验证文档签名和证书
本主题介绍如何验证 XPS 文档中的签名以及如何验证与这些签名相关的证书。
在程序中使用以下代码示例之前，请阅读常见数字签名编程任务中的免责声明。
以下代码示例检查 XPS 文档中找到的数字签名。
若要检查 XPS 文档中的签名，请执行以下步骤：
HRESULT
VerifyAllDigitalSignaturesAndAuthenticateCertificates(
IXpsSignatureManager *signatureManager
)
{
HRESULT hr = S_OK;
IXpsSignature *signature = NULL;
IXpsSignatureCollection *signaturesInDocument = NULL;
UINT32 numberOfSignaturesInDocument = NULL;
hr = signatureManager->GetSignatures(&signaturesInDocument);
if (SUCCEEDED(hr)) {
hr = signaturesInDocument->GetCount(&numberOfSignaturesInDocument);
}
if (SUCCEEDED(hr)) {
// Check each signature in the XPS document that was opened in
// the signature manager.
for (UINT32 index = 0; index < numberOfSignaturesInDocument; index++)
{
// Get the signature in the current index of the
// IXpsSignatureCollection object
hr = signaturesInDocument->GetAt(index, &signature);
if (SUCCEEDED(hr)) {
PCCERT_CONTEXT signingCertificate = NULL;
XPS_SIGNATURE_STATUS signatureStatus;
signatureStatus = XPS_SIGNATURE_STATUS_BROKEN;
// Verify the signature and authenticate
// its signing certificate
hr = VerifySignatureAndCertificates (
signature,
&signingCertificate,
&signatureStatus);
if (FAILED(hr)) {
// If a FACILITY_SECURITY error code is returned then
// the current certificate was not the
// signing certificate, so continue with
// the enumeration.
if (HRESULT_FACILITY(hr) != FACILITY_SECURITY)
{
// If the error was not a FACILITY_SECURITY error
// then exit and return the error
break; // out of for loop
}
}
// release pointers for next loop
if (NULL != signature) {
signature->Release();
signature = NULL;
}
if (NULL != signingCertificate) {
CertFreeCertificateContext (signingCertificate);
signingCertificate = NULL;
}
}
}
}
if (NULL != signaturesInDocument) signaturesInDocument->Release();
return hr;
}
若要验证数字签名，请首先验证签名证书创建的签名，然后验证签名证书。 以下代码示例中使用的验证方法将证书缓存在临时证书存储中，在本示例后面部分调用 Crypto API 函数时，这些函数将使用这些证书。
若要创建临时证书存储，请执行以下步骤：
- 创建临时证书存储来保存此签名使用的证书。
- 循环访问此签名的证书集，并将每个证书加载到临时证书存储中。
HRESULT VerifySignatureAndCertificates (
IXpsSignature *signature,
PCCERT_CONTEXT *signingCertificate,
XPS_SIGNATURE_STATUS *signatureStatus
)
{
HRESULT hr = S_OK;
BOOL moreCertificates = FALSE;
IOpcCertificateEnumerator *certificatesInSignature = NULL;
HCERTSTORE signatureCertificateStore = NULL;
// Create a temporary certificate store.
signatureCertificateStore = CertOpenStore(
CERT_STORE_PROV_MEMORY,
X509_ASN_ENCODING,
NULL,
0,
NULL);
// Create a certificate enumerator to store the certificates
// that are associated with the current signature.
hr = signature->GetCertificateEnumerator(&certificatesInSignature);
if (SUCCEEDED(hr))
{
// We need to call the MoveNext method to initialize the enumerator.
hr = certificatesInSignature->MoveNext(&moreCertificates);
}
if (SUCCEEDED(hr))
{
// Iterate through the certificates in the signature,
// and add each one to the temporary certificate store.
