
1708 {
1709     static const BYTE emptyHash[] = { 0xda, 0x39, 0xa3, 0xee, 0x5e, 0x6b, 0x4b,
1710      0x0d, 0x32, 0x55, 0xbf, 0xef, 0x95, 0x60, 0x18, 0x90, 0xaf, 0xd8, 0x07,
1711      0x09 };
1712     static const BYTE knownHash[] = { 0xae, 0x9d, 0xbf, 0x6d, 0xf5, 0x46, 0xee,
1713      0x8b, 0xc5, 0x7a, 0x13, 0xba, 0xc2, 0xb1, 0x04, 0xf2, 0xbf, 0x52, 0xa8,
1714      0xa2 };
1715     static const BYTE toHash[] = "abcdefghijklmnopqrstuvwxyz0123456789.,;!?:";
1716     BOOL ret;
1717     BYTE hash[20];
1718     DWORD hashLen = sizeof(hash);
1719
1720     /* NULL buffer and nonzero length crashes
1721     ret = CryptHashCertificate(0, 0, 0, NULL, size, hash, &hashLen);
1722        empty hash length also crashes
1723     ret = CryptHashCertificate(0, 0, 0, buf, size, hash, NULL);
1724      */
1725     /* Test empty hash */
1726     ret = CryptHashCertificate(0, 0, 0, toHash, sizeof(toHash), NULL,
1727      &hashLen);
1728     ok(ret, "CryptHashCertificate failed: %08x\n", GetLastError());
1729     ok(hashLen == sizeof(hash), "Got unexpected size of hash %d\n", hashLen);
1730     /* Test with empty buffer */
1731     ret = CryptHashCertificate(0, 0, 0, NULL, 0, hash, &hashLen);
1732     ok(ret, "CryptHashCertificate failed: %08x\n", GetLastError());
1733     ok(!memcmp(hash, emptyHash, sizeof(emptyHash)),
1734      "Unexpected hash of nothing\n");
1735     /* Test a known value */
1736     ret = CryptHashCertificate(0, 0, 0, toHash, sizeof(toHash), hash,
1737      &hashLen);
1738     ok(ret, "CryptHashCertificate failed: %08x\n", GetLastError());
1739     ok(!memcmp(hash, knownHash, sizeof(knownHash)), "Unexpected hash\n");
1740 }
1741
1742 static void verifySig(HCRYPTPROV csp, const BYTE *toSign, size_t toSignLen,
1743  const BYTE *sig, unsigned int sigLen)
1744 {
1745     HCRYPTHASH hash;
1746     BOOL ret = CryptCreateHash(csp, CALG_SHA1, 0, 0, &hash);
1747
1748     ok(ret, "CryptCreateHash failed: %08x\n", GetLastError());
1749     if (ret)
1750     {
1751         BYTE mySig[64];
1752         DWORD mySigSize = sizeof(mySig);
1753
1754         ret = CryptHashData(hash, toSign, toSignLen, 0);
1755         ok(ret, "CryptHashData failed: %08x\n", GetLastError());
1756         /* use the A variant so the test can run on Win9x */
1757         ret = CryptSignHashA(hash, AT_SIGNATURE, NULL, 0, mySig, &mySigSize);
1758         ok(ret, "CryptSignHash failed: %08x\n", GetLastError());
1759         if (ret)
1760         {
1761             ok(mySigSize == sigLen, "Expected sig length %d, got %d\n",
1762              sigLen, mySigSize);
1763             ok(!memcmp(mySig, sig, sigLen), "Unexpected signature\n");
1764         }
1765         CryptDestroyHash(hash);
1766     }
1767 }
1768
1769 /* Tests signing the certificate described by toBeSigned with the CSP passed in,
1770  * using the algorithm with OID sigOID.  The CSP is assumed to be empty, and a
1771  * keyset named AT_SIGNATURE will be added to it.  The signature will be stored
1772  * in sig.  sigLen should be at least 64 bytes.
1773  */
1774 static void testSignCert(HCRYPTPROV csp, const CRYPT_DATA_BLOB *toBeSigned,
1775  LPCSTR sigOID, BYTE *sig, DWORD *sigLen)
1776 {
1777     BOOL ret;
1778     DWORD size = 0;
1779     CRYPT_ALGORITHM_IDENTIFIER algoID = { NULL, { 0, NULL } };
1780     HCRYPTKEY key;
1781
1782     /* These all crash
1783     ret = CryptSignCertificate(0, 0, 0, NULL, 0, NULL, NULL, NULL, NULL);
1784     ret = CryptSignCertificate(0, 0, 0, NULL, 0, NULL, NULL, NULL, &size);
1785     ret = CryptSignCertificate(0, 0, 0, toBeSigned->pbData, toBeSigned->cbData,
1786      NULL, NULL, NULL, &size);
1787      */
1788     ret = CryptSignCertificate(0, 0, 0, toBeSigned->pbData, toBeSigned->cbData,
1789      &algoID, NULL, NULL, &size);
1790     ok(!ret && GetLastError() == NTE_BAD_ALGID,
1791      "Expected NTE_BAD_ALGID, got %08x\n", GetLastError());
1792     algoID.pszObjId = (LPSTR)sigOID;
1793     ret = CryptSignCertificate(0, 0, 0, toBeSigned->pbData, toBeSigned->cbData,
1794      &algoID, NULL, NULL, &size);
1795     ok(!ret &&
1796      (GetLastError() == ERROR_INVALID_PARAMETER || GetLastError() == NTE_BAD_ALGID),
1797      "Expected ERROR_INVALID_PARAMETER or NTE_BAD_ALGID, got %08x\n",
1798      GetLastError());
1799     ret = CryptSignCertificate(0, AT_SIGNATURE, 0, toBeSigned->pbData,
1800      toBeSigned->cbData, &algoID, NULL, NULL, &size);
1801     ok(!ret &&
1802      (GetLastError() == ERROR_INVALID_PARAMETER || GetLastError() == NTE_BAD_ALGID),
1803      "Expected ERROR_INVALID_PARAMETER or NTE_BAD_ALGID, got %08x\n",
1804      GetLastError());
1805
1806     /* No keys exist in the new CSP yet.. */
1807     ret = CryptSignCertificate(csp, AT_SIGNATURE, 0, toBeSigned->pbData,
1808      toBeSigned->cbData, &algoID, NULL, NULL, &size);
1809     ok(!ret && (GetLastError() == NTE_BAD_KEYSET || GetLastError() ==
1810      NTE_NO_KEY), "Expected NTE_BAD_KEYSET or NTE_NO_KEY, got %08x\n",
1811      GetLastError());
1812     ret = CryptGenKey(csp, AT_SIGNATURE, 0, &key);
1813     ok(ret, "CryptGenKey failed: %08x\n", GetLastError());
1814     if (ret)
1815     {
1816         ret = CryptSignCertificate(csp, AT_SIGNATURE, 0, toBeSigned->pbData,
1817          toBeSigned->cbData, &algoID, NULL, NULL, &size);
1818         ok(ret, "CryptSignCertificate failed: %08x\n", GetLastError());
1819         ok(size <= *sigLen, "Expected size <= %d, got %d\n", *sigLen, size);
1820         if (ret)
1821         {
1822             ret = CryptSignCertificate(csp, AT_SIGNATURE, 0, toBeSigned->pbData,
1823              toBeSigned->cbData, &algoID, NULL, sig, &size);
1824             ok(ret, "CryptSignCertificate failed: %08x\n", GetLastError());
1825             if (ret)
1826             {
1827                 *sigLen = size;
1828                 verifySig(csp, toBeSigned->pbData, toBeSigned->cbData, sig,
1829                  size);
1830             }
1831         }
1832         CryptDestroyKey(key);
1833     }
1834 }
1835
1836 static void testVerifyCertSig(HCRYPTPROV csp, const CRYPT_DATA_BLOB *toBeSigned,
1837  LPCSTR sigOID, const BYTE *sig, DWORD sigLen)
1838 {
1839     CERT_SIGNED_CONTENT_INFO info;
1840     LPBYTE cert = NULL;
1841     DWORD size = 0;
1842     BOOL ret;
1843
1844     if (!pCryptEncodeObjectEx)
1845     {
1846         win_skip("no CryptEncodeObjectEx support\n");
1847         return;
1848     }
1849     ret = CryptVerifyCertificateSignature(0, 0, NULL, 0, NULL);
1850     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
1851      "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
1852     ret = CryptVerifyCertificateSignature(csp, 0, NULL, 0, NULL);
1853     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
1854      "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
1855     ret = CryptVerifyCertificateSignature(csp, X509_ASN_ENCODING, NULL, 0,
1856      NULL);
1857     ok(!ret && (GetLastError() == CRYPT_E_ASN1_EOD ||
1858      GetLastError() == OSS_BAD_ARG),
1859      "Expected CRYPT_E_ASN1_EOD or OSS_BAD_ARG, got %08x\n", GetLastError());
1860     info.ToBeSigned.cbData = toBeSigned->cbData;
1861     info.ToBeSigned.pbData = toBeSigned->pbData;
1862     info.SignatureAlgorithm.pszObjId = (LPSTR)sigOID;
1863     info.SignatureAlgorithm.Parameters.cbData = 0;
1864     info.Signature.cbData = sigLen;
1865     info.Signature.pbData = (BYTE *)sig;
1866     info.Signature.cUnusedBits = 0;
1867     ret = pCryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT, &info,
1868      CRYPT_ENCODE_ALLOC_FLAG, NULL, &cert, &size);
1869     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
1870     if (cert)
1871     {
1872         PCERT_PUBLIC_KEY_INFO pubKeyInfo = NULL;
1873         DWORD pubKeySize;
1874
1875         if (0)
1876         {
1877             /* Crashes prior to Vista */
1878             ret = CryptVerifyCertificateSignature(csp, X509_ASN_ENCODING,
1879              cert, size, NULL);
1880         }
1881         CryptExportPublicKeyInfoEx(csp, AT_SIGNATURE, X509_ASN_ENCODING,
1882          (LPSTR)sigOID, 0, NULL, NULL, &pubKeySize);
1883         pubKeyInfo = HeapAlloc(GetProcessHeap(), 0, pubKeySize);
1884         if (pubKeyInfo)
1885         {
1886             ret = CryptExportPublicKeyInfoEx(csp, AT_SIGNATURE,
1887              X509_ASN_ENCODING, (LPSTR)sigOID, 0, NULL, pubKeyInfo,
1888              &pubKeySize);
1889             ok(ret, "CryptExportKey failed: %08x\n", GetLastError());
1890             if (ret)
1891             {
1892                 ret = CryptVerifyCertificateSignature(csp, X509_ASN_ENCODING,
1893                  cert, size, pubKeyInfo);
1894                 ok(ret, "CryptVerifyCertificateSignature failed: %08x\n",
1895                  GetLastError());
1896             }
1897             HeapFree(GetProcessHeap(), 0, pubKeyInfo);
1898         }
1899         LocalFree(cert);
1900     }
1901 }
1902
1903 static void testVerifyCertSigEx(HCRYPTPROV csp, const CRYPT_DATA_BLOB *toBeSigned,
1904  LPCSTR sigOID, const BYTE *sig, DWORD sigLen)
1905 {
1906     CERT_SIGNED_CONTENT_INFO info;
1907     LPBYTE cert = NULL;
1908     DWORD size = 0;
1909     BOOL ret;
1910
1911     if (!pCryptVerifyCertificateSignatureEx)
1912     {
1913         win_skip("no CryptVerifyCertificateSignatureEx support\n");
1914         return;
1915     }
1916     if (!pCryptEncodeObjectEx)
1917     {
1918         win_skip("no CryptEncodeObjectEx support\n");
1919         return;
1920     }
1921     ret = pCryptVerifyCertificateSignatureEx(0, 0, 0, NULL, 0, NULL, 0, NULL);
1922     ok(!ret && GetLastError() == E_INVALIDARG,
1923      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1924     ret = pCryptVerifyCertificateSignatureEx(csp, 0, 0, NULL, 0, NULL, 0, NULL);
1925     ok(!ret && GetLastError() == E_INVALIDARG,
1926      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1927     ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING, 0, NULL, 0,
1928      NULL, 0, NULL);
1929     ok(!ret && GetLastError() == E_INVALIDARG,
1930      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1931     /* This crashes
1932     ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1933      CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, NULL, 0, NULL, 0, NULL);
1934      */
1935     info.ToBeSigned.cbData = toBeSigned->cbData;
1936     info.ToBeSigned.pbData = toBeSigned->pbData;
1937     info.SignatureAlgorithm.pszObjId = (LPSTR)sigOID;
1938     info.SignatureAlgorithm.Parameters.cbData = 0;
1939     info.Signature.cbData = sigLen;
1940     info.Signature.pbData = (BYTE *)sig;
1941     info.Signature.cUnusedBits = 0;
1942     ret = pCryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT, &info,
1943      CRYPT_ENCODE_ALLOC_FLAG, NULL, &cert, &size);
1944     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
1945     if (cert)
1946     {
1947         CRYPT_DATA_BLOB certBlob = { 0, NULL };
1948         PCERT_PUBLIC_KEY_INFO pubKeyInfo = NULL;
1949
1950         ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1951          CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob, 0, NULL, 0, NULL);
1952         ok(!ret && GetLastError() == CRYPT_E_ASN1_EOD,
1953          "Expected CRYPT_E_ASN1_EOD, got %08x\n", GetLastError());
1954         certBlob.cbData = 1;
1955         certBlob.pbData = (void *)0xdeadbeef;
1956         ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1957          CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob, 0, NULL, 0, NULL);
1958         ok(!ret && (GetLastError() == STATUS_ACCESS_VIOLATION ||
1959                     GetLastError() == CRYPT_E_ASN1_EOD /* Win9x */ ||
1960                     GetLastError() == CRYPT_E_ASN1_BADTAG /* Win98 */),
1961          "Expected STATUS_ACCESS_VIOLATION, CRYPT_E_ASN1_EOD, OR CRYPT_E_ASN1_BADTAG, got %08x\n",
1962          GetLastError());
1963
1964         certBlob.cbData = size;
1965         certBlob.pbData = cert;
1966         ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1967          CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob, 0, NULL, 0, NULL);
1968         ok(!ret && GetLastError() == E_INVALIDARG,
1969          "Expected E_INVALIDARG, got %08x\n", GetLastError());
1970         ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1971          CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob,
1972          CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL, NULL, 0, NULL);
1973         ok(!ret && GetLastError() == E_INVALIDARG,
1974          "Expected E_INVALIDARG, got %08x\n", GetLastError());
1975         /* This crashes
1976         ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1977          CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob,
1978          CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, NULL, 0, NULL);
1979          */
1980         CryptExportPublicKeyInfoEx(csp, AT_SIGNATURE, X509_ASN_ENCODING,
1981          (LPSTR)sigOID, 0, NULL, NULL, &size);
1982         pubKeyInfo = HeapAlloc(GetProcessHeap(), 0, size);
1983         if (pubKeyInfo)
1984         {
1985             ret = CryptExportPublicKeyInfoEx(csp, AT_SIGNATURE,
1986              X509_ASN_ENCODING, (LPSTR)sigOID, 0, NULL, pubKeyInfo, &size);
1987             ok(ret, "CryptExportKey failed: %08x\n", GetLastError());
1988             if (ret)
1989             {
1990                 ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1991                  CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob,
1992                  CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pubKeyInfo, 0, NULL);
1993                 ok(ret, "CryptVerifyCertificateSignatureEx failed: %08x\n",
1994                  GetLastError());
1995             }
1996             HeapFree(GetProcessHeap(), 0, pubKeyInfo);
1997         }
1998         LocalFree(cert);
1999     }
2000 }
2001
2002 static BYTE emptyCert[] = { 0x30, 0x00 };
2003
2004 static void testCertSigs(void)
2005 {
2006     HCRYPTPROV csp;
2007     CRYPT_DATA_BLOB toBeSigned = { sizeof(emptyCert), emptyCert };
2008     BOOL ret;
2009     BYTE sig[64];
2010     DWORD sigSize = sizeof(sig);
2011
2012     /* Just in case a previous run failed, delete this thing */
2013     pCryptAcquireContextA(&csp, cspNameA, MS_DEF_PROV_A, PROV_RSA_FULL,
2014      CRYPT_DELETEKEYSET);
2015     ret = pCryptAcquireContextA(&csp, cspNameA, MS_DEF_PROV_A, PROV_RSA_FULL,
2016      CRYPT_NEWKEYSET);
2017     ok(ret, "CryptAcquireContext failed: %08x\n", GetLastError());
2018
2019     testSignCert(csp, &toBeSigned, szOID_RSA_SHA1RSA, sig, &sigSize);
2020     testVerifyCertSig(csp, &toBeSigned, szOID_RSA_SHA1RSA, sig, sigSize);
2021     testVerifyCertSigEx(csp, &toBeSigned, szOID_RSA_SHA1RSA, sig, sigSize);
2022
2023     CryptReleaseContext(csp, 0);
2024     ret = pCryptAcquireContextA(&csp, cspNameA, MS_DEF_PROV_A, PROV_RSA_FULL,
2025      CRYPT_DELETEKEYSET);
2026     ok(ret, "CryptAcquireContext failed: %08x\n", GetLastError());
2027 }
2028
2029 static const BYTE md5SignedEmptyCert[] = {
2030 0x30,0x56,0x30,0x33,0x02,0x00,0x30,0x02,0x06,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,
2031 0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,0x31,
2032 0x36,0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x07,
