除了之前的答案。
如果您想手动检查不受信任的根证书（例如自签名），您需要
- 设置标志以忽略不受信任的证书
// Open request before
HINTERNET hRequest = HttpOpenRequest(hConnect, _T("POST"), action, NULL, NULL, NULL, dwFlags, 0);
if (!hRequest) return GetLastError();
// set ignore options to request
DWORD dwFlags;
DWORD dwBuffLen = sizeof(dwFlags);
InternetQueryOption(hRequest, INTERNET_OPTION_SECURITY_FLAGS, (LPVOID)&dwFlags, &dwBuffLen);
dwFlags |= SECURITY_FLAG_IGNORE_UNKNOWN_CA;
InternetSetOption (hRequest, INTERNET_OPTION_SECURITY_FLAGS, &dwFlags, sizeof (dwFlags));
- 发送数据请求
if (HttpSendRequest(hRequest, strHeaders, strHeaders.GetLength(), data, len)) {
- 只有在数据请求返回后我们才能查看证书信息并检查指纹。
要获取指纹，我们必须使用 cryptapi 中的方法，
所以需要#include“WinCrypt.h”并将crypt32.lib添加到链接器
PCCERT_CHAIN_CONTEXT CertCtx=NULL;
DWORD cbCertSize = sizeof(&CertCtx);
// Get certificate chain information
if (InternetQueryOption(hRequest, INTERNET_OPTION_SERVER_CERT_CHAIN_CONTEXT, (LPVOID)&CertCtx, &cbCertSize))
{
PCCERT_CHAIN_CONTEXT pChainContext=CertCtx;
CERT_SIMPLE_CHAIN *simpleCertificateChainWithinContext = NULL;
for (int i=0; i<pChainContext->cChain; i++)
{
simpleCertificateChainWithinContext=pChainContext->rgpChain[i];
// We can check any certificates from chain, but if selfsigned it will be single
for (int simpleCertChainIndex = 0; simpleCertChainIndex < simpleCertificateChainWithinContext->cElement; simpleCertChainIndex++)
{
// get the CertContext from the array
PCCERT_CONTEXT pCertContext = simpleCertificateChainWithinContext->rgpElement[simpleCertChainIndex]->pCertContext;
// Public key can be getted from
// (((*((*pCertContext).pCertInfo)).SubjectPublicKeyInfo).PublicKey).pbData
// but better to use thumbprint to check
// CERT_HASH_PROP_ID - is a thumbprint
BYTE thumbprint[1024];
DWORD len = 1024;
if (CertGetCertificateContextProperty(pCertContext, CERT_HASH_PROP_ID, thumbprint, &len)) {
//
// !!! HERE WE CAN CHECK THUMPRINT WITH TRUSTED(PREVIOUSLY SAVED)
// and return error, or accept request output.
//
}
}
}
// important! Free the CertCtx
CertFreeCertificateChain(CertCtx);
}
- 为什么要使用指纹来比对证书？
证书中有三个有趣的字段需要比较：
序列号、公钥、指纹。
序列号只是颁发证书的 CA 选择的唯一编号，
公钥很好的解决方案，但指纹是通过完整证书计算的哈希值
(https://security.stackexchange.com/questions/35691/what-is-the-difference- Between-serial-number-and-thumbprint)