// This temporary certificate store simplifies
// authentication of the signing certificate.
while (moreCertificates)
{
PCCERT_CONTEXT certificate = NULL;
hr = certificatesInSignature->GetCurrent(&certificate);
if (SUCCEEDED(hr))
{
// got the next certificate so
// add the current certificate to the temporary certificate store.
if (!CertAddCertificateContextToStore(signatureCertificateStore,
certificate,
CERT_STORE_ADD_REPLACE_EXISTING,
NULL))
{
hr = E_FAIL;
// ERROR: could not add the certificate to the certificate store
break; // out of while loop
}
CertFreeCertificateContext (certificate);
}
else
{
// unable to get the certificate so skip
}
// move to next certificate in set
if (FAILED(hr = certificatesInSignature->MoveNext(&moreCertificates)))
{
// ERROR: could not move to the next certificate in the enumerator
break; // out of while loop
}
// moreCertificates == FALSE when the end of the set has been reached.
}//End while
}
if (NULL != certificatesInSignature) certificatesInSignature->Release();
若要验证数字签名和用于签署文档的证书，请执行以下步骤：
- 通过循环访问此签名使用的证书来查找签名证书。
- 通过根据证书验证签名来测试证书。 当 Verify 方法返回的 XPS_SIGNATURE_STATUS 为 XPS_SIGNATURE_STATUS_VALID 或 XPS_SIGNATURE_STATUS_QUESTIONABLE 且没有返回 FACILITY_SECURITY 错误时，表明签名证书已找到。
// Reset the enumerator
hr = signature->GetCertificateEnumerator(&certificatesInSignature);
if (SUCCEEDED (hr))
{
moreCertificates = FALSE;
hr = certificatesInSignature->MoveNext(&moreCertificates);
}
if (SUCCEEDED(hr))
{
// Iterate through the certificates in the signature,
// and call the IXpsSignature.Verify() method
// on each certificate.
// A signature can include an entire certificate chain, and so
// only one of the certificates found in this enumeration
// is the certificate that was used to sign the package.
// The signing certificate is the one to authenticate.
// To find the signing certificate, iterate through
// the certificates in the signature and select the certificate that
// returns an XPS_SIGNATURE_STATUS of XPS_SIGNATURE_STATUS_VALID
// or XPS_SIGNATURE_STATUS_QUESTIONABLE and does not return a
// FACILITY_SECURITY error.
XPS_SIGNATURE_STATUS localSignatureStatus;
localSignatureStatus = XPS_SIGNATURE_STATUS_INCOMPLIANT;
do
{
PCCERT_CONTEXT certificate = NULL;
DWORD certificateStatus = NULL;
if (FAILED(hr = certificatesInSignature->GetCurrent(&certificate)))
{
// We will skip corrupted certificates
// free this one and move to the next
CertFreeCertificateContext (certificate);
hr = certificatesInSignature->MoveNext(&moreCertificates);
if (FAILED(hr))
{
// ERROR: could not move to the next
// certificate in the enumerator
break; // out of do loop with failed hr
}
// continue with next loop iteration
continue;
}
// Verify that the signature conforms to the XPS signing policy.
hr = signature->Verify(certificate, &localSignatureStatus);
if (FAILED(hr))
{
// If a FACILITY_SECURITY error code is returned, then the
// current certificate was not the signing certificate,
// so continue to the next certificate.
if (HRESULT_FACILITY(hr) == FACILITY_SECURITY)
{
// free this one and move to the next
CertFreeCertificateContext (certificate);
hr = certificatesInSignature->MoveNext(&moreCertificates);
if (FAILED(hr))
{
// ERROR: could not move to the next certificate
// in the enumerator
break; // out of do loop with failed hr
}
continue;
}
// ERROR: An attempt to verify the signature has failed
break; // out of do loop with failed hr
}
// if verification was successful, localSignatureStatus will
// contain the status of the signature.