2033 0x30,0x02,0x06,0x00,0x03,0x01,0x00,0x30,0x0c,0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,
2034 0x0d,0x02,0x05,0x05,0x00,0x03,0x11,0x00,0xfb,0x0f,0x66,0x82,0x66,0xd9,0xe5,0xf8,
2035 0xd8,0xa2,0x55,0x2b,0xe1,0xa5,0xd9,0x04 };
2036 static const BYTE md5SignedEmptyCertNoNull[] = {
2037 0x30,0x54,0x30,0x33,0x02,0x00,0x30,0x02,0x06,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,
2038 0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,0x31,
2039 0x36,0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x07,
2040 0x30,0x02,0x06,0x00,0x03,0x01,0x00,0x30,0x0a,0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,
2041 0x0d,0x02,0x05,0x03,0x11,0x00,0x04,0xd9,0xa5,0xe1,0x2b,0x55,0xa2,0xd8,0xf8,0xe5,
2042 0xd9,0x66,0x82,0x66,0x0f,0xfb };
2043
2044 static void testSignAndEncodeCert(void)
2045 {
2046     static char oid_rsa_md5rsa[] = szOID_RSA_MD5RSA;
2047     static char oid_rsa_md5[] = szOID_RSA_MD5;
2048     BOOL ret;
2049     DWORD size;
2050     CRYPT_ALGORITHM_IDENTIFIER algID = { 0 };
2051     CERT_INFO info = { 0 };
2052
2053     /* Crash
2054     ret = CryptSignAndEncodeCertificate(0, 0, 0, NULL, NULL, NULL, NULL, NULL,
2055      NULL);
2056     ret = CryptSignAndEncodeCertificate(0, 0, 0, NULL, NULL, NULL, NULL, NULL,
2057      &size);
2058      */
2059     ret = CryptSignAndEncodeCertificate(0, 0, 0, NULL, NULL, &algID, NULL, NULL,
2060      &size);
2061     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
2062      "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
2063     ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING, NULL, NULL,
2064      &algID, NULL, NULL, &size);
2065     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
2066      "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
2067     ret = CryptSignAndEncodeCertificate(0, 0, 0, X509_CERT_TO_BE_SIGNED, NULL,
2068      &algID, NULL, NULL, &size);
2069     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
2070      "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
2071     /* Crashes on some win9x boxes */
2072     if (0)
2073     {
2074         ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
2075          X509_CERT_TO_BE_SIGNED, NULL, &algID, NULL, NULL, &size);
2076         ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
2077          "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
2078     }
2079     /* Crashes
2080     ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
2081      X509_CERT_TO_BE_SIGNED, &info, NULL, NULL, NULL, &size);
2082      */
2083     ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
2084      X509_CERT_TO_BE_SIGNED, &info, &algID, NULL, NULL, &size);
2085     ok(!ret &&
2086      (GetLastError() == NTE_BAD_ALGID ||
2087       GetLastError() == OSS_BAD_PTR), /* win9x */
2088      "Expected NTE_BAD_ALGID, got %08x\n", GetLastError());
2089     algID.pszObjId = oid_rsa_md5rsa;
2090     ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
2091      X509_CERT_TO_BE_SIGNED, &info, &algID, NULL, NULL, &size);
2092     ok(!ret &&
2093      (GetLastError() == ERROR_INVALID_PARAMETER ||
2094       GetLastError() == NTE_BAD_ALGID ||
2095       GetLastError() == OSS_BAD_PTR), /* Win9x */
2096      "Expected ERROR_INVALID_PARAMETER or NTE_BAD_ALGID, got %08x\n",
2097      GetLastError());
2098     algID.pszObjId = oid_rsa_md5;
2099     ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
2100      X509_CERT_TO_BE_SIGNED, &info, &algID, NULL, NULL, &size);
2101     /* oid_rsa_md5 not present in some win2k */
2102     if (ret)
2103     {
2104         LPBYTE buf = HeapAlloc(GetProcessHeap(), 0, size);
2105
2106         if (buf)
2107         {
2108             ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
2109              X509_CERT_TO_BE_SIGNED, &info, &algID, NULL, buf, &size);
2110             ok(ret, "CryptSignAndEncodeCertificate failed: %08x\n",
2111              GetLastError());
2112             /* Tricky: because the NULL parameters may either be omitted or
2113              * included as an asn.1-encoded NULL (0x05,0x00), two different
2114              * values are allowed.
2115              */
2116             ok(size == sizeof(md5SignedEmptyCert) ||
2117              size == sizeof(md5SignedEmptyCertNoNull), "Unexpected size %d\n",
2118              size);
2119             if (size == sizeof(md5SignedEmptyCert))
2120                 ok(!memcmp(buf, md5SignedEmptyCert, size),
2121                  "Unexpected value\n");
2122             else if (size == sizeof(md5SignedEmptyCertNoNull))
2123                 ok(!memcmp(buf, md5SignedEmptyCertNoNull, size),
2124                  "Unexpected value\n");
2125             HeapFree(GetProcessHeap(), 0, buf);
2126         }
2127     }
2128 }
2129
2130 static void testCreateSelfSignCert(void)
2131 {
2132     PCCERT_CONTEXT context;
2133     CERT_NAME_BLOB name = { sizeof(subjectName), subjectName };
2134     HCRYPTPROV csp;
2135     BOOL ret;
2136     HCRYPTKEY key;
2137     CRYPT_KEY_PROV_INFO info;
2138
2139     if (!pCertCreateSelfSignCertificate)
2140     {
2141         win_skip("CertCreateSelfSignCertificate() is not available\n");
2142         return;
2143     }
2144
2145     /* This crashes:
2146     context = pCertCreateSelfSignCertificate(0, NULL, 0, NULL, NULL, NULL, NULL,
2147      NULL);
2148      * Calling this with no first parameter creates a new key container, which
2149      * lasts beyond the test, so I don't test that.  Nb: the generated key
2150      * name is a GUID.
2151     context = pCertCreateSelfSignCertificate(0, &name, 0, NULL, NULL, NULL, NULL,
2152      NULL);
2153      */
2154
2155     /* Acquire a CSP */
2156     pCryptAcquireContextA(&csp, cspNameA, MS_DEF_PROV_A, PROV_RSA_FULL,
2157      CRYPT_DELETEKEYSET);
2158     ret = pCryptAcquireContextA(&csp, cspNameA, MS_DEF_PROV_A, PROV_RSA_FULL,
2159      CRYPT_NEWKEYSET);
2160     ok(ret, "CryptAcquireContext failed: %08x\n", GetLastError());
2161
2162     context = pCertCreateSelfSignCertificate(csp, &name, 0, NULL, NULL, NULL,
2163      NULL, NULL);
2164     ok(!context && GetLastError() == NTE_NO_KEY,
2165      "Expected NTE_NO_KEY, got %08x\n", GetLastError());
2166     ret = CryptGenKey(csp, AT_SIGNATURE, 0, &key);
2167     ok(ret, "CryptGenKey failed: %08x\n", GetLastError());
2168     if (ret)
2169     {
2170         context = pCertCreateSelfSignCertificate(csp, &name, 0, NULL, NULL, NULL,
2171          NULL, NULL);
2172         ok(context != NULL, "CertCreateSelfSignCertificate failed: %08x\n",
2173          GetLastError());
2174         if (context)
2175         {
2176             DWORD size = 0;
2177
2178             /* The context must have a key provider info property */
2179             ret = CertGetCertificateContextProperty(context,
2180              CERT_KEY_PROV_INFO_PROP_ID, NULL, &size);
2181             ok(ret && size, "Expected non-zero key provider info\n");
2182             if (size)
2183             {
2184                 PCRYPT_KEY_PROV_INFO pInfo = HeapAlloc(GetProcessHeap(), 0, size);
2185
2186                 if (pInfo)
2187                 {
2188                     ret = CertGetCertificateContextProperty(context,
2189                      CERT_KEY_PROV_INFO_PROP_ID, pInfo, &size);
2190                     ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
2191                      GetLastError());
2192                     if (ret)
2193                     {
2194                         /* Sanity-check the key provider */
2195                         ok(!lstrcmpW(pInfo->pwszContainerName, cspNameW),
2196                          "Unexpected key container\n");
2197                         ok(!lstrcmpW(pInfo->pwszProvName, MS_DEF_PROV_W),
2198                          "Unexpected provider\n");
2199                         ok(pInfo->dwKeySpec == AT_SIGNATURE,
2200                          "Expected AT_SIGNATURE, got %d\n", pInfo->dwKeySpec);
2201                     }
2202                     HeapFree(GetProcessHeap(), 0, pInfo);
2203                 }
2204             }
2205
2206             CertFreeCertificateContext(context);
2207         }
2208
2209         CryptDestroyKey(key);
2210     }
2211
2212     CryptReleaseContext(csp, 0);
2213     ret = pCryptAcquireContextA(&csp, cspNameA, MS_DEF_PROV_A, PROV_RSA_FULL,
2214      CRYPT_DELETEKEYSET);
2215     ok(ret, "CryptAcquireContext failed: %08x\n", GetLastError());
2216
2217     /* Do the same test with a CSP, AT_KEYEXCHANGE and key info */
2218     pCryptAcquireContextA(&csp, cspNameA, MS_DEF_PROV_A, PROV_RSA_FULL,
2219      CRYPT_DELETEKEYSET);
2220     ret = pCryptAcquireContextA(&csp, cspNameA, MS_DEF_PROV_A, PROV_RSA_FULL,
2221      CRYPT_NEWKEYSET);
2222     ok(ret, "CryptAcquireContext failed: %08x\n", GetLastError());
2223     ret = CryptGenKey(csp, AT_SIGNATURE, 0, &key);
2224     ok(ret, "CryptGenKey failed: %08x\n", GetLastError());
2225
2226     memset(&info,0,sizeof(info));
2227     info.dwProvType = PROV_RSA_FULL;
2228     info.dwKeySpec = AT_KEYEXCHANGE;
2229     info.pwszProvName = (LPWSTR) MS_DEF_PROV_W;
2230     info.pwszContainerName = cspNameW;
2231     /* This should fail because the CSP doesn't have the specified key. */
2232     SetLastError(0xdeadbeef);
2233     context = pCertCreateSelfSignCertificate(csp, &name, 0, &info, NULL, NULL,
2234         NULL, NULL);
2235     ok(context == NULL, "expected failure\n");
2236     if (context != NULL)
2237         CertFreeCertificateContext(context);
2238     else
2239         ok(GetLastError() == NTE_NO_KEY, "expected NTE_NO_KEY, got %08x\n",
2240             GetLastError());
2241     /* Again, with a CSP, AT_SIGNATURE and key info */
2242     info.dwKeySpec = AT_SIGNATURE;
2243     SetLastError(0xdeadbeef);
2244     context = pCertCreateSelfSignCertificate(csp, &name, 0, &info, NULL, NULL,
2245         NULL, NULL);
2246     ok(context != NULL,
2247         "CertCreateSelfSignCertificate failed: %08x\n", GetLastError());
2248     if (context)
2249     {
2250         DWORD size = 0;
2251
2252         /* The context must have a key provider info property */
2253         ret = CertGetCertificateContextProperty(context,
2254             CERT_KEY_PROV_INFO_PROP_ID, NULL, &size);
2255         ok(ret && size, "Expected non-zero key provider info\n");
2256         if (size)
2257         {
2258             PCRYPT_KEY_PROV_INFO pInfo = HeapAlloc(GetProcessHeap(), 0, size);
2259
2260             if (pInfo)
2261             {
2262                 ret = CertGetCertificateContextProperty(context,
2263                     CERT_KEY_PROV_INFO_PROP_ID, pInfo, &size);
2264                 ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
2265                     GetLastError());
2266                 if (ret)
2267                 {
2268                     /* Sanity-check the key provider */
2269                     ok(!lstrcmpW(pInfo->pwszContainerName, cspNameW),
2270                         "Unexpected key container\n");
2271                     ok(!lstrcmpW(pInfo->pwszProvName, MS_DEF_PROV_W),
2272                         "Unexpected provider\n");
2273                     ok(pInfo->dwKeySpec == AT_SIGNATURE,
2274                         "Expected AT_SIGNATURE, got %d\n", pInfo->dwKeySpec);
2275                 }
2276                 HeapFree(GetProcessHeap(), 0, pInfo);
2277             }
2278         }
2279
2280         CertFreeCertificateContext(context);
2281     }
2282     CryptDestroyKey(key);
2283
2284     CryptReleaseContext(csp, 0);
2285     ret = pCryptAcquireContextA(&csp, cspNameA, MS_DEF_PROV_A, PROV_RSA_FULL,
2286      CRYPT_DELETEKEYSET);
2287     ok(ret, "CryptAcquireContext failed: %08x\n", GetLastError());
2288
2289     /* Do the same test with no CSP, AT_KEYEXCHANGE and key info */
2290     info.dwKeySpec = AT_KEYEXCHANGE;
2291     context = pCertCreateSelfSignCertificate(0, &name, 0, &info, NULL, NULL,
2292         NULL, NULL);
2293     ok(context != NULL, "CertCreateSelfSignCertificate failed: %08x\n",
2294         GetLastError());
2295     if (context)
2296     {
2297         DWORD size = 0;
2298
2299         /* The context must have a key provider info property */
2300         ret = CertGetCertificateContextProperty(context,
2301             CERT_KEY_PROV_INFO_PROP_ID, NULL, &size);
2302         ok(ret && size, "Expected non-zero key provider info\n");
2303         if (size)
2304         {
2305             PCRYPT_KEY_PROV_INFO pInfo = HeapAlloc(GetProcessHeap(), 0, size);
2306
2307             if (pInfo)
2308             {
2309                 ret = CertGetCertificateContextProperty(context,
2310                     CERT_KEY_PROV_INFO_PROP_ID, pInfo, &size);
2311                 ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
2312                     GetLastError());
2313                 if (ret)
2314                 {
2315                     /* Sanity-check the key provider */
2316                     ok(!lstrcmpW(pInfo->pwszContainerName, cspNameW),
2317                         "Unexpected key container\n");
2318                     ok(!lstrcmpW(pInfo->pwszProvName, MS_DEF_PROV_W),
2319                         "Unexpected provider\n");
2320                     ok(pInfo->dwKeySpec == AT_KEYEXCHANGE,
2321                         "Expected AT_KEYEXCHANGE, got %d\n", pInfo->dwKeySpec);
2322                 }
2323                 HeapFree(GetProcessHeap(), 0, pInfo);
2324             }
2325         }
2326
2327         CertFreeCertificateContext(context);
2328     }
2329
2330     pCryptAcquireContextA(&csp, cspNameA, MS_DEF_PROV_A, PROV_RSA_FULL,
2331         CRYPT_DELETEKEYSET);
2332
2333     /* Acquire a CSP and generate an AT_KEYEXCHANGE key in it. */
2334     pCryptAcquireContextA(&csp, cspNameA, MS_DEF_PROV_A, PROV_RSA_FULL,
2335      CRYPT_DELETEKEYSET);
2336     ret = pCryptAcquireContextA(&csp, cspNameA, MS_DEF_PROV_A, PROV_RSA_FULL,
2337      CRYPT_NEWKEYSET);
2338     ok(ret, "CryptAcquireContext failed: %08x\n", GetLastError());
2339
2340     context = pCertCreateSelfSignCertificate(csp, &name, 0, NULL, NULL, NULL,
2341      NULL, NULL);
2342     ok(!context && GetLastError() == NTE_NO_KEY,
2343      "Expected NTE_NO_KEY, got %08x\n", GetLastError());
2344     ret = CryptGenKey(csp, AT_KEYEXCHANGE, 0, &key);
2345     ok(ret, "CryptGenKey failed: %08x\n", GetLastError());
2346     CryptDestroyKey(key);
2347
2348     memset(&info,0,sizeof(info));
2349     info.dwProvType = PROV_RSA_FULL;
2350     info.dwKeySpec = AT_SIGNATURE;
2351     info.pwszProvName = (LPWSTR) MS_DEF_PROV_W;
2352     info.pwszContainerName = cspNameW;
2353     /* This should fail because the CSP doesn't have the specified key. */
2354     SetLastError(0xdeadbeef);
2355     context = pCertCreateSelfSignCertificate(csp, &name, 0, &info, NULL, NULL,
2356         NULL, NULL);
2357     ok(context == NULL, "expected failure\n");
2358     if (context != NULL)
2359         CertFreeCertificateContext(context);
2360     else
2361         ok(GetLastError() == NTE_NO_KEY, "expected NTE_NO_KEY, got %08x\n",
2362             GetLastError());
2363     /* Again, with a CSP, AT_KEYEXCHANGE and key info. This succeeds because the
2364      * CSP has an AT_KEYEXCHANGE key in it.
2365      */
2366     info.dwKeySpec = AT_KEYEXCHANGE;
2367     SetLastError(0xdeadbeef);
2368     context = pCertCreateSelfSignCertificate(csp, &name, 0, &info, NULL, NULL,
2369         NULL, NULL);
2370     ok(context != NULL,
2371         "CertCreateSelfSignCertificate failed: %08x\n", GetLastError());
2372     if (context)
2373     {
2374         DWORD size = 0;
2375
2376         /* The context must have a key provider info property */
2377         ret = CertGetCertificateContextProperty(context,
2378             CERT_KEY_PROV_INFO_PROP_ID, NULL, &size);
2379         ok(ret && size, "Expected non-zero key provider info\n");
2380         if (size)
2381         {
2382             PCRYPT_KEY_PROV_INFO pInfo = HeapAlloc(GetProcessHeap(), 0, size);
2383
2384             if (pInfo)
2385             {
2386                 ret = CertGetCertificateContextProperty(context,
2387                     CERT_KEY_PROV_INFO_PROP_ID, pInfo, &size);
2388                 ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
2389                     GetLastError());
2390                 if (ret)
2391                 {
2392                     /* Sanity-check the key provider */
2393                     ok(!lstrcmpW(pInfo->pwszContainerName, cspNameW),
2394                         "Unexpected key container\n");
2395                     ok(!lstrcmpW(pInfo->pwszProvName, MS_DEF_PROV_W),
2396                         "Unexpected provider\n");
2397                     ok(pInfo->dwKeySpec == AT_KEYEXCHANGE,
2398                         "Expected AT_KEYEXCHANGE, got %d\n", pInfo->dwKeySpec);
2399                 }
2400                 HeapFree(GetProcessHeap(), 0, pInfo);
2401             }
2402         }
2403
2404         CertFreeCertificateContext(context);
2405     }
2406
2407     CryptReleaseContext(csp, 0);
2408     ret = pCryptAcquireContextA(&csp, cspNameA, MS_DEF_PROV_A, PROV_RSA_FULL,
2409      CRYPT_DELETEKEYSET);
2410     ok(ret, "CryptAcquireContext failed: %08x\n", GetLastError());
2411
2412 }
2413
2414 static void testIntendedKeyUsage(void)
2415 {
2416     BOOL ret;
2417     CERT_INFO info = { 0 };
2418     static char oid_key_usage[] = szOID_KEY_USAGE;
2419     /* A couple "key usages".  Really they're just encoded bits which aren't
2420      * necessarily restricted to the defined key usage values.
2421      */
2422     static BYTE usage1[] = { 0x03,0x03,0x00,0xff,0xff };
2423     static BYTE usage2[] = { 0x03,0x03,0x01,0xff,0xfe };
2424     static const BYTE expected_usage1[] = { 0xff,0xff,0x00,0x00 };
2425     static const BYTE expected_usage2[] = { 0xff,0xfe,0x00,0x00 };
2426     CERT_EXTENSION ext = { oid_key_usage, TRUE, { sizeof(usage1), usage1 } };
2427     BYTE usage_bytes[4];
2428
2429     if (0)
2430     {
2431         /* Crash */
2432         CertGetIntendedKeyUsage(0, NULL, NULL, 0);
2433     }
2434     ret = CertGetIntendedKeyUsage(0, &info, NULL, 0);
2435     ok(!ret, "expected failure\n");
2436     ret = CertGetIntendedKeyUsage(0, &info, usage_bytes, sizeof(usage_bytes));
2437     ok(!ret, "expected failure\n");
2438     ret = CertGetIntendedKeyUsage(X509_ASN_ENCODING, &info, NULL, 0);
2439     ok(!ret, "expected failure\n");
2440     ret = CertGetIntendedKeyUsage(X509_ASN_ENCODING, &info, usage_bytes,
2441      sizeof(usage_bytes));
2442     ok(!ret, "expected failure\n");
2443     info.cExtension = 1;
2444     info.rgExtension = &ext;
2445     ret = CertGetIntendedKeyUsage(X509_ASN_ENCODING, &info, NULL, 0);
2446     ok(!ret, "expected failure\n");
2447     /* The unused bytes are filled with 0. */
2448     ret = CertGetIntendedKeyUsage(X509_ASN_ENCODING, &info, usage_bytes,
2449      sizeof(usage_bytes));
2450     ok(ret, "CertGetIntendedKeyUsage failed: %08x\n", GetLastError());
2451     ok(!memcmp(usage_bytes, expected_usage1, sizeof(expected_usage1)),
2452      "unexpected value\n");
2453     /* The usage bytes are copied in big-endian order. */
2454     ext.Value.cbData = sizeof(usage2);
2455     ext.Value.pbData = usage2;
2456     ret = CertGetIntendedKeyUsage(X509_ASN_ENCODING, &info, usage_bytes,
2457      sizeof(usage_bytes));
2458     ok(ret, "CertGetIntendedKeyUsage failed: %08x\n", GetLastError());
2459     ok(!memcmp(usage_bytes, expected_usage2, sizeof(expected_usage2)),
2460      "unexpected value\n");
2461 }
2462
2463 static const LPCSTR keyUsages[] = { szOID_PKIX_KP_CODE_SIGNING,
2464  szOID_PKIX_KP_CLIENT_AUTH, szOID_RSA_RSA };
2465
2466 static void testKeyUsage(void)
2467 {
2468     BOOL ret;
2469     PCCERT_CONTEXT context;
2470     DWORD size;
2471
2472     /* Test base cases */
2473     ret = CertGetEnhancedKeyUsage(NULL, 0, NULL, NULL);
2474     ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
2475      "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
2476     size = 1;
2477     ret = CertGetEnhancedKeyUsage(NULL, 0, NULL, &size);
2478     ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
2479      "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
2480     size = 0;
2481     ret = CertGetEnhancedKeyUsage(NULL, 0, NULL, &size);
2482     ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
2483      "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
2484     /* These crash
2485     ret = CertSetEnhancedKeyUsage(NULL, NULL);
2486     usage.cUsageIdentifier = 0;
2487     ret = CertSetEnhancedKeyUsage(NULL, &usage);
2488      */
2489     /* Test with a cert with no enhanced key usage extension */
2490     context = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert,
2491      sizeof(bigCert));
2492     ok(context != NULL, "CertCreateCertificateContext failed: %08x\n",
2493      GetLastError());
2494     if (context)
2495     {
2496         static const char oid[] = "1.2.3.4";
2497         BYTE buf[sizeof(CERT_ENHKEY_USAGE) + 2 * (sizeof(LPSTR) + sizeof(oid))];
2498         PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
2499
2500         ret = CertGetEnhancedKeyUsage(context, 0, NULL, NULL);
2501         ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
2502          "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
2503         size = 1;
2504         ret = CertGetEnhancedKeyUsage(context, 0, NULL, &size);
2505         if (ret)
2506         {
2507             /* Windows 2000, ME, or later: even though it succeeded, we expect
2508              * CRYPT_E_NOT_FOUND, which indicates there is no enhanced key
2509              * usage set for this cert (which implies it's valid for all uses.)
2510              */
2511             ok(GetLastError() == CRYPT_E_NOT_FOUND,
2512              "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
2513             ok(size == sizeof(CERT_ENHKEY_USAGE), "Wrong size %d\n", size);
2514             ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
2515             ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2516             ok(pUsage->cUsageIdentifier == 0, "Expected 0 usages, got %d\n",
2517              pUsage->cUsageIdentifier);
2518         }
2519         else
2520         {
2521             /* Windows NT, 95, or 98: it fails, and the last error is
2522              * CRYPT_E_NOT_FOUND.
2523              */
2524             ok(GetLastError() == CRYPT_E_NOT_FOUND,
2525              "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
2526         }
2527         /* I can add a usage identifier when no key usage has been set */
2528         ret = CertAddEnhancedKeyUsageIdentifier(context, oid);
2529         ok(ret, "CertAddEnhancedKeyUsageIdentifier failed: %08x\n",
2530          GetLastError());
2531         size = sizeof(buf);
2532         ret = CertGetEnhancedKeyUsage(context,
2533          CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2534         ok(ret && GetLastError() == 0,
2535          "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2536         ok(pUsage->cUsageIdentifier == 1, "Expected 1 usage, got %d\n",
2537          pUsage->cUsageIdentifier);
2538         if (pUsage->cUsageIdentifier)
2539             ok(!strcmp(pUsage->rgpszUsageIdentifier[0], oid),
2540              "Expected %s, got %s\n", oid, pUsage->rgpszUsageIdentifier[0]);
2541         /* Now set an empty key usage */
2542         pUsage->cUsageIdentifier = 0;
2543         ret = CertSetEnhancedKeyUsage(context, pUsage);
2544         ok(ret, "CertSetEnhancedKeyUsage failed: %08x\n", GetLastError());
2545         /* Shouldn't find it in the cert */
2546         size = sizeof(buf);
2547         ret = CertGetEnhancedKeyUsage(context,
2548          CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2549         ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
2550          "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
2551         /* Should find it as an extended property */
2552         ret = CertGetEnhancedKeyUsage(context,
2553          CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2554         ok(ret && GetLastError() == 0,
2555          "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2556         ok(pUsage->cUsageIdentifier == 0, "Expected 0 usages, got %d\n",
2557          pUsage->cUsageIdentifier);
2558         /* Should find it as either */
2559         ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
2560         ok(ret && GetLastError() == 0,
2561          "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2562         ok(pUsage->cUsageIdentifier == 0, "Expected 0 usages, got %d\n",
2563          pUsage->cUsageIdentifier);
2564         /* Add a usage identifier */
2565         ret = CertAddEnhancedKeyUsageIdentifier(context, oid);
2566         ok(ret, "CertAddEnhancedKeyUsageIdentifier failed: %08x\n",
2567          GetLastError());
2568         size = sizeof(buf);
2569         ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
2570         ok(ret && GetLastError() == 0,
2571          "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2572         ok(pUsage->cUsageIdentifier == 1, "Expected 1 identifier, got %d\n",
2573          pUsage->cUsageIdentifier);
2574         if (pUsage->cUsageIdentifier)
2575             ok(!strcmp(pUsage->rgpszUsageIdentifier[0], oid),
2576              "Expected %s, got %s\n", oid, pUsage->rgpszUsageIdentifier[0]);
2577         /* Re-adding the same usage identifier succeeds, though it only adds
2578          * a duplicate usage identifier on versions prior to Vista
2579          */
2580         ret = CertAddEnhancedKeyUsageIdentifier(context, oid);
2581         ok(ret, "CertAddEnhancedKeyUsageIdentifier failed: %08x\n",
2582          GetLastError());
2583         size = sizeof(buf);
2584         ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
2585         ok(ret && GetLastError() == 0,
2586          "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2587         ok(pUsage->cUsageIdentifier == 1 || pUsage->cUsageIdentifier == 2,
2588          "Expected 1 or 2 identifiers, got %d\n", pUsage->cUsageIdentifier);
2589         if (pUsage->cUsageIdentifier)
2590             ok(!strcmp(pUsage->rgpszUsageIdentifier[0], oid),
2591              "Expected %s, got %s\n", oid, pUsage->rgpszUsageIdentifier[0]);
2592         if (pUsage->cUsageIdentifier >= 2)
2593             ok(!strcmp(pUsage->rgpszUsageIdentifier[1], oid),
2594              "Expected %s, got %s\n", oid, pUsage->rgpszUsageIdentifier[1]);
2595         /* Now set a NULL extended property--this deletes the property. */
2596         ret = CertSetEnhancedKeyUsage(context, NULL);
2597         ok(ret, "CertSetEnhancedKeyUsage failed: %08x\n", GetLastError());
2598         SetLastError(0xbaadcafe);
2599         size = sizeof(buf);
2600         ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
2601         ok(ret || broken(!ret && GetLastError() == CRYPT_E_NOT_FOUND /* NT4 */),
2602          "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2603         ok(GetLastError() == CRYPT_E_NOT_FOUND,
2604          "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
2605
2606         CertFreeCertificateContext(context);
2607     }
2608     /* Now test with a cert with an enhanced key usage extension */
2609     context = CertCreateCertificateContext(X509_ASN_ENCODING, certWithUsage,
2610      sizeof(certWithUsage));
2611     ok(context != NULL, "CertCreateCertificateContext failed: %08x\n",
2612      GetLastError());
2613     if (context)
2614     {
2615         LPBYTE buf = NULL;
2616         DWORD bufSize = 0, i;
2617
2618         /* The size may depend on what flags are used to query it, so I
2619          * realloc the buffer for each test.
2620          */
2621         ret = CertGetEnhancedKeyUsage(context,
2622          CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG, NULL, &bufSize);
2623         ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2624         buf = HeapAlloc(GetProcessHeap(), 0, bufSize);
2625         if (buf)
2626         {
2627             PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
2628
2629             /* Should find it in the cert */
2630             size = bufSize;
2631             ret = CertGetEnhancedKeyUsage(context,
2632              CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2633             ok(ret && GetLastError() == 0,
2634              "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2635             ok(pUsage->cUsageIdentifier == 3, "Expected 3 usages, got %d\n",
2636              pUsage->cUsageIdentifier);
2637             for (i = 0; i < pUsage->cUsageIdentifier; i++)
2638                 ok(!strcmp(pUsage->rgpszUsageIdentifier[i], keyUsages[i]),
2639                  "Expected %s, got %s\n", keyUsages[i],
2640                  pUsage->rgpszUsageIdentifier[i]);
2641             HeapFree(GetProcessHeap(), 0, buf);
2642         }
2643         ret = CertGetEnhancedKeyUsage(context, 0, NULL, &bufSize);
2644         ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2645         buf = HeapAlloc(GetProcessHeap(), 0, bufSize);
2646         if (buf)
2647         {
2648             PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
2649
2650             /* Should find it as either */
2651             size = bufSize;
2652             ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
2653             /* In Windows, GetLastError returns CRYPT_E_NOT_FOUND not found
2654              * here, even though the return is successful and the usage id
2655              * count is positive.  I don't enforce that here.