//
// do loop continues in next code example
找到签名证书后，请执行以下步骤：
- 保存返回的签名状态。
- 必要时更新本地状态以执行后续证书测试：
- 如果签名状态是成功的状态，请将本地状态设置为有问题的状态以测试证书。
- 如果签名状态是不合规的状态，请将本地状态保留为不合规的状态。
- 如果签名状态是损坏的或不完整的状态，请将本地状态设置为损坏。
签名状态为“XPS_SIGNATURE_STATUS_INCOMPLIANT”表示 XPS 文档中不应签名的部分已签名，或者 XPS 文档中应签名的部分未签名。 如果 Verify 返回此签名状态，则无需进一步检查签名。
// continuing do loop from previous code example
*signingCertificate = certificate;
*signatureStatus = localSignatureStatus;
// note that this test should only downgrade the
// signature status, it should not upgrade it.
switch (localSignatureStatus) {
case XPS_SIGNATURE_STATUS_VALID:
case XPS_SIGNATURE_STATUS_QUESTIONABLE:
// the signature is valid or questionable so
// save the actual status and set the new status
// to questionable so the certificates will be checked.
localSignatureStatus = XPS_SIGNATURE_STATUS_QUESTIONABLE;
break;
case XPS_SIGNATURE_STATUS_INCOMPLIANT:
// the signature is not compliant
break;
case XPS_SIGNATURE_STATUS_INCOMPLETE:
case XPS_SIGNATURE_STATUS_BROKEN:
// The Windows 7 XPS viewer displays incomplete signatures
// and broken signatures as broken.
*signatureStatus = XPS_SIGNATURE_STATUS_BROKEN;
localSignatureStatus = XPS_SIGNATURE_STATUS_BROKEN;
break;
default:
// there should be no other possible status values
break;
}
// do loop continues in next code example
若要验证证书信任签名状态是有效的状态还是有问题的状态，请执行以下步骤：
- 获取证书信任状态。
- 评估返回的证书信任状态。
- 返回生成的状态。
下一个代码示例不会针对每种可能的证书信任状态进行测试。 有关可返回的状态值的更多详细信息，请参阅 CERT_TRUST_STATUS。
// continuing do loop from previous code example
//
// at this point, localSignatureStatus should be less than or
// equal to what it was before the test.
// Check the certificate to see if it is valid
if ((localSignatureStatus == XPS_SIGNATURE_STATUS_VALID) ||
(localSignatureStatus == XPS_SIGNATURE_STATUS_QUESTIONABLE))
{
// This call builds the certificate trust chain from the
// supplied certificate. The certificate chain is used to
// authenticate the supplied certificate.
hr = GetCertificateTrustStatus (
*signingCertificate,
&signatureCertificateStore,
&certificateStatus);
if (FAILED(hr))
{
// ERROR: An attempt to authenticate the certificate
// has failed
break; // out of do loop with failed hr
}
// The Crypt API returns a status that can contain more than
// one status value.
// statusFlagMask is set to test all bits except for the
// CERT_TRUST_REVOCATION_STATUS_UNKNOWN
// CERT_TRUST_IS_OFFLINE_REVOCATION
// CERT_TRUST_IS_NOT_TIME_VALID
// values because, for this test, these are not considered
// to be error conditions.
DWORD statusFlagMask = ~(
CERT_TRUST_REVOCATION_STATUS_UNKNOWN |
CERT_TRUST_IS_OFFLINE_REVOCATION |
CERT_TRUST_IS_NOT_TIME_VALID);
if (CERT_TRUST_NO_ERROR == (certificateStatus & statusFlagMask))
{
// If *signatureStatus is already
// XPS_SIGNATURE_STATUS_VALID then there is no need to
// change the status as the certificate status has no
// certificate trust errors.
// If *signatureStatus is already
// XPS_SIGNATURE_STATUS_QUESTIONABLE then we will not
// upgrade the trust status of the signature just
// because there is no trust issue with the certificate.
}
else
{
// If trust errors were detected with the certificate,
// then this XPS signature is given a status of
// XPS_SIGNATURE_STATUS_QUESTIONABLE
*signatureStatus = XPS_SIGNATURE_STATUS_QUESTIONABLE;
}
// Handle additional certificate errors.
// This is not an exhaustive list of possible errors.
if (certificateStatus & CERT_TRUST_IS_NOT_TIME_VALID)
{
// The XPS Viewer considers signatures with
// expired certificates as valid.