2656              */
2657             ok(ret,
2658              "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2659             ok(pUsage->cUsageIdentifier == 3, "Expected 3 usages, got %d\n",
2660              pUsage->cUsageIdentifier);
2661             for (i = 0; i < pUsage->cUsageIdentifier; i++)
2662                 ok(!strcmp(pUsage->rgpszUsageIdentifier[i], keyUsages[i]),
2663                  "Expected %s, got %s\n", keyUsages[i],
2664                  pUsage->rgpszUsageIdentifier[i]);
2665             HeapFree(GetProcessHeap(), 0, buf);
2666         }
2667         /* Shouldn't find it as an extended property */
2668         ret = CertGetEnhancedKeyUsage(context,
2669          CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size);
2670         ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
2671          "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
2672         /* Adding a usage identifier overrides the cert's usage!? */
2673         ret = CertAddEnhancedKeyUsageIdentifier(context, szOID_RSA_RSA);
2674         ok(ret, "CertAddEnhancedKeyUsageIdentifier failed: %08x\n",
2675          GetLastError());
2676         ret = CertGetEnhancedKeyUsage(context, 0, NULL, &bufSize);
2677         ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2678         buf = HeapAlloc(GetProcessHeap(), 0, bufSize);
2679         if (buf)
2680         {
2681             PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
2682
2683             /* Should find it as either */
2684             size = bufSize;
2685             ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
2686             ok(ret,
2687              "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2688             ok(pUsage->cUsageIdentifier == 1, "Expected 1 usage, got %d\n",
2689              pUsage->cUsageIdentifier);
2690             ok(!strcmp(pUsage->rgpszUsageIdentifier[0], szOID_RSA_RSA),
2691              "Expected %s, got %s\n", szOID_RSA_RSA,
2692              pUsage->rgpszUsageIdentifier[0]);
2693             HeapFree(GetProcessHeap(), 0, buf);
2694         }
2695         /* But querying the cert directly returns its usage */
2696         ret = CertGetEnhancedKeyUsage(context,
2697          CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG, NULL, &bufSize);
2698         ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2699         buf = HeapAlloc(GetProcessHeap(), 0, bufSize);
2700         if (buf)
2701         {
2702             PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
2703
2704             size = bufSize;
2705             ret = CertGetEnhancedKeyUsage(context,
2706              CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2707             ok(ret,
2708              "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2709             ok(pUsage->cUsageIdentifier == 3, "Expected 3 usages, got %d\n",
2710              pUsage->cUsageIdentifier);
2711             for (i = 0; i < pUsage->cUsageIdentifier; i++)
2712                 ok(!strcmp(pUsage->rgpszUsageIdentifier[i], keyUsages[i]),
2713                  "Expected %s, got %s\n", keyUsages[i],
2714                  pUsage->rgpszUsageIdentifier[i]);
2715             HeapFree(GetProcessHeap(), 0, buf);
2716         }
2717         /* And removing the only usage identifier in the extended property
2718          * results in the cert's key usage being found.
2719          */
2720         ret = CertRemoveEnhancedKeyUsageIdentifier(context, szOID_RSA_RSA);
2721         ok(ret, "CertRemoveEnhancedKeyUsage failed: %08x\n", GetLastError());
2722         ret = CertGetEnhancedKeyUsage(context, 0, NULL, &bufSize);
2723         ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2724         buf = HeapAlloc(GetProcessHeap(), 0, bufSize);
2725         if (buf)
2726         {
2727             PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
2728
2729             /* Should find it as either */
2730             size = bufSize;
2731             ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
2732             ok(ret,
2733              "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
2734             ok(pUsage->cUsageIdentifier == 3, "Expected 3 usages, got %d\n",
2735              pUsage->cUsageIdentifier);
2736             for (i = 0; i < pUsage->cUsageIdentifier; i++)
2737                 ok(!strcmp(pUsage->rgpszUsageIdentifier[i], keyUsages[i]),
2738                  "Expected %s, got %s\n", keyUsages[i],
2739                  pUsage->rgpszUsageIdentifier[i]);
2740             HeapFree(GetProcessHeap(), 0, buf);
2741         }
2742
2743         CertFreeCertificateContext(context);
2744     }
2745 }
2746
2747 static const BYTE cert2WithUsage[] = {
2748 0x30,0x81,0x89,0x02,0x01,0x01,0x30,0x02,0x06,0x00,0x30,0x15,0x31,0x13,0x30,
2749 0x11,0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,
2750 0x6e,0x67,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,0x31,
2751 0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,
2752 0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x15,0x31,0x13,0x30,0x11,
2753 0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,
2754 0x67,0x00,0x30,0x07,0x30,0x02,0x06,0x00,0x03,0x01,0x00,0xa3,0x25,0x30,0x23,
2755 0x30,0x21,0x06,0x03,0x55,0x1d,0x25,0x01,0x01,0xff,0x04,0x17,0x30,0x15,0x06,
2756 0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x03,0x02,0x06,0x09,0x2a,0x86,0x48,0x86,
2757 0xf7,0x0d,0x01,0x01,0x01 };
2758
2759 static void testGetValidUsages(void)
2760 {
2761     static const LPCSTR expectedOIDs[] = {
2762      "1.3.6.1.5.5.7.3.3",
2763      "1.3.6.1.5.5.7.3.2",
2764      "1.2.840.113549.1.1.1",
2765     };
2766     static const LPCSTR expectedOIDs2[] = {
2767      "1.3.6.1.5.5.7.3.2",
2768      "1.2.840.113549.1.1.1",
2769     };
2770     BOOL ret;
2771     int numOIDs;
2772     DWORD size;
2773     LPSTR *oids = NULL;
2774     PCCERT_CONTEXT contexts[3];
2775
2776     if (!pCertGetValidUsages)
2777     {
2778         win_skip("CertGetValidUsages() is not available\n");
2779         return;
2780     }
2781
2782     /* Crash
2783     ret = pCertGetValidUsages(0, NULL, NULL, NULL, NULL);
2784     ret = pCertGetValidUsages(0, NULL, NULL, NULL, &size);
2785      */
2786     contexts[0] = NULL;
2787     numOIDs = size = 0xdeadbeef;
2788     SetLastError(0xdeadbeef);
2789     ret = pCertGetValidUsages(1, &contexts[0], &numOIDs, NULL, &size);
2790     ok(ret, "CertGetValidUsages failed: %d\n", GetLastError());
2791     ok(numOIDs == -1, "Expected -1, got %d\n", numOIDs);
2792     ok(size == 0, "Expected size 0, got %d\n", size);
2793     contexts[0] = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert,
2794      sizeof(bigCert));
2795     contexts[1] = CertCreateCertificateContext(X509_ASN_ENCODING, certWithUsage,
2796      sizeof(certWithUsage));
2797     contexts[2] = CertCreateCertificateContext(X509_ASN_ENCODING,
2798      cert2WithUsage, sizeof(cert2WithUsage));
2799     numOIDs = size = 0xdeadbeef;
2800     ret = pCertGetValidUsages(0, NULL, &numOIDs, NULL, &size);
2801     ok(ret, "CertGetValidUsages failed: %08x\n", GetLastError());
2802     ok(numOIDs == -1, "Expected -1, got %d\n", numOIDs);
2803     ok(size == 0, "Expected size 0, got %d\n", size);
2804     numOIDs = size = 0xdeadbeef;
2805     ret = pCertGetValidUsages(1, contexts, &numOIDs, NULL, &size);
2806     ok(ret, "CertGetValidUsages failed: %08x\n", GetLastError());
2807     ok(numOIDs == -1, "Expected -1, got %d\n", numOIDs);
2808     ok(size == 0, "Expected size 0, got %d\n", size);
2809     ret = pCertGetValidUsages(1, &contexts[1], &numOIDs, NULL, &size);
2810     ok(ret, "CertGetValidUsages failed: %08x\n", GetLastError());
2811     ok(numOIDs == 3, "Expected 3, got %d\n", numOIDs);
2812     ok(size, "Expected non-zero size\n");
2813     oids = HeapAlloc(GetProcessHeap(), 0, size);
2814     if (oids)
2815     {
2816         int i;
2817         DWORD smallSize = 1;
2818
2819         SetLastError(0xdeadbeef);
2820         ret = pCertGetValidUsages(1, &contexts[1], &numOIDs, oids, &smallSize);
2821         ok(!ret && GetLastError() == ERROR_MORE_DATA,
2822          "Expected ERROR_MORE_DATA, got %d\n", GetLastError());
2823         ret = pCertGetValidUsages(1, &contexts[1], &numOIDs, oids, &size);
2824         ok(ret, "CertGetValidUsages failed: %08x\n", GetLastError());
2825         for (i = 0; i < numOIDs; i++)
2826             ok(!lstrcmpA(oids[i], expectedOIDs[i]), "unexpected OID %s\n",
2827              oids[i]);
2828         HeapFree(GetProcessHeap(), 0, oids);
2829     }
2830     numOIDs = size = 0xdeadbeef;
2831     /* Oddly enough, this crashes when the number of contexts is not 1:
2832     ret = pCertGetValidUsages(2, contexts, &numOIDs, NULL, &size);
2833      * but setting size to 0 allows it to succeed:
2834      */
2835     size = 0;
2836     ret = pCertGetValidUsages(2, contexts, &numOIDs, NULL, &size);
2837     ok(ret, "CertGetValidUsages failed: %08x\n", GetLastError());
2838     ok(numOIDs == 3, "Expected 3, got %d\n", numOIDs);
2839     ok(size, "Expected non-zero size\n");
2840     oids = HeapAlloc(GetProcessHeap(), 0, size);
2841     if (oids)
2842     {
2843         int i;
2844
2845         ret = pCertGetValidUsages(1, &contexts[1], &numOIDs, oids, &size);
2846         ok(ret, "CertGetValidUsages failed: %08x\n", GetLastError());
2847         for (i = 0; i < numOIDs; i++)
2848             ok(!lstrcmpA(oids[i], expectedOIDs[i]), "unexpected OID %s\n",
2849              oids[i]);
2850         HeapFree(GetProcessHeap(), 0, oids);
2851     }
2852     numOIDs = 0xdeadbeef;
2853     size = 0;
2854     ret = pCertGetValidUsages(1, &contexts[2], &numOIDs, NULL, &size);
2855     ok(ret, "CertGetValidUsages failed: %08x\n", GetLastError());
2856     ok(numOIDs == 2, "Expected 2, got %d\n", numOIDs);
2857     ok(size, "Expected non-zero size\n");
2858     oids = HeapAlloc(GetProcessHeap(), 0, size);
2859     if (oids)
2860     {
2861         int i;
2862
2863         ret = pCertGetValidUsages(1, &contexts[2], &numOIDs, oids, &size);
2864         ok(ret, "CertGetValidUsages failed: %08x\n", GetLastError());
2865         for (i = 0; i < numOIDs; i++)
2866             ok(!lstrcmpA(oids[i], expectedOIDs2[i]), "unexpected OID %s\n",
2867              oids[i]);
2868         HeapFree(GetProcessHeap(), 0, oids);
2869     }
2870     numOIDs = 0xdeadbeef;
2871     size = 0;
2872     ret = pCertGetValidUsages(3, contexts, &numOIDs, NULL, &size);
2873     ok(ret, "CertGetValidUsages failed: %08x\n", GetLastError());
2874     ok(numOIDs == 2, "Expected 2, got %d\n", numOIDs);
2875     ok(size, "Expected non-zero size\n");
2876     oids = HeapAlloc(GetProcessHeap(), 0, size);
2877     if (oids)
2878     {
2879         int i;
2880
2881         ret = pCertGetValidUsages(3, contexts, &numOIDs, oids, &size);
2882         ok(ret, "CertGetValidUsages failed: %08x\n", GetLastError());
2883         for (i = 0; i < numOIDs; i++)
2884             ok(!lstrcmpA(oids[i], expectedOIDs2[i]), "unexpected OID %s\n",
2885              oids[i]);
2886         HeapFree(GetProcessHeap(), 0, oids);
2887     }
2888     CertFreeCertificateContext(contexts[0]);
2889     CertFreeCertificateContext(contexts[1]);
2890     CertFreeCertificateContext(contexts[2]);
2891 }
2892
2893 static BYTE cn[] = {
2894 0x30,0x14,0x31,0x12,0x30,0x10,0x06,0x03,0x55,0x04,0x03,0x13,0x09,0x4a,0x75,
2895 0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67 };
2896 static BYTE cnWithLeadingSpace[] = {
2897 0x30,0x15,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x20,0x4a,
2898 0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67 };
2899 static BYTE cnWithTrailingSpace[] = {
2900 0x30,0x15,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,
2901 0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x20 };
2902 static BYTE cnWithIntermediateSpace[] = {
2903 0x30,0x15,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,
2904 0x61,0x6e,0x20,0x20,0x4c,0x61,0x6e,0x67 };
2905 static BYTE cnThenO[] = {
2906 0x30,0x2d,0x31,0x2b,0x30,0x10,0x06,0x03,0x55,0x04,0x03,0x13,0x09,0x4a,0x75,
2907 0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x30,0x17,0x06,0x03,0x55,0x04,0x0a,0x13,
2908 0x10,0x54,0x68,0x65,0x20,0x57,0x69,0x6e,0x65,0x20,0x50,0x72,0x6f,0x6a,0x65,
2909 0x63,0x74 };
2910 static BYTE oThenCN[] = {
2911 0x30,0x2d,0x31,0x2b,0x30,0x10,0x06,0x03,0x55,0x04,0x0a,0x13,0x09,0x4a,0x75,
2912 0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x30,0x17,0x06,0x03,0x55,0x04,0x03,0x13,
2913 0x10,0x54,0x68,0x65,0x20,0x57,0x69,0x6e,0x65,0x20,0x50,0x72,0x6f,0x6a,0x65,
2914 0x63,0x74 };
2915
2916 static void testCompareCertName(void)
2917 {
2918     static BYTE bogus[] = { 1, 2, 3, 4 };
2919     static BYTE bogusPrime[] = { 0, 1, 2, 3, 4 };
2920     static BYTE emptyPrime[] = { 0x30, 0x00, 0x01 };
2921     BOOL ret;
2922     CERT_NAME_BLOB blob1, blob2;
2923
2924     /* crashes
2925     ret = CertCompareCertificateName(0, NULL, NULL);
2926      */
2927     /* An empty name checks against itself.. */
2928     blob1.pbData = emptyCert;
2929     blob1.cbData = sizeof(emptyCert);
2930     ret = CertCompareCertificateName(0, &blob1, &blob1);
2931     ok(ret, "CertCompareCertificateName failed: %08x\n", GetLastError());
2932     /* It doesn't have to be a valid encoded name.. */
2933     blob1.pbData = bogus;
2934     blob1.cbData = sizeof(bogus);
2935     ret = CertCompareCertificateName(0, &blob1, &blob1);
2936     ok(ret, "CertCompareCertificateName failed: %08x\n", GetLastError());
2937     /* Leading zeroes matter.. */
2938     blob2.pbData = bogusPrime;
2939     blob2.cbData = sizeof(bogusPrime);
2940     ret = CertCompareCertificateName(0, &blob1, &blob2);
2941     ok(!ret, "Expected failure\n");
2942     /* As do trailing extra bytes. */
2943     blob2.pbData = emptyPrime;
2944     blob2.cbData = sizeof(emptyPrime);
2945     ret = CertCompareCertificateName(0, &blob1, &blob2);
2946     ok(!ret, "Expected failure\n");
2947     /* Tests to show that CertCompareCertificateName doesn't decode the name
2948      * to remove spaces, or to do an order-independent comparison.
2949      */
2950     /* Compare CN="Juan Lang" with CN=" Juan Lang" */
2951     blob1.pbData = cn;
2952     blob1.cbData = sizeof(cn);
2953     blob2.pbData = cnWithLeadingSpace;
2954     blob2.cbData = sizeof(cnWithLeadingSpace);
2955     ret = CertCompareCertificateName(0, &blob1, &blob2);
2956     ok(!ret, "Expected failure\n");
2957     ret = CertCompareCertificateName(X509_ASN_ENCODING, &blob1, &blob2);
2958     ok(!ret, "Expected failure\n");
2959     /* Compare CN="Juan Lang" with CN="Juan Lang " */
2960     blob2.pbData = cnWithTrailingSpace;
2961     blob2.cbData = sizeof(cnWithTrailingSpace);
2962     ret = CertCompareCertificateName(0, &blob1, &blob2);
2963     ok(!ret, "Expected failure\n");
2964     ret = CertCompareCertificateName(X509_ASN_ENCODING, &blob1, &blob2);
2965     ok(!ret, "Expected failure\n");
2966     /* Compare CN="Juan Lang" with CN="Juan  Lang" */
2967     blob2.pbData = cnWithIntermediateSpace;
2968     blob2.cbData = sizeof(cnWithIntermediateSpace);
2969     ret = CertCompareCertificateName(0, &blob1, &blob2);
2970     ok(!ret, "Expected failure\n");
2971     ret = CertCompareCertificateName(X509_ASN_ENCODING, &blob1, &blob2);
2972     ok(!ret, "Expected failure\n");
2973     /* Compare 'CN="Juan Lang", O="The Wine Project"' with
2974      * 'O="The Wine Project", CN="Juan Lang"'
2975      */
2976     blob1.pbData = cnThenO;
2977     blob1.cbData = sizeof(cnThenO);
2978     blob2.pbData = oThenCN;
2979     blob2.cbData = sizeof(oThenCN);
2980     ret = CertCompareCertificateName(0, &blob1, &blob2);
2981     ok(!ret, "Expected failure\n");
2982     ret = CertCompareCertificateName(X509_ASN_ENCODING, &blob1, &blob2);
2983     ok(!ret, "Expected failure\n");
2984 }
2985
2986 static void testIsRDNAttrsInCertificateName(void)
2987 {
2988     static char oid_1_2_3[] = "1.2.3";
2989     static char oid_common_name[] = szOID_COMMON_NAME;
2990     static char oid_organization[] = szOID_ORGANIZATION_NAME;
2991     static char juan[] = "Juan Lang";
2992     static char juan_with_leading_space[] = " Juan Lang";
2993     static char juan_with_intermediate_space[] = "Juan  Lang";
2994     static char juan_with_trailing_space[] = "Juan Lang ";
2995     static char juan_lower_case[] = "juan lang";
2996     static WCHAR juanW[] = { 'J','u','a','n',' ','L','a','n','g',0 };
2997     static char the_wine_project[] = "The Wine Project";
2998     BOOL ret;
2999     CERT_NAME_BLOB name;
3000     CERT_RDN_ATTR attr[2];
3001     CERT_RDN rdn = { 0, NULL };
3002
3003     name.cbData = sizeof(cn);
3004     name.pbData = cn;
3005     if (0)
3006     {
3007         /* Crash */
3008         CertIsRDNAttrsInCertificateName(0, 0, NULL, NULL);
3009         CertIsRDNAttrsInCertificateName(X509_ASN_ENCODING, 0, &name, NULL);
3010     }
3011     SetLastError(0xdeadbeef);
3012     ret = CertIsRDNAttrsInCertificateName(0, 0, &name, NULL);
3013     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
3014      "expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
3015     ret = CertIsRDNAttrsInCertificateName(X509_ASN_ENCODING, 0, &name, &rdn);
3016     ok(ret, "CertIsRDNAttrsInCertificateName failed: %08x\n", GetLastError());
3017     attr[0].pszObjId = oid_1_2_3;
3018     rdn.rgRDNAttr = attr;
3019     rdn.cRDNAttr = 1;
3020     SetLastError(0xdeadbeef);
3021     ret = CertIsRDNAttrsInCertificateName(X509_ASN_ENCODING, 0, &name, &rdn);
3022     ok(!ret && GetLastError() == CRYPT_E_NO_MATCH,
3023      "expected CRYPT_E_NO_MATCH, got %08x\n", GetLastError());
3024     attr[0].pszObjId = oid_common_name;
3025     attr[0].dwValueType = CERT_RDN_PRINTABLE_STRING;
3026     attr[0].Value.cbData = strlen(juan);
3027     attr[0].Value.pbData = (BYTE *)juan;
3028     ret = CertIsRDNAttrsInCertificateName(X509_ASN_ENCODING, 0, &name, &rdn);
3029     ok(ret, "CertIsRDNAttrsInCertificateName failed: %08x\n", GetLastError());
3030     /* Again, spaces are not removed for name comparison. */
3031     attr[0].Value.cbData = strlen(juan_with_leading_space);
3032     attr[0].Value.pbData = (BYTE *)juan_with_leading_space;
3033     SetLastError(0xdeadbeef);
3034     ret = CertIsRDNAttrsInCertificateName(X509_ASN_ENCODING, 0, &name, &rdn);
3035     ok(!ret && GetLastError() == CRYPT_E_NO_MATCH,
3036      "expected CRYPT_E_NO_MATCH, got %08x\n", GetLastError());
3037     attr[0].Value.cbData = strlen(juan_with_intermediate_space);
3038     attr[0].Value.pbData = (BYTE *)juan_with_intermediate_space;
3039     SetLastError(0xdeadbeef);
3040     ret = CertIsRDNAttrsInCertificateName(X509_ASN_ENCODING, 0, &name, &rdn);
3041     ok(!ret && GetLastError() == CRYPT_E_NO_MATCH,
3042      "expected CRYPT_E_NO_MATCH, got %08x\n", GetLastError());
3043     attr[0].Value.cbData = strlen(juan_with_trailing_space);
3044     attr[0].Value.pbData = (BYTE *)juan_with_trailing_space;
3045     SetLastError(0xdeadbeef);
3046     ret = CertIsRDNAttrsInCertificateName(X509_ASN_ENCODING, 0, &name, &rdn);
3047     ok(!ret && GetLastError() == CRYPT_E_NO_MATCH,
3048      "expected CRYPT_E_NO_MATCH, got %08x\n", GetLastError());
3049     /* The lower case name isn't matched unless a case insensitive match is
3050      * specified.
3051      */
3052     attr[0].Value.cbData = strlen(juan_lower_case);
3053     attr[0].Value.pbData = (BYTE *)juan_lower_case;
3054     SetLastError(0xdeadbeef);
3055     ret = CertIsRDNAttrsInCertificateName(X509_ASN_ENCODING, 0, &name, &rdn);
3056     ok(!ret && GetLastError() == CRYPT_E_NO_MATCH,
3057      "expected CRYPT_E_NO_MATCH, got %08x\n", GetLastError());
3058     ret = CertIsRDNAttrsInCertificateName(X509_ASN_ENCODING,
3059      CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG, &name, &rdn);
3060     ok(ret ||
3061      broken(!ret && GetLastError() == CRYPT_E_NO_MATCH), /* Older crypt32 */
3062      "CertIsRDNAttrsInCertificateName failed: %08x\n", GetLastError());
3063     /* The values don't match unless they have the same RDN type */
3064     attr[0].dwValueType = CERT_RDN_UNICODE_STRING;
3065     attr[0].Value.cbData = lstrlenW(juanW) * sizeof(WCHAR);
3066     attr[0].Value.pbData = (BYTE *)juanW;
3067     SetLastError(0xdeadbeef);
3068     ret = CertIsRDNAttrsInCertificateName(X509_ASN_ENCODING, 0, &name, &rdn);
3069     ok(!ret && GetLastError() == CRYPT_E_NO_MATCH,
3070      "expected CRYPT_E_NO_MATCH, got %08x\n", GetLastError());
3071     SetLastError(0xdeadbeef);
3072     ret = CertIsRDNAttrsInCertificateName(X509_ASN_ENCODING,
3073      CERT_UNICODE_IS_RDN_ATTRS_FLAG, &name, &rdn);
3074     ok(!ret && GetLastError() == CRYPT_E_NO_MATCH,
3075      "expected CRYPT_E_NO_MATCH, got %08x\n", GetLastError());
3076     attr[0].dwValueType = CERT_RDN_IA5_STRING;
3077     attr[0].Value.cbData = strlen(juan);
3078     attr[0].Value.pbData = (BYTE *)juan;
3079     SetLastError(0xdeadbeef);
3080     ret = CertIsRDNAttrsInCertificateName(X509_ASN_ENCODING, 0, &name, &rdn);
3081     ok(!ret && GetLastError() == CRYPT_E_NO_MATCH,
3082      "expected CRYPT_E_NO_MATCH, got %08x\n", GetLastError());
3083     /* All attributes must be present */
3084     attr[0].dwValueType = CERT_RDN_PRINTABLE_STRING;
3085     attr[0].Value.cbData = strlen(juan);
3086     attr[0].Value.pbData = (BYTE *)juan;
3087     attr[1].pszObjId = oid_organization;
3088     attr[1].dwValueType = CERT_RDN_PRINTABLE_STRING;
3089     attr[1].Value.cbData = strlen(the_wine_project);
3090     attr[1].Value.pbData = (BYTE *)the_wine_project;
3091     rdn.cRDNAttr = 2;
3092     SetLastError(0xdeadbeef);
3093     ret = CertIsRDNAttrsInCertificateName(X509_ASN_ENCODING, 0, &name, &rdn);
3094     ok(!ret && GetLastError() == CRYPT_E_NO_MATCH,
3095      "expected CRYPT_E_NO_MATCH, got %08x\n", GetLastError());
3096     /* Order also matters */
3097     name.pbData = cnThenO;
3098     name.cbData = sizeof(cnThenO);
3099     ret = CertIsRDNAttrsInCertificateName(X509_ASN_ENCODING, 0, &name, &rdn);
3100     ok(ret, "CertIsRDNAttrsInCertificateName failed: %08x\n", GetLastError());
3101     name.pbData = oThenCN;
3102     name.cbData = sizeof(oThenCN);
3103     SetLastError(0xdeadbeef);
3104     ret = CertIsRDNAttrsInCertificateName(X509_ASN_ENCODING, 0, &name, &rdn);
3105     ok(!ret && GetLastError() == CRYPT_E_NO_MATCH,
3106      "expected CRYPT_E_NO_MATCH, got %08x\n", GetLastError());
3107 }
3108
3109 static BYTE int1[] = { 0x88, 0xff, 0xff, 0xff };
3110 static BYTE int2[] = { 0x88, 0xff };
3111 static BYTE int3[] = { 0x23, 0xff };
3112 static BYTE int4[] = { 0x7f, 0x00 };
3113 static BYTE int5[] = { 0x7f };
3114 static BYTE int6[] = { 0x80, 0x00, 0x00, 0x00 };
3115 static BYTE int7[] = { 0x80, 0x00 };
3116
3117 static struct IntBlobTest
3118 {
3119     CRYPT_INTEGER_BLOB blob1;
3120     CRYPT_INTEGER_BLOB blob2;
3121     BOOL areEqual;
3122 } intBlobs[] = {
3123  { { sizeof(int1), int1 }, { sizeof(int2), int2 }, TRUE },
3124  { { sizeof(int3), int3 }, { sizeof(int3), int3 }, TRUE },
3125  { { sizeof(int4), int4 }, { sizeof(int5), int5 }, TRUE },
3126  { { sizeof(int6), int6 }, { sizeof(int7), int7 }, TRUE },
3127  { { sizeof(int1), int1 }, { sizeof(int7), int7 }, FALSE },
3128 };
3129
3130 static void testCompareIntegerBlob(void)
3131 {
3132     DWORD i;
3133     BOOL ret;
3134
3135     for (i = 0; i < sizeof(intBlobs) / sizeof(intBlobs[0]); i++)
3136     {
3137         ret = CertCompareIntegerBlob(&intBlobs[i].blob1, &intBlobs[i].blob2);
3138         ok(ret == intBlobs[i].areEqual,
3139          "%d: expected blobs %s compare\n", i, intBlobs[i].areEqual ?
3140          "to" : "not to");
3141     }
3142 }
3143
3144 static void testComparePublicKeyInfo(void)
3145 {
3146     BOOL ret;
3147     CERT_PUBLIC_KEY_INFO info1 = { { 0 } }, info2 = { { 0 } };
3148     static CHAR oid_rsa_rsa[]     = szOID_RSA_RSA;
3149     static CHAR oid_rsa_sha1rsa[] = szOID_RSA_SHA1RSA;
3150     static CHAR oid_x957_dsa[]    = szOID_X957_DSA;
3151     static BYTE bits1[] = { 1, 0 };
3152     static BYTE bits2[] = { 0 };
3153     static BYTE bits3[] = { 1 };
3154     static BYTE bits4[] = { 0x30,8, 2,1,0x81, 2,3,1,0,1 };
3155     static BYTE bits5[] = { 0x30,9, 2,2,0,0x81, 2,3,1,0,1 };
3156     static BYTE bits6[] = { 0x30,9, 2,2,0,0x82, 2,3,1,0,1 };
3157
3158     /* crashes
3159     ret = CertComparePublicKeyInfo(0, NULL, NULL);
3160      */
3161     /* Empty public keys compare */
3162     ret = CertComparePublicKeyInfo(0, &info1, &info2);
3163     ok(ret, "CertComparePublicKeyInfo failed: %08x\n", GetLastError());
3164     /* Different OIDs appear to compare */
3165     info1.Algorithm.pszObjId = oid_rsa_rsa;
3166     info2.Algorithm.pszObjId = oid_rsa_sha1rsa;
3167     ret = CertComparePublicKeyInfo(0, &info1, &info2);
3168     ok(ret, "CertComparePublicKeyInfo failed: %08x\n", GetLastError());
3169     info2.Algorithm.pszObjId = oid_x957_dsa;
3170     ret = CertComparePublicKeyInfo(0, &info1, &info2);
3171     ok(ret, "CertComparePublicKeyInfo failed: %08x\n", GetLastError());
3172     info1.PublicKey.cbData = sizeof(bits1);
3173     info1.PublicKey.pbData = bits1;
3174     info1.PublicKey.cUnusedBits = 0;
3175     info2.PublicKey.cbData = sizeof(bits1);
3176     info2.PublicKey.pbData = bits1;
3177     info2.PublicKey.cUnusedBits = 0;
3178     ret = CertComparePublicKeyInfo(0, &info1, &info2);
3179     ok(ret, "CertComparePublicKeyInfo failed: %08x\n", GetLastError());
3180     info2.Algorithm.pszObjId = oid_rsa_rsa;
3181     info1.PublicKey.cbData = sizeof(bits4);
3182     info1.PublicKey.pbData = bits4;
3183     info1.PublicKey.cUnusedBits = 0;
3184     info2.PublicKey.cbData = sizeof(bits5);
3185     info2.PublicKey.pbData = bits5;
3186     info2.PublicKey.cUnusedBits = 0;
3187     ret = CertComparePublicKeyInfo(0, &info1, &info2);
3188     ok(!ret, "CertComparePublicKeyInfo: as raw binary: keys should be unequal\n");
3189     ret = CertComparePublicKeyInfo(X509_ASN_ENCODING, &info1, &info2);
3190     ok(ret ||
3191      broken(!ret), /* win9x */
3192      "CertComparePublicKeyInfo: as ASN.1 encoded: keys should be equal\n");
3193     info1.PublicKey.cUnusedBits = 1;
3194     info2.PublicKey.cUnusedBits = 5;
3195     ret = CertComparePublicKeyInfo(X509_ASN_ENCODING, &info1, &info2);
3196     ok(ret ||
3197      broken(!ret), /* win9x */
3198      "CertComparePublicKeyInfo: ASN.1 encoding should ignore cUnusedBits\n");
3199     info1.PublicKey.cUnusedBits = 0;
3200     info2.PublicKey.cUnusedBits = 0;
3201     info1.PublicKey.cbData--; /* kill one byte, make ASN.1 encoded data invalid */
3202     ret = CertComparePublicKeyInfo(X509_ASN_ENCODING, &info1, &info2);
3203     ok(!ret, "CertComparePublicKeyInfo: comparing bad ASN.1 encoded key should fail\n");
3204     /* Even though they compare in their used bits, these do not compare */
3205     info1.PublicKey.cbData = sizeof(bits2);
3206     info1.PublicKey.pbData = bits2;
3207     info1.PublicKey.cUnusedBits = 0;
3208     info2.PublicKey.cbData = sizeof(bits3);
3209     info2.PublicKey.pbData = bits3;
3210     info2.PublicKey.cUnusedBits = 1;
3211     ret = CertComparePublicKeyInfo(0, &info1, &info2);
3212     /* Simple (non-comparing) case */
3213     ok(!ret, "Expected keys not to compare\n");
3214     info2.PublicKey.cbData = sizeof(bits1);
3215     info2.PublicKey.pbData = bits1;
3216     info2.PublicKey.cUnusedBits = 0;
3217     ret = CertComparePublicKeyInfo(0, &info1, &info2);
3218     ok(!ret, "Expected keys not to compare\n");
3219     /* ASN.1 encoded non-comparing case */
3220     info1.PublicKey.cbData = sizeof(bits5);
3221     info1.PublicKey.pbData = bits5;
3222     info1.PublicKey.cUnusedBits = 0;
3223     info2.PublicKey.cbData = sizeof(bits6);
3224     info2.PublicKey.pbData = bits6;
3225     info2.PublicKey.cUnusedBits = 0;
3226     ret = CertComparePublicKeyInfo(X509_ASN_ENCODING, &info1, &info2);
3227     ok(!ret, "CertComparePublicKeyInfo: different keys should be unequal\n");
3228 }
3229
3230 static void testHashPublicKeyInfo(void)
3231 {
3232     BOOL ret;
3233     CERT_PUBLIC_KEY_INFO info = { { 0 } };
3234     DWORD len;
3235
3236     /* Crash
3237     ret = CryptHashPublicKeyInfo(0, 0, 0, 0, NULL, NULL, NULL);
3238     ret = CryptHashPublicKeyInfo(0, 0, 0, 0, &info, NULL, NULL);
3239      */
3240     ret = CryptHashPublicKeyInfo(0, 0, 0, 0, NULL, NULL, &len);
3241     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
3242      "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
3243     /* Crashes on some win9x boxes */
3244     if (0)
3245     {
3246         ret = CryptHashPublicKeyInfo(0, 0, 0, X509_ASN_ENCODING, NULL, NULL, &len);
3247         ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
3248          "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
3249     }
3250     ret = CryptHashPublicKeyInfo(0, 0, 0, X509_ASN_ENCODING, &info, NULL, &len);
3251     ok(ret ||
3252      broken(!ret), /* win9x */
3253      "CryptHashPublicKeyInfo failed: %08x\n", GetLastError());
3254     if (ret)
3255     {
3256         ok(len == 16, "Expected hash size 16, got %d\n", len);
3257         if (len == 16)
3258         {
3259             static const BYTE emptyHash[] = { 0xb8,0x51,0x3a,0x31,0x0e,0x9f,0x40,
3260              0x36,0x9c,0x92,0x45,0x1b,0x9d,0xc8,0xf9,0xf6 };
3261             BYTE buf[16];
3262
3263             ret = CryptHashPublicKeyInfo(0, 0, 0, X509_ASN_ENCODING, &info, buf,
3264              &len);
3265             ok(ret, "CryptHashPublicKeyInfo failed: %08x\n", GetLastError());
3266             ok(!memcmp(buf, emptyHash, len), "Unexpected hash\n");
3267         }
3268     }
3269 }
3270
3271 static const BYTE md5SignedEmptyCertHash[] = { 0xfb,0x0f,0x66,0x82,0x66,0xd9,
3272  0xe5,0xf8,0xd8,0xa2,0x55,0x2b,0xe1,0xa5,0xd9,0x04 };
3273
3274 static void testHashToBeSigned(void)
3275 {
3276     BOOL ret;
3277     DWORD size;
3278     BYTE hash[16];
3279
3280     /* Crash */
3281     if (0)
3282     {
3283         CryptHashToBeSigned(0, 0, NULL, 0, NULL, NULL);
3284     }
3285     SetLastError(0xdeadbeef);
3286     ret = CryptHashToBeSigned(0, 0, NULL, 0, NULL, &size);
3287     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
3288      "expected ERROR_FILE_NOT_FOUND, got %d\n", GetLastError());
3289     SetLastError(0xdeadbeef);
3290     ret = CryptHashToBeSigned(0, X509_ASN_ENCODING, NULL, 0, NULL, &size);
3291     ok(!ret &&
3292      (GetLastError() == CRYPT_E_ASN1_EOD ||
3293       GetLastError() == OSS_BAD_ARG), /* win9x */
3294      "expected CRYPT_E_ASN1_EOD, got %08x\n", GetLastError());
3295     /* Can't sign anything:  has to be asn.1 encoded, at least */
3296     SetLastError(0xdeadbeef);
3297     ret = CryptHashToBeSigned(0, X509_ASN_ENCODING, int1, sizeof(int1),
3298      NULL, &size);
3299     ok(!ret &&
3300      (GetLastError() == CRYPT_E_ASN1_BADTAG ||
3301       GetLastError() == OSS_MORE_INPUT), /* win9x */
3302      "expected CRYPT_E_ASN1_BADTAG, got %08x\n", GetLastError());
3303     /* Can't be empty, either */
3304     SetLastError(0xdeadbeef);
3305     ret = CryptHashToBeSigned(0, X509_ASN_ENCODING, emptyCert,
3306      sizeof(emptyCert), NULL, &size);
3307     ok(!ret &&
3308      (GetLastError() == CRYPT_E_ASN1_CORRUPT ||
3309       GetLastError() == OSS_DATA_ERROR), /* win9x */
3310      "expected CRYPT_E_ASN1_CORRUPT, got %08x\n", GetLastError());
3311     /* Signing a cert works */
3312     ret = CryptHashToBeSigned(0, X509_ASN_ENCODING, md5SignedEmptyCert,
3313      sizeof(md5SignedEmptyCert), NULL, &size);
3314     ok(ret ||
3315      broken(!ret), /* win9x */
3316      "CryptHashToBeSigned failed: %08x\n", GetLastError());
3317     if (ret)
3318     {
3319         ok(size == sizeof(md5SignedEmptyCertHash), "unexpected size %d\n", size);
3320     }
3321
3322     ret = CryptHashToBeSigned(0, X509_ASN_ENCODING, md5SignedEmptyCert,
3323      sizeof(md5SignedEmptyCert), hash, &size);
3324     ok(ret || broken(!ret && GetLastError() == NTE_BAD_ALGID) /* NT4 */,
3325      "CryptHashToBeSigned failed: %08x\n", GetLastError());
3326
3327     ok(!memcmp(hash, md5SignedEmptyCertHash, size), "unexpected value\n");
3328 }
3329
3330 static void testCompareCert(void)
3331 {
3332     CERT_INFO info1 = { 0 }, info2 = { 0 };
3333     BOOL ret;
3334
3335     /* Crashes */
3336     if (0)
3337         CertCompareCertificate(X509_ASN_ENCODING, NULL, NULL);
3338
3339     /* Certs with the same issuer and serial number are equal, even if they
3340      * differ in other respects (like subject).