}
if (certificateStatus & CERT_TRUST_IS_PARTIAL_CHAIN)
{
// This test ensures that we only degrade the
// trust status and never upgrade it
if (XPS_SIGNATURE_STATUS_VALID == *signatureStatus)
{
*signatureStatus = XPS_SIGNATURE_STATUS_QUESTIONABLE;
}
}
if (certificateStatus & CERT_TRUST_IS_NOT_SIGNATURE_VALID)
{
// This test ensures that we only degrade the
// trust status and never upgrade it
if (XPS_SIGNATURE_STATUS_VALID == *signatureStatus)
{
*signatureStatus = XPS_SIGNATURE_STATUS_QUESTIONABLE;
}
}
if (certificateStatus & CERT_TRUST_IS_SELF_SIGNED)
{
// This test ensures that we only degrade the
// trust status and never upgrade it
if (XPS_SIGNATURE_STATUS_VALID == *signatureStatus)
{
*signatureStatus = XPS_SIGNATURE_STATUS_QUESTIONABLE;
}
}
if (certificateStatus & CERT_TRUST_IS_UNTRUSTED_ROOT)
{
// This test ensures that we only degrade the
// trust status and never upgrade it
if (XPS_SIGNATURE_STATUS_VALID == *signatureStatus)
{
*signatureStatus = XPS_SIGNATURE_STATUS_QUESTIONABLE;
}
}
}//End if
hr = certificatesInSignature->MoveNext(&moreCertificates);
if (FAILED(hr))
{
// ERROR: could not move to the next
// certificate in the enumerator
break; // out of do loop with failed hr
}
} while((*signatureStatus != XPS_SIGNATURE_STATUS_VALID) &&
moreCertificates);
} // end if successful
if (NULL != certificatesInSignature) certificatesInSignature->Release();
return hr;
}
在下一代码示例中，将通过调用下面的代码示例中所示的方法来获得证书信任状态。
HRESULT GetCertificateTrustStatus(
__in PCCERT_CONTEXT certificate,
__in HCERTSTORE* certificateStore,
__out DWORD* certificateStatus
)
{
HRESULT hr = S_OK;
// The certificate chain that will be created from
// the PCCERT_CONTEXT object passed in.
PCCERT_CHAIN_CONTEXT certificateChain = NULL;
hr = CreateCertificateChain(
certificate,
*certificateStore,
&certificateChain);
if (SUCCEEDED(hr)) {
*certificateStatus =
certificateChain->TrustStatus.dwErrorStatus;
}
return hr;
}
上一代码示例中使用的证书链是通过调用以下代码示例中所示的方法创建的。
HRESULT
CreateCertificateChain (
__in PCCERT_CONTEXT certificate,
__in HCERTSTORE certificateStore,
__out PCCERT_CHAIN_CONTEXT* certificateChain
)
{
HRESULT hr = S_OK;
CERT_CHAIN_PARA certificateChainParameters = {0};
certificateChainParameters.cbSize = sizeof(CERT_CHAIN_PARA);
certificateChainParameters.RequestedUsage.dwType = USAGE_MATCH_TYPE_AND;
// CertGetCertificateChain builds a certificate chain that starts
// from the PCCERT_CONTEXT structure provided by the caller.
// After the certificate chain has been successfully created,
// then the authenticity of the certificate can be determined
// by examining the errors, if any, that occurred while the chain
// was created.
BOOL successCreatingCertChain = CertGetCertificateChain (
NULL,
certificate,
NULL,
certificateStore,
&certificateChainParameters,
CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT,
NULL,
certificateChain);
if (!successCreatingCertChain)
{
hr = HRESULT_FROM_WIN32(GetLastError());
}
return hr;
}
相关主题
-
本部分使用的内容
-
详细信息
反馈
即将发布：在整个 2024 年，我们将逐步淘汰作为内容反馈机制的“GitHub 问题”，并将其取代为新的反馈系统。 有关详细信息，请参阅：https://aka.ms/ContentUserFeedback。
提交和查看相关反馈