3341      */
3342     info1.SerialNumber.pbData = serialNum;
3343     info1.SerialNumber.cbData = sizeof(serialNum);
3344     info1.Issuer.pbData = subjectName;
3345     info1.Issuer.cbData = sizeof(subjectName);
3346     info1.Subject.pbData = subjectName2;
3347     info1.Subject.cbData = sizeof(subjectName2);
3348     info2.SerialNumber.pbData = serialNum;
3349     info2.SerialNumber.cbData = sizeof(serialNum);
3350     info2.Issuer.pbData = subjectName;
3351     info2.Issuer.cbData = sizeof(subjectName);
3352     info2.Subject.pbData = subjectName;
3353     info2.Subject.cbData = sizeof(subjectName);
3354     ret = CertCompareCertificate(X509_ASN_ENCODING, &info1, &info2);
3355     ok(ret, "Expected certs to be equal\n");
3356
3357     info2.Issuer.pbData = subjectName2;
3358     info2.Issuer.cbData = sizeof(subjectName2);
3359     ret = CertCompareCertificate(X509_ASN_ENCODING, &info1, &info2);
3360     ok(!ret, "Expected certs not to be equal\n");
3361 }
3362
3363 static void testVerifySubjectCert(void)
3364 {
3365     BOOL ret;
3366     DWORD flags;
3367     PCCERT_CONTEXT context1, context2;
3368
3369     /* Crashes
3370     ret = CertVerifySubjectCertificateContext(NULL, NULL, NULL);
3371      */
3372     flags = 0;
3373     ret = CertVerifySubjectCertificateContext(NULL, NULL, &flags);
3374     ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
3375      GetLastError());
3376     flags = CERT_STORE_NO_CRL_FLAG;
3377     ret = CertVerifySubjectCertificateContext(NULL, NULL, &flags);
3378     ok(!ret && GetLastError() == E_INVALIDARG,
3379      "Expected E_INVALIDARG, got %08x\n", GetLastError());
3380
3381     flags = 0;
3382     context1 = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert,
3383      sizeof(bigCert));
3384     ret = CertVerifySubjectCertificateContext(NULL, context1, &flags);
3385     ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
3386      GetLastError());
3387     ret = CertVerifySubjectCertificateContext(context1, NULL, &flags);
3388     ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
3389      GetLastError());
3390     ret = CertVerifySubjectCertificateContext(context1, context1, &flags);
3391     ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
3392      GetLastError());
3393
3394     context2 = CertCreateCertificateContext(X509_ASN_ENCODING,
3395      bigCertWithDifferentSubject, sizeof(bigCertWithDifferentSubject));
3396     SetLastError(0xdeadbeef);
3397     ret = CertVerifySubjectCertificateContext(context1, context2, &flags);
3398     ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
3399      GetLastError());
3400     flags = CERT_STORE_REVOCATION_FLAG;
3401     ret = CertVerifySubjectCertificateContext(context1, context2, &flags);
3402     ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
3403      GetLastError());
3404     ok(flags == (CERT_STORE_REVOCATION_FLAG | CERT_STORE_NO_CRL_FLAG),
3405      "Expected CERT_STORE_REVOCATION_FLAG | CERT_STORE_NO_CRL_FLAG, got %08x\n",
3406      flags);
3407     flags = CERT_STORE_SIGNATURE_FLAG;
3408     ret = CertVerifySubjectCertificateContext(context1, context2, &flags);
3409     ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
3410      GetLastError());
3411     ok(flags == CERT_STORE_SIGNATURE_FLAG,
3412      "Expected CERT_STORE_SIGNATURE_FLAG, got %08x\n", flags);
3413     CertFreeCertificateContext(context2);
3414
3415     CertFreeCertificateContext(context1);
3416 }
3417
3418 static const BYTE rootWithKeySignAndCRLSign[] = {
3419 0x30,0x82,0x01,0xdf,0x30,0x82,0x01,0x4c,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
3420 0x5b,0xc7,0x0b,0x27,0x99,0xbb,0x2e,0x99,0x47,0x9d,0x45,0x4e,0x7c,0x1a,0xca,
3421 0xe8,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
3422 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
3423 0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
3424 0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
3425 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
3426 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
3427 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
3428 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
3429 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
3430 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
3431 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
3432 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
3433 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
3434 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
3435 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
3436 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
3437 0x00,0x01,0xa3,0x42,0x30,0x40,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,0x01,
3438 0xff,0x04,0x04,0x03,0x02,0x00,0x06,0x30,0x0f,0x06,0x03,0x55,0x1d,0x13,0x01,
3439 0x01,0xff,0x04,0x05,0x30,0x03,0x01,0x01,0xff,0x30,0x1d,0x06,0x03,0x55,0x1d,
3440 0x0e,0x04,0x16,0x04,0x14,0x14,0x8c,0x16,0xbb,0xbe,0x70,0xa2,0x28,0x89,0xa0,
3441 0x58,0xff,0x98,0xbd,0xa8,0x24,0x2b,0x8a,0xe9,0x9a,0x30,0x09,0x06,0x05,0x2b,
3442 0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x81,0x81,0x00,0x74,0xcb,0x21,0xfd,0x2d,
3443 0x25,0xdc,0xa5,0xaa,0xa1,0x26,0xdc,0x8b,0x40,0x11,0x64,0xae,0x5c,0x71,0x3c,
3444 0x28,0xbc,0xf9,0xb3,0xcb,0xa5,0x94,0xb2,0x8d,0x4c,0x23,0x2b,0x9b,0xde,0x2c,
3445 0x4c,0x30,0x04,0xc6,0x88,0x10,0x2f,0x53,0xfd,0x6c,0x82,0xf1,0x13,0xfb,0xda,
3446 0x27,0x75,0x25,0x48,0xe4,0x72,0x09,0x2a,0xee,0xb4,0x1e,0xc9,0x55,0xf5,0xf7,
3447 0x82,0x91,0xd8,0x4b,0xe4,0x3a,0xfe,0x97,0x87,0xdf,0xfb,0x15,0x5a,0x12,0x3e,
3448 0x12,0xe6,0xad,0x40,0x0b,0xcf,0xee,0x1a,0x44,0xe0,0x83,0xb2,0x67,0x94,0xd4,
3449 0x2e,0x7c,0xf2,0x06,0x9d,0xb3,0x3b,0x7e,0x2f,0xda,0x25,0x66,0x7e,0xa7,0x1f,
3450 0x45,0xd4,0xf5,0xe3,0xdf,0x2a,0xf1,0x18,0x28,0x20,0xb5,0xf8,0xf5,0x8d,0x7a,
3451 0x2e,0x84,0xee };
3452 static const BYTE eeCert[] = {
3453 0x30,0x82,0x01,0xb9,0x30,0x82,0x01,0x22,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,
3454 0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
3455 0x00,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,
3456 0x65,0x72,0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x35,0x30,0x31,0x30,
3457 0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x30,0x30,0x31,0x30,
3458 0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,
3459 0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9f,0x30,0x0d,0x06,
3460 0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,
3461 0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,
3462 0x33,0x0e,0x67,0x5f,0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,
3463 0xdc,0xb6,0x17,0x8e,0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,
3464 0x48,0x9f,0x6e,0xfe,0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,
3465 0x47,0xd1,0x57,0x71,0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,
3466 0x05,0x72,0xa7,0x87,0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,
3467 0x6a,0x80,0x83,0x68,0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,
3468 0x85,0xb5,0x46,0x36,0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,
3469 0xd3,0x51,0x9a,0x22,0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,
3470 0xa3,0x02,0x03,0x01,0x00,0x01,0xa3,0x23,0x30,0x21,0x30,0x1f,0x06,0x03,0x55,
3471 0x1d,0x23,0x04,0x18,0x30,0x18,0x80,0x14,0x14,0x8c,0x16,0xbb,0xbe,0x70,0xa2,
3472 0x28,0x89,0xa0,0x58,0xff,0x98,0xbd,0xa8,0x24,0x2b,0x8a,0xe9,0x9a,0x30,0x0d,
3473 0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,
3474 0x81,0x00,0x8a,0x49,0xa9,0x86,0x5e,0xc9,0x33,0x7e,0xfd,0xab,0x64,0x1f,0x6d,
3475 0x00,0xd7,0x9b,0xec,0xd1,0x5b,0x38,0xcc,0xd6,0xf3,0xf2,0xb4,0x75,0x70,0x00,
3476 0x82,0x9d,0x37,0x58,0xe1,0xcd,0x2c,0x61,0xb3,0x28,0xe7,0x8a,0x00,0xbe,0x6e,
3477 0xca,0xe8,0x55,0xd5,0xad,0x3a,0xea,0xaf,0x13,0x20,0x1c,0x44,0xfc,0xb4,0xf9,
3478 0x29,0x2b,0xdc,0x8a,0x2d,0x1b,0x27,0x9e,0xb9,0x3b,0x4a,0x71,0x9d,0x47,0x7d,
3479 0xf7,0x92,0x6b,0x21,0x7f,0xfa,0x88,0x79,0x94,0x33,0xf6,0xdd,0x92,0x04,0x92,
3480 0xd6,0x5e,0x0a,0x74,0xf2,0x85,0xa6,0xd5,0x3c,0x28,0xc0,0x89,0x5d,0xda,0xf3,
3481 0xa6,0x01,0xc2,0xe9,0xa3,0xc1,0xb7,0x21,0x08,0xba,0x18,0x07,0x45,0xeb,0x77,
3482 0x7d,0xcd,0xc6,0xe7,0x2a,0x7b,0x46,0xd2,0x3d,0xb5 };
3483 static const BYTE rootSignedCRL[] = {
3484 0x30,0x82,0x01,0x1f,0x30,0x81,0x89,0x02,0x01,0x01,0x30,0x0d,0x06,0x09,0x2a,
3485 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x30,0x10,0x31,0x0e,0x30,
3486 0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,0x17,0x0d,
3487 0x30,0x37,0x30,0x39,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,
3488 0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x14,
3489 0x30,0x12,0x02,0x01,0x01,0x17,0x0d,0x30,0x37,0x30,0x39,0x30,0x31,0x30,0x30,
3490 0x30,0x30,0x30,0x30,0x5a,0xa0,0x2f,0x30,0x2d,0x30,0x0a,0x06,0x03,0x55,0x1d,
3491 0x14,0x04,0x03,0x02,0x01,0x01,0x30,0x1f,0x06,0x03,0x55,0x1d,0x23,0x04,0x18,
3492 0x30,0x18,0x80,0x14,0x14,0x8c,0x16,0xbb,0xbe,0x70,0xa2,0x28,0x89,0xa0,0x58,
3493 0xff,0x98,0xbd,0xa8,0x24,0x2b,0x8a,0xe9,0x9a,0x30,0x0d,0x06,0x09,0x2a,0x86,
3494 0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0xa3,0xcf,
3495 0x17,0x5d,0x7a,0x08,0xab,0x11,0x1a,0xbd,0x5c,0xde,0x9a,0x22,0x92,0x38,0xe6,
3496 0x96,0xcc,0xb1,0xc5,0x42,0x86,0xa6,0xae,0xad,0xa3,0x1a,0x2b,0xa0,0xb0,0x65,
3497 0xaa,0x9c,0xd7,0x2d,0x44,0x8c,0xae,0x61,0xc7,0x30,0x17,0x89,0x84,0x3b,0x4a,
3498 0x8f,0x17,0x08,0x06,0x37,0x1c,0xf7,0x2d,0x4e,0x47,0x07,0x61,0x50,0xd9,0x06,
3499 0xd1,0x46,0xed,0x0a,0xbb,0xc3,0x9b,0x36,0x0b,0xa7,0x27,0x2f,0x2b,0x55,0xce,
3500 0x2a,0xa5,0x60,0xc6,0x53,0x28,0xe8,0xee,0xad,0x0e,0x2b,0xe8,0xd7,0x5f,0xc9,
3501 0xa5,0xed,0xf9,0x77,0xb0,0x3c,0x81,0xcf,0xcc,0x49,0xb2,0x1a,0xc3,0xfd,0x34,
3502 0xd5,0xbc,0xb0,0xd5,0xa5,0x9c,0x1b,0x72,0xc3,0x0f,0xa3,0xe3,0x3c,0xf0,0xc3,
3503 0x91,0xe8,0x93,0x4f,0xd4,0x2f };
3504
3505 static void testVerifyRevocation(void)
3506 {
3507     BOOL ret;
3508     CERT_REVOCATION_STATUS status = { 0 };
3509     PCCERT_CONTEXT certs[2];
3510     CERT_REVOCATION_PARA revPara = { sizeof(revPara), 0 };
3511
3512     /* Crash
3513     ret = CertVerifyRevocation(0, 0, 0, NULL, 0, NULL, NULL);
3514      */
3515     SetLastError(0xdeadbeef);
3516     ret = CertVerifyRevocation(0, 0, 0, NULL, 0, NULL, &status);
3517     ok(!ret && GetLastError() == E_INVALIDARG,
3518      "Expected E_INVALIDARG, got %08x\n", GetLastError());
3519     status.cbSize = sizeof(status);
3520     ret = CertVerifyRevocation(0, 0, 0, NULL, 0, NULL, &status);
3521     ok(ret, "CertVerifyRevocation failed: %08x\n", GetLastError());
3522     ret = CertVerifyRevocation(0, 2, 0, NULL, 0, NULL, &status);
3523     ok(ret, "CertVerifyRevocation failed: %08x\n", GetLastError());
3524     ret = CertVerifyRevocation(2, 0, 0, NULL, 0, NULL, &status);
3525     ok(ret, "CertVerifyRevocation failed: %08x\n", GetLastError());
3526     certs[0] = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert,
3527      sizeof(bigCert));
3528     SetLastError(0xdeadbeef);
3529     ret = CertVerifyRevocation(0, 0, 1, (void **)certs, 0, NULL, &status);
3530     ok(!ret && GetLastError() == CRYPT_E_NO_REVOCATION_DLL,
3531      "Expected CRYPT_E_NO_REVOCATION_DLL, got %08x\n", GetLastError());
3532     SetLastError(0xdeadbeef);
3533     ret = CertVerifyRevocation(0, 2, 1, (void **)certs, 0, NULL, &status);
3534     ok(!ret && GetLastError() == CRYPT_E_NO_REVOCATION_DLL,
3535      "Expected CRYPT_E_NO_REVOCATION_DLL, got %08x\n", GetLastError());
3536
3537     CertFreeCertificateContext(certs[0]);
3538
3539     certs[0] = CertCreateCertificateContext(X509_ASN_ENCODING,
3540      rootWithKeySignAndCRLSign, sizeof(rootWithKeySignAndCRLSign));
3541     certs[1] = CertCreateCertificateContext(X509_ASN_ENCODING,
3542      eeCert, sizeof(eeCert));
3543     /* The root cert itself can't be checked for revocation */
3544     SetLastError(0xdeadbeef);
3545     ret = CertVerifyRevocation(X509_ASN_ENCODING, CERT_CONTEXT_REVOCATION_TYPE,
3546      1, (void **)certs, 0, NULL, &status);
3547     if (!ret && GetLastError() == ERROR_FILE_NOT_FOUND)
3548     {
3549         win_skip("CERT_CONTEXT_REVOCATION_TYPE unsupported, skipping\n");
3550         return;
3551     }
3552     ok(!ret && GetLastError() == CRYPT_E_NO_REVOCATION_CHECK,
3553      "expected CRYPT_E_NO_REVOCATION_CHECK, got %08x\n", GetLastError());
3554     ok(status.dwError == CRYPT_E_NO_REVOCATION_CHECK,
3555      "expected CRYPT_E_NO_REVOCATION_CHECK, got %08x\n", status.dwError);
3556     ok(status.dwIndex == 0, "expected index 0, got %d\n", status.dwIndex);
3557     /* Neither can the end cert */
3558     SetLastError(0xdeadbeef);
3559     ret = CertVerifyRevocation(X509_ASN_ENCODING, CERT_CONTEXT_REVOCATION_TYPE,
3560      1, (void **)&certs[1], 0, NULL, &status);
3561     ok(!ret && (GetLastError() == CRYPT_E_NO_REVOCATION_CHECK /* Win9x */ ||
3562      GetLastError() == CRYPT_E_REVOCATION_OFFLINE),
3563      "expected CRYPT_E_NO_REVOCATION_CHECK or CRYPT_E_REVOCATION_OFFLINE, got %08x\n",
3564      GetLastError());
3565     ok(status.dwError == CRYPT_E_NO_REVOCATION_CHECK /* Win9x */ ||
3566      status.dwError == CRYPT_E_REVOCATION_OFFLINE,
3567      "expected CRYPT_E_NO_REVOCATION_CHECK or CRYPT_E_REVOCATION_OFFLINE, got %08x\n",
3568      status.dwError);
3569     ok(status.dwIndex == 0, "expected index 0, got %d\n", status.dwIndex);
3570     /* Both certs together can't, either (they're not CRLs) */
3571     SetLastError(0xdeadbeef);
3572     ret = CertVerifyRevocation(X509_ASN_ENCODING, CERT_CONTEXT_REVOCATION_TYPE,
3573      2, (void **)certs, 0, NULL, &status);
3574     ok(!ret && (GetLastError() == CRYPT_E_NO_REVOCATION_CHECK ||
3575      GetLastError() == CRYPT_E_REVOCATION_OFFLINE /* WinME */),
3576      "expected CRYPT_E_NO_REVOCATION_CHECK or CRYPT_E_REVOCATION_OFFLINE, got %08x\n",
3577      GetLastError());
3578     ok(status.dwError == CRYPT_E_NO_REVOCATION_CHECK ||
3579      status.dwError == CRYPT_E_REVOCATION_OFFLINE /* WinME */,
3580      "expected CRYPT_E_NO_REVOCATION_CHECK or CRYPT_E_REVOCATION_OFFLINE, got %08x\n",
3581      status.dwError);
3582     ok(status.dwIndex == 0, "expected index 0, got %d\n", status.dwIndex);
3583     ok(status.dwIndex == 0, "expected index 0, got %d\n", status.dwIndex);
3584     /* Now add a CRL to the hCrlStore */
3585     revPara.hCrlStore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
3586      CERT_STORE_CREATE_NEW_FLAG, NULL);
3587     CertAddEncodedCRLToStore(revPara.hCrlStore, X509_ASN_ENCODING,
3588      rootSignedCRL, sizeof(rootSignedCRL), CERT_STORE_ADD_ALWAYS, NULL);
3589     SetLastError(0xdeadbeef);
3590     ret = CertVerifyRevocation(X509_ASN_ENCODING, CERT_CONTEXT_REVOCATION_TYPE,
3591      2, (void **)certs, 0, &revPara, &status);
3592     ok(!ret && (GetLastError() == CRYPT_E_NO_REVOCATION_CHECK ||
3593      GetLastError() == CRYPT_E_REVOCATION_OFFLINE /* WinME */),
3594      "expected CRYPT_E_NO_REVOCATION_CHECK or CRYPT_E_REVOCATION_OFFLINE, got %08x\n",
3595      GetLastError());
3596     ok(status.dwError == CRYPT_E_NO_REVOCATION_CHECK ||
3597      status.dwError == CRYPT_E_REVOCATION_OFFLINE /* WinME */,
3598      "expected CRYPT_E_NO_REVOCATION_CHECK or CRYPT_E_REVOCATION_OFFLINE, got %08x\n",
3599      status.dwError);
3600     ok(status.dwIndex == 0, "expected index 0, got %d\n", status.dwIndex);
3601     /* Specifying CERT_VERIFY_REV_CHAIN_FLAG doesn't change things either */
3602     SetLastError(0xdeadbeef);
3603     ret = CertVerifyRevocation(X509_ASN_ENCODING, CERT_CONTEXT_REVOCATION_TYPE,
3604      2, (void **)certs, CERT_VERIFY_REV_CHAIN_FLAG, &revPara, &status);
3605     ok(!ret && GetLastError() == CRYPT_E_NO_REVOCATION_CHECK,
3606      "expected CRYPT_E_NO_REVOCATION_CHECK, got %08x\n", GetLastError());
3607     ok(status.dwError == CRYPT_E_NO_REVOCATION_CHECK,
3608      "expected CRYPT_E_NO_REVOCATION_CHECK, got %08x\n", status.dwError);
3609     ok(status.dwIndex == 0, "expected index 0, got %d\n", status.dwIndex);
3610     /* Again, specifying the issuer cert: no change */
3611     revPara.pIssuerCert = certs[0];
3612     SetLastError(0xdeadbeef);
3613     ret = CertVerifyRevocation(X509_ASN_ENCODING, CERT_CONTEXT_REVOCATION_TYPE,
3614      1, (void **)&certs[1], 0, &revPara, &status);
3615     /* Win2k thinks the cert is revoked, and it is, except the CRL is out of
3616      * date, hence the revocation status should be unknown.
3617      */
3618     ok(!ret && (GetLastError() == CRYPT_E_NO_REVOCATION_CHECK ||
3619      broken(GetLastError() == CRYPT_E_REVOKED /* Win2k */)),
3620      "expected CRYPT_E_NO_REVOCATION_CHECK, got %08x\n", GetLastError());
3621     ok(status.dwError == CRYPT_E_NO_REVOCATION_CHECK ||
3622      broken(status.dwError == CRYPT_E_REVOKED /* Win2k */),
3623      "expected CRYPT_E_NO_REVOCATION_CHECK, got %08x\n", status.dwError);
3624     ok(status.dwIndex == 0, "expected index 0, got %d\n", status.dwIndex);
3625     CertCloseStore(revPara.hCrlStore, 0);
3626     CertFreeCertificateContext(certs[1]);
3627     CertFreeCertificateContext(certs[0]);
3628 }
3629
3630 static BYTE privKey[] = {
3631  0x07, 0x02, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x52, 0x53, 0x41, 0x32, 0x00,
3632  0x02, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x79, 0x10, 0x1c, 0xd0, 0x6b, 0x10,
3633  0x18, 0x30, 0x94, 0x61, 0xdc, 0x0e, 0xcb, 0x96, 0x4e, 0x21, 0x3f, 0x79, 0xcd,
3634  0xa9, 0x17, 0x62, 0xbc, 0xbb, 0x61, 0x4c, 0xe0, 0x75, 0x38, 0x6c, 0xf3, 0xde,
3635  0x60, 0x86, 0x03, 0x97, 0x65, 0xeb, 0x1e, 0x6b, 0xdb, 0x53, 0x85, 0xad, 0x68,
3636  0x21, 0xf1, 0x5d, 0xe7, 0x1f, 0xe6, 0x53, 0xb4, 0xbb, 0x59, 0x3e, 0x14, 0x27,
3637  0xb1, 0x83, 0xa7, 0x3a, 0x54, 0xe2, 0x8f, 0x65, 0x8e, 0x6a, 0x4a, 0xcf, 0x3b,
3638  0x1f, 0x65, 0xff, 0xfe, 0xf1, 0x31, 0x3a, 0x37, 0x7a, 0x8b, 0xcb, 0xc6, 0xd4,
3639  0x98, 0x50, 0x36, 0x67, 0xe4, 0xa1, 0xe8, 0x7e, 0x8a, 0xc5, 0x23, 0xf2, 0x77,
3640  0xf5, 0x37, 0x61, 0x49, 0x72, 0x59, 0xe8, 0x3d, 0xf7, 0x60, 0xb2, 0x77, 0xca,
3641  0x78, 0x54, 0x6d, 0x65, 0x9e, 0x03, 0x97, 0x1b, 0x61, 0xbd, 0x0c, 0xd8, 0x06,
3642  0x63, 0xe2, 0xc5, 0x48, 0xef, 0xb3, 0xe2, 0x6e, 0x98, 0x7d, 0xbd, 0x4e, 0x72,
3643  0x91, 0xdb, 0x31, 0x57, 0xe3, 0x65, 0x3a, 0x49, 0xca, 0xec, 0xd2, 0x02, 0x4e,
3644  0x22, 0x7e, 0x72, 0x8e, 0xf9, 0x79, 0x84, 0x82, 0xdf, 0x7b, 0x92, 0x2d, 0xaf,
3645  0xc9, 0xe4, 0x33, 0xef, 0x89, 0x5c, 0x66, 0x99, 0xd8, 0x80, 0x81, 0x47, 0x2b,
3646  0xb1, 0x66, 0x02, 0x84, 0x59, 0x7b, 0xc3, 0xbe, 0x98, 0x45, 0x4a, 0x3d, 0xdd,
3647  0xea, 0x2b, 0xdf, 0x4e, 0xb4, 0x24, 0x6b, 0xec, 0xe7, 0xd9, 0x0c, 0x45, 0xb8,
3648  0xbe, 0xca, 0x69, 0x37, 0x92, 0x4c, 0x38, 0x6b, 0x96, 0x6d, 0xcd, 0x86, 0x67,
3649  0x5c, 0xea, 0x54, 0x94, 0xa4, 0xca, 0xa4, 0x02, 0xa5, 0x21, 0x4d, 0xae, 0x40,
3650  0x8f, 0x9d, 0x51, 0x83, 0xf2, 0x3f, 0x33, 0xc1, 0x72, 0xb4, 0x1d, 0x94, 0x6e,
3651  0x7d, 0xe4, 0x27, 0x3f, 0xea, 0xff, 0xe5, 0x9b, 0xa7, 0x5e, 0x55, 0x8e, 0x0d,
3652  0x69, 0x1c, 0x7a, 0xff, 0x81, 0x9d, 0x53, 0x52, 0x97, 0x9a, 0x76, 0x79, 0xda,
3653  0x93, 0x32, 0x16, 0xec, 0x69, 0x51, 0x1a, 0x4e, 0xc3, 0xf1, 0x72, 0x80, 0x78,
3654  0x5e, 0x66, 0x4a, 0x8d, 0x85, 0x2f, 0x3f, 0xb2, 0xa7 };
3655
3656 static const BYTE exportedPublicKeyBlob[] = {
3657 0x06,0x02,0x00,0x00,0x00,0xa4,0x00,0x00,0x52,0x53,0x41,0x31,0x00,0x02,0x00,0x00,
3658 0x01,0x00,0x01,0x00,0x79,0x10,0x1c,0xd0,0x6b,0x10,0x18,0x30,0x94,0x61,0xdc,0x0e,
3659 0xcb,0x96,0x4e,0x21,0x3f,0x79,0xcd,0xa9,0x17,0x62,0xbc,0xbb,0x61,0x4c,0xe0,0x75,
3660 0x38,0x6c,0xf3,0xde,0x60,0x86,0x03,0x97,0x65,0xeb,0x1e,0x6b,0xdb,0x53,0x85,0xad,
3661 0x68,0x21,0xf1,0x5d,0xe7,0x1f,0xe6,0x53,0xb4,0xbb,0x59,0x3e,0x14,0x27,0xb1,0x83,
3662 0xa7,0x3a,0x54,0xe2 };
3663
3664 static const BYTE asnEncodedPublicKey[] = {
3665 0x30,0x48,0x02,0x41,0x00,0xe2,0x54,0x3a,0xa7,0x83,0xb1,0x27,0x14,0x3e,0x59,0xbb,
3666 0xb4,0x53,0xe6,0x1f,0xe7,0x5d,0xf1,0x21,0x68,0xad,0x85,0x53,0xdb,0x6b,0x1e,0xeb,
3667 0x65,0x97,0x03,0x86,0x60,0xde,0xf3,0x6c,0x38,0x75,0xe0,0x4c,0x61,0xbb,0xbc,0x62,
3668 0x17,0xa9,0xcd,0x79,0x3f,0x21,0x4e,0x96,0xcb,0x0e,0xdc,0x61,0x94,0x30,0x18,0x10,
3669 0x6b,0xd0,0x1c,0x10,0x79,0x02,0x03,0x01,0x00,0x01 };
3670
3671 static void testAcquireCertPrivateKey(void)
3672 {
3673     BOOL ret;
3674     PCCERT_CONTEXT cert;
3675     HCRYPTPROV csp;
3676     DWORD size, keySpec;
3677     BOOL callerFree;
3678     CRYPT_KEY_PROV_INFO keyProvInfo;
3679     HCRYPTKEY key;
3680     WCHAR ms_def_prov_w[MAX_PATH];
3681
3682     if (!pCryptAcquireCertificatePrivateKey)
3683     {
3684         win_skip("CryptAcquireCertificatePrivateKey() is not available\n");
3685         return;
3686     }
3687
3688     lstrcpyW(ms_def_prov_w, MS_DEF_PROV_W);
3689
3690     keyProvInfo.pwszContainerName = cspNameW;
3691     keyProvInfo.pwszProvName = ms_def_prov_w;
3692     keyProvInfo.dwProvType = PROV_RSA_FULL;
3693     keyProvInfo.dwFlags = 0;
3694     keyProvInfo.cProvParam = 0;
3695     keyProvInfo.rgProvParam = NULL;
3696     keyProvInfo.dwKeySpec = AT_SIGNATURE;
3697
3698     pCryptAcquireContextA(NULL, cspNameA, MS_DEF_PROV_A, PROV_RSA_FULL,
3699      CRYPT_DELETEKEYSET);
3700
3701     cert = CertCreateCertificateContext(X509_ASN_ENCODING, selfSignedCert,
3702      sizeof(selfSignedCert));
3703
3704     /* Crash
3705     ret = pCryptAcquireCertificatePrivateKey(NULL, 0, NULL, NULL, NULL, NULL);
3706     ret = pCryptAcquireCertificatePrivateKey(NULL, 0, NULL, NULL, NULL,
3707      &callerFree);
3708     ret = pCryptAcquireCertificatePrivateKey(NULL, 0, NULL, NULL, &keySpec,
3709      NULL);
3710     ret = pCryptAcquireCertificatePrivateKey(NULL, 0, NULL, &csp, NULL, NULL);
3711     ret = pCryptAcquireCertificatePrivateKey(NULL, 0, NULL, &csp, &keySpec,
3712      &callerFree);
3713     ret = pCryptAcquireCertificatePrivateKey(cert, 0, NULL, NULL, NULL, NULL);
3714      */
3715
3716     /* Missing private key */
3717     ret = pCryptAcquireCertificatePrivateKey(cert, 0, NULL, &csp, NULL, NULL);
3718     ok(!ret && GetLastError() == CRYPT_E_NO_KEY_PROPERTY,
3719      "Expected CRYPT_E_NO_KEY_PROPERTY, got %08x\n", GetLastError());
3720     ret = pCryptAcquireCertificatePrivateKey(cert, 0, NULL, &csp, &keySpec,
3721      &callerFree);
3722     ok(!ret && GetLastError() == CRYPT_E_NO_KEY_PROPERTY,
3723      "Expected CRYPT_E_NO_KEY_PROPERTY, got %08x\n", GetLastError());
3724     CertSetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, 0,
3725      &keyProvInfo);
3726     ret = pCryptAcquireCertificatePrivateKey(cert, 0, NULL, &csp, &keySpec,
3727      &callerFree);
3728     ok(!ret && (GetLastError() == CRYPT_E_NO_KEY_PROPERTY || GetLastError() == NTE_BAD_KEYSET /* win8 */),
3729      "Expected CRYPT_E_NO_KEY_PROPERTY, got %08x\n", GetLastError());
3730
3731     pCryptAcquireContextA(&csp, cspNameA, MS_DEF_PROV_A, PROV_RSA_FULL,
3732      CRYPT_NEWKEYSET);
3733     ret = CryptImportKey(csp, privKey, sizeof(privKey), 0, 0, &key);
3734     ok(ret, "CryptImportKey failed: %08x\n", GetLastError());
3735     if (ret)
3736     {
3737         HCRYPTPROV certCSP;
3738         DWORD size;
3739         CERT_KEY_CONTEXT keyContext;
3740
3741         /* Don't cache provider */
3742         ret = pCryptAcquireCertificatePrivateKey(cert, 0, NULL, &certCSP,
3743          &keySpec, &callerFree);
3744         ok(ret ||
3745          broken(!ret), /* win95 */
3746          "CryptAcquireCertificatePrivateKey failed: %08x\n",
3747          GetLastError());
3748         if (ret)
3749         {
3750             ok(callerFree, "Expected callerFree to be TRUE\n");
3751             CryptReleaseContext(certCSP, 0);
3752         }
3753
3754         ret = pCryptAcquireCertificatePrivateKey(cert, 0, NULL, &certCSP,
3755          NULL, NULL);
3756         ok(ret ||
3757          broken(!ret), /* win95 */
3758          "CryptAcquireCertificatePrivateKey failed: %08x\n",
3759          GetLastError());
3760         CryptReleaseContext(certCSP, 0);
3761
3762         /* Use the key prov info's caching (there shouldn't be any) */
3763         ret = pCryptAcquireCertificatePrivateKey(cert,
3764          CRYPT_ACQUIRE_USE_PROV_INFO_FLAG, NULL, &certCSP, &keySpec,
3765          &callerFree);
3766         ok(ret ||
3767          broken(!ret), /* win95 */
3768          "CryptAcquireCertificatePrivateKey failed: %08x\n",
3769          GetLastError());
3770         if (ret)
3771         {
3772             ok(callerFree, "Expected callerFree to be TRUE\n");
3773             CryptReleaseContext(certCSP, 0);
3774         }
3775
3776         /* Cache it (and check that it's cached) */
3777         ret = pCryptAcquireCertificatePrivateKey(cert,
3778          CRYPT_ACQUIRE_CACHE_FLAG, NULL, &certCSP, &keySpec, &callerFree);
3779         ok(ret ||
3780          broken(!ret), /* win95 */
3781          "CryptAcquireCertificatePrivateKey failed: %08x\n",
3782          GetLastError());
3783         ok(!callerFree, "Expected callerFree to be FALSE\n");
3784         size = sizeof(keyContext);
3785         ret = CertGetCertificateContextProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
3786          &keyContext, &size);
3787         ok(ret ||
3788          broken(!ret), /* win95 */
3789          "CertGetCertificateContextProperty failed: %08x\n",
3790          GetLastError());
3791
3792         /* Remove the cached provider */
3793         CryptReleaseContext(keyContext.hCryptProv, 0);
3794         CertSetCertificateContextProperty(cert, CERT_KEY_CONTEXT_PROP_ID, 0,
3795          NULL);
3796         /* Allow caching via the key prov info */
3797         keyProvInfo.dwFlags = CERT_SET_KEY_CONTEXT_PROP_ID;
3798         CertSetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, 0,
3799          &keyProvInfo);
3800         /* Now use the key prov info's caching */
3801         ret = pCryptAcquireCertificatePrivateKey(cert,
3802          CRYPT_ACQUIRE_USE_PROV_INFO_FLAG, NULL, &certCSP, &keySpec,
3803          &callerFree);
3804         ok(ret ||
3805          broken(!ret), /* win95 */
3806          "CryptAcquireCertificatePrivateKey failed: %08x\n",
3807          GetLastError());
3808         ok(!callerFree, "Expected callerFree to be FALSE\n");
3809         size = sizeof(keyContext);
3810         ret = CertGetCertificateContextProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
3811          &keyContext, &size);
3812         ok(ret ||
3813          broken(!ret), /* win95 */
3814          "CertGetCertificateContextProperty failed: %08x\n",
3815          GetLastError());
3816         CryptReleaseContext(certCSP, 0);
3817
3818         CryptDestroyKey(key);
3819     }
3820
3821     /* Some sanity-checking on public key exporting */
3822     ret = CryptImportPublicKeyInfo(csp, X509_ASN_ENCODING,
3823      &cert->pCertInfo->SubjectPublicKeyInfo, &key);
3824     ok(ret, "CryptImportPublicKeyInfo failed: %08x\n", GetLastError());
3825     if (ret)
3826     {
3827         ret = CryptExportKey(key, 0, PUBLICKEYBLOB, 0, NULL, &size);
3828         ok(ret, "CryptExportKey failed: %08x\n", GetLastError());
3829         if (ret)
3830         {
3831             LPBYTE buf = HeapAlloc(GetProcessHeap(), 0, size), encodedKey;
3832
3833             ret = CryptExportKey(key, 0, PUBLICKEYBLOB, 0, buf, &size);
3834             ok(ret, "CryptExportKey failed: %08x\n", GetLastError());
3835             ok(size == sizeof(exportedPublicKeyBlob), "Unexpected size %d\n",
3836              size);
3837             ok(!memcmp(buf, exportedPublicKeyBlob, size), "Unexpected value\n");
3838             ret = pCryptEncodeObjectEx(X509_ASN_ENCODING, RSA_CSP_PUBLICKEYBLOB,
3839              buf, CRYPT_ENCODE_ALLOC_FLAG, NULL, &encodedKey, &size);
3840             ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
3841             if (ret)
3842             {
3843                 ok(size == sizeof(asnEncodedPublicKey), "Unexpected size %d\n",
3844                  size);
3845                 ok(!memcmp(encodedKey, asnEncodedPublicKey, size),
3846                  "Unexpected value\n");
3847                 LocalFree(encodedKey);
3848             }
3849             HeapFree(GetProcessHeap(), 0, buf);
3850         }
3851         CryptDestroyKey(key);
3852     }
3853     ret = CryptExportPublicKeyInfoEx(csp, AT_SIGNATURE, X509_ASN_ENCODING,
3854      NULL, 0, NULL, NULL, &size);
3855     ok(ret, "CryptExportPublicKeyInfoEx failed: %08x\n", GetLastError());
3856     if (ret)
3857     {
3858         PCERT_PUBLIC_KEY_INFO info = HeapAlloc(GetProcessHeap(), 0, size);
3859
3860         ret = CryptExportPublicKeyInfoEx(csp, AT_SIGNATURE, X509_ASN_ENCODING,
3861          NULL, 0, NULL, info, &size);
3862         ok(ret, "CryptExportPublicKeyInfoEx failed: %08x\n", GetLastError());
3863         if (ret)
3864         {
3865             ok(info->PublicKey.cbData == sizeof(asnEncodedPublicKey),
3866              "Unexpected size %d\n", info->PublicKey.cbData);
3867             ok(!memcmp(info->PublicKey.pbData, asnEncodedPublicKey,
3868              info->PublicKey.cbData), "Unexpected value\n");
3869         }
3870         HeapFree(GetProcessHeap(), 0, info);
3871     }
3872
3873     CryptReleaseContext(csp, 0);
3874     pCryptAcquireContextA(&csp, cspNameA, MS_DEF_PROV_A, PROV_RSA_FULL,
3875      CRYPT_DELETEKEYSET);
3876
3877     CertFreeCertificateContext(cert);
3878 }
3879
3880 static void testGetPublicKeyLength(void)
3881 {
3882     static char oid_rsa_rsa[] = szOID_RSA_RSA;
3883     static char oid_rsa_dh[] = szOID_RSA_DH;
3884     static char bogusOID[] = "1.2.3";
3885     DWORD ret;
3886     CERT_PUBLIC_KEY_INFO info = { { 0 } };
3887     BYTE bogusKey[] = { 1, 2, 3, 4, 5, 6, 7, 8 };
3888     BYTE key[] = { 0x30,0x0f,0x02,0x08,0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,
3889      0x02,0x03,0x01,0x00,0x01 };
3890
3891     /* Crashes
3892     ret = CertGetPublicKeyLength(0, NULL);
3893      */
3894     /* With an empty public key info */
3895     SetLastError(0xdeadbeef);
3896     ret = CertGetPublicKeyLength(0, &info);
3897     ok(ret == 0 && GetLastError() == ERROR_FILE_NOT_FOUND,
3898      "Expected length 0 and ERROR_FILE_NOT_FOUND, got length %d, %08x\n",
3899      ret, GetLastError());
3900     SetLastError(0xdeadbeef);
3901     ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
3902     ok(ret == 0 &&
3903      (GetLastError() == CRYPT_E_ASN1_EOD ||
3904       GetLastError() == OSS_BAD_ARG), /* win9x */
3905      "Expected length 0 and CRYPT_E_ASN1_EOD, got length %d, %08x\n",
3906      ret, GetLastError());
3907     /* With a nearly-empty public key info */
3908     info.Algorithm.pszObjId = oid_rsa_rsa;
3909     SetLastError(0xdeadbeef);
3910     ret = CertGetPublicKeyLength(0, &info);
3911     ok(ret == 0 && GetLastError() == ERROR_FILE_NOT_FOUND,
3912      "Expected length 0 and ERROR_FILE_NOT_FOUND, got length %d, %08x\n",
3913      ret, GetLastError());
3914     SetLastError(0xdeadbeef);
3915     ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
3916     ok(ret == 0 &&
3917      (GetLastError() == CRYPT_E_ASN1_EOD ||
3918       GetLastError() == OSS_BAD_ARG), /* win9x */
3919      "Expected length 0 and CRYPT_E_ASN1_EOD, got length %d, %08x\n",
3920      ret, GetLastError());
3921     /* With a bogus key */
3922     info.PublicKey.cbData = sizeof(bogusKey);
3923     info.PublicKey.pbData = bogusKey;
3924     SetLastError(0xdeadbeef);
3925     ret = CertGetPublicKeyLength(0, &info);
3926     ok(ret == 0 && GetLastError() == ERROR_FILE_NOT_FOUND,
3927      "Expected length 0 and ERROR_FILE_NOT_FOUND, got length %d, %08x\n",
3928      ret, GetLastError());
3929     SetLastError(0xdeadbeef);
3930     ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
3931     ok(ret == 0 &&
3932      (GetLastError() == CRYPT_E_ASN1_BADTAG ||
3933       GetLastError() == OSS_PDU_MISMATCH), /* win9x */
3934      "Expected length 0 and CRYPT_E_ASN1_BADTAGTAG, got length %d, %08x\n",
3935      ret, GetLastError());
3936     /* With a believable RSA key but a bogus OID */
3937     info.Algorithm.pszObjId = bogusOID;
3938     info.PublicKey.cbData = sizeof(key);
3939     info.PublicKey.pbData = key;
3940     SetLastError(0xdeadbeef);
3941     ret = CertGetPublicKeyLength(0, &info);
3942     ok(ret == 0 && GetLastError() == ERROR_FILE_NOT_FOUND,
3943      "Expected length 0 and ERROR_FILE_NOT_FOUND, got length %d, %08x\n",
3944      ret, GetLastError());
3945     SetLastError(0xdeadbeef);
3946     ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
3947     ok(ret == 56 || broken(ret == 0 && GetLastError() == NTE_BAD_LEN) /* Win7 */,
3948        "Expected length 56, got %d\n", ret);
3949     /* An RSA key with the DH OID */
3950     info.Algorithm.pszObjId = oid_rsa_dh;
3951     SetLastError(0xdeadbeef);
3952     ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
3953     ok(ret == 0 &&
3954      (GetLastError() == CRYPT_E_ASN1_BADTAG ||
3955       GetLastError() == E_INVALIDARG), /* win9x */
3956      "Expected length 0 and CRYPT_E_ASN1_BADTAG, got length %d, %08x\n",
3957      ret, GetLastError());
3958     /* With the RSA OID */
3959     info.Algorithm.pszObjId = oid_rsa_rsa;
3960     SetLastError(0xdeadbeef);
3961     ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
3962     ok(ret == 56 || broken(ret == 0 && GetLastError() == NTE_BAD_LEN) /* Win7 */,
3963        "Expected length 56, got %d\n", ret);
3964     /* With the RSA OID and a message encoding */
3965     info.Algorithm.pszObjId = oid_rsa_rsa;
3966     SetLastError(0xdeadbeef);
3967     ret = CertGetPublicKeyLength(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, &info);
3968     ok(ret == 56 || broken(ret == 0 && GetLastError() == NTE_BAD_LEN) /* Win7 */,
3969        "Expected length 56, got %d\n", ret);
3970 }
3971
3972 START_TEST(cert)
3973 {
3974     init_function_pointers();
3975
3976     testAddCert();
3977     testCertProperties();
3978     testCreateCert();
3979     testDupCert();
3980     testFindCert();
3981     testGetSubjectCert();
3982     testGetIssuerCert();
3983     testLinkCert();
3984
3985     testCryptHashCert();
3986     testCertSigs();
3987     testSignAndEncodeCert();
3988     testCreateSelfSignCert();
3989     testIntendedKeyUsage();
3990     testKeyUsage();
3991     testGetValidUsages();
3992     testCompareCertName();
3993     testCompareIntegerBlob();
3994     testComparePublicKeyInfo();
3995     testHashPublicKeyInfo();
3996     testHashToBeSigned();
3997     testCompareCert();
3998     testVerifySubjectCert();
3999     testVerifyRevocation();
4000     testAcquireCertPrivateKey();
4001     testGetPublicKeyLength();
4002     testIsRDNAttrsInCertificateName();
4003 